Overview

overview

8

Static

static

5

SaruzziGrabber.exe

windows10-2004-x64

8

SaruzziGrabber.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/06/2026, 14:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SaruzziGrabber.exe
  • Size 25.0MB
  • Sample260627-ryencaby8p
  • SHA256 23a2a23eb5ddbaf41d0cf9c57ac7d267387fa7a20796f23916ddf0597cfbdbce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespywareupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 31 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 6 IoCs
    discovery
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe
    "C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe
      "C:\Users\Admin\AppData\Local\Temp\SaruzziGrabber.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5460
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "imagename eq processmonitor.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5688
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "imagename eq procmon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:948
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "imagename eq regmon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1828
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "imagename eq filemon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3368
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "imagename eq wireshark.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3388
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "imagename eq tcpview.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4680
  • C:\Windows\system32\userinit.exe
    C:\Windows\system32\userinit.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2240
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4964
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3380

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_bz2.pyd
        • Size 48KB
        • SHA256 d252417d3f2385c0d7a01495b5fcf66b41b0b816bdb102c0b20ffec36e0c1088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_ctypes.pyd
        • Size 59KB
        • SHA256 f70b293b16a4931ce530d4173db83684b0b0faeaa7fcdc214118005ae8bd21b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_hashlib.pyd
        • Size 35KB
        • SHA256 5bbc32ab89206a36252e5e21d09d8dfc5842407f1401f865584c602ef5d9a1e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_lzma.pyd
        • Size 86KB
        • SHA256 3a3cc0995fe194b76614d4336c2f778d0d5444813ef56d47074d22dacc0b2a4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_queue.pyd
        • Size 26KB
        • SHA256 ab421e4a864a116a90c9fa3b0691b55866f5a2fb398f204d16859332cf97b07d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_socket.pyd
        • Size 44KB
        • SHA256 32feae7c64bcf48d6285fbaef478eae3295d69d6a471ba34d4b9db81a4031a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_sqlite3.pyd
        • Size 57KB
        • SHA256 c00388b1b70dc416c70bbd148f4f98b098f598bb07ca0ae511fe53d14e2f9eb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_ssl.pyd
        • Size 66KB
        • SHA256 17587e148c3449297e787e1e7aca506347a886e121a552af23f37abf4ffe78bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_uuid.pyd
        • Size 25KB
        • SHA256 869361adf2be930e5c8b492fa2116dc0d0edccbf2c231d39c859ce320be27b31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\_wmi.pyd
        • Size 28KB
        • SHA256 8d2a91faa16cd202394643792f5918ee4207313b642b3049e168ce3a3a6f17dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\base_library.zip
        • Size 1.1MB
        • SHA256 33741d87fac49764b80a8f2d51a0cb6e3e9422c8cd29525879943d5f03f8789e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\charset_normalizer\md.cp312-win_amd64.pyd
        • Size 9KB
        • SHA256 5a9da73b4fbd936a411dda89b2b8b94a36a5cdf05b89552d55283839d8e5d594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
        • Size 40KB
        • SHA256 811fbfa9650a6ea97418bf35c3164286066605ead96d99111a6453c4e40fe78b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\libcrypto-3.dll
        • Size 1.6MB
        • SHA256 5bcb5de3eff2a80e7d57725ab9e5013f2df728e8a41278fe06d5ac4de91bd26c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\libffi-8.dll
        • Size 29KB
        • SHA256 7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\libssl-3.dll
        • Size 221KB
        • SHA256 5027010163bfecded82cb733e971c37a4d71653974813e96839f1b4e99412a60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\psutil\_psutil_windows.pyd
        • Size 32KB
        • SHA256 bcfe492ce80b0e654982154dff1f208e2dc85bd7ff82aac4b8c1a6fb2ceb47c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\pyexpat.pyd
        • Size 88KB
        • SHA256 e9e9e241e25e02fce140a616221e74e6bb171c2e6e30328c47fa8d73f26c4e65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\python3.dll
        • Size 66KB
        • SHA256 d52baca085f88b40f30c855e6c55791e5375c80f60f94057061e77e33f4cad7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\python312.dll
        • Size 1.7MB
        • SHA256 c4e1f126e4dd4022bc4bdcaeb02e3b5cf907bdfa16b8c015ad2925482e0ddb0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\pywin32_system32\pythoncom312.dll
        • Size 197KB
        • SHA256 318c78e6ecff4677865b71499cd91531ee2fbe32e3f89483e37307b3c7f774ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\pywin32_system32\pywintypes312.dll
        • Size 62KB
        • SHA256 63418f11f24815033da3660e5c04726273a144ab7a44fad61c156b811fcaa1ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\select.pyd
        • Size 25KB
        • SHA256 2b445e046d4dff6d0b4b8bf962eea8fdefaadb157cb3309bf7ef1eac24c7cb33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\sqlite3.dll
        • Size 643KB
        • SHA256 4989665577a6cc875616d5b8feac5a1992ce1d1ae5d9ad39a3d70f3642a0b342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Conakry
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Africa\Conakry
        • Size 130B
        • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Djibouti
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Africa\Djibouti
        • Size 191B
        • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Kigali
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Africa\Kigali
        • Size 131B
        • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lagos
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Africa\Lagos
        • Size 180B
        • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Curacao
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\America\Curacao
        • Size 177B
        • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Toronto
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\America\Toronto
        • Size 1KB
        • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EST
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\EST
        • Size 149B
        • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Greenwich
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Etc\Greenwich
        • Size 111B
        • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
        • MD5 SHA1 SHA512
        Submit Download

        London
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Europe\London
        • Size 1KB
        • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Oslo
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Europe\Oslo
        • Size 705B
        • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Skopje
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Europe\Skopje
        • Size 478B
        • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MET
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\MET
        • Size 1KB
        • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PRC
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\PRC
        • Size 393B
        • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Wallis
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Pacific\Wallis
        • Size 134B
        • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Yap
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\Pacific\Yap
        • Size 154B
        • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UCT
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\UCT
        • Size 111B
        • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
        • MD5 SHA1 SHA512
        Submit Download

        Mountain
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\tzdata\zoneinfo\US\Mountain
        • Size 1KB
        • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\ucrtbase.dll
        • Size 1.1MB
        • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\unicodedata.pyd
        • Size 295KB
        • SHA256 424b5fb8bc2adbfdc6342802756fa43bdf5c8db245396cf9ffef2ad2de33ed62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\win32\win32api.pyd
        • Size 50KB
        • SHA256 fa1c0aab978c180af3ddb615f833a37f2411ba9a6f0f2f6dbb9db2234bd324a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\win32\win32crypt.pyd
        • Size 52KB
        • SHA256 844ebcdee507eba77584becbe327ddda86cfe72ff14787e944df18a038cbe3be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32event.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45682\win32\win32event.pyd
        • Size 16KB
        • SHA256 8d69e5b0a32cd849128ec76aab91aeb2959c7b67380fb9b33db0636935ced6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3380-908-0x000001E102910000-0x000001E102930000-memory.dmp
        Download

        memory/3380-939-0x000001E1141F0000-0x000001E114210000-memory.dmp
        Download

        memory/3380-898-0x000001E1001E0000-0x000001E1002E0000-memory.dmp
        Download

        memory/3380-900-0x000001E1001E0000-0x000001E1002E0000-memory.dmp
        Download

        memory/3380-909-0x000001E102D50000-0x000001E102E50000-memory.dmp
        Download

        memory/3380-932-0x000001E102C30000-0x000001E102C50000-memory.dmp
        Download

        memory/3660-849-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
        Download

        memory/4568-783-0x00007FF73DDB0000-0x00007FF73DE1F000-memory.dmp
        Download

        memory/4568-877-0x00007FF73DDB0000-0x00007FF73DE1F000-memory.dmp
        Download

        memory/4568-879-0x00007FF73DDB0000-0x00007FF73DE1F000-memory.dmp
        Download

        memory/4568-0-0x00007FF73DDB0000-0x00007FF73DE1F000-memory.dmp
        Download

        memory/5460-847-0x00007FFF9B5D0000-0x00007FFF9B5F4000-memory.dmp
        Download

        memory/5460-872-0x00007FFFA2590000-0x00007FFFA25AB000-memory.dmp
        Download

        memory/5460-776-0x00007FFFA69B0000-0x00007FFFA69C9000-memory.dmp
        Download

        memory/5460-820-0x00007FFF8FC00000-0x00007FFF8FD7F000-memory.dmp
        Download

        memory/5460-818-0x00007FFF9B5D0000-0x00007FFF9B5F4000-memory.dmp
        Download

        memory/5460-814-0x00007FFF9B1A0000-0x00007FFF9B2BA000-memory.dmp
        Download

        memory/5460-772-0x00007FFFA69D0000-0x00007FFFA69FC000-memory.dmp
        Download

        memory/5460-824-0x00007FFF9B5A0000-0x00007FFF9B5CA000-memory.dmp
        Download

        memory/5460-828-0x00007FFF9B170000-0x00007FFF9B19F000-memory.dmp
        Download

        memory/5460-827-0x00007FFF8FE50000-0x00007FFF90383000-memory.dmp
        Download

        memory/5460-826-0x00007FFFA25B0000-0x00007FFFA25C4000-memory.dmp
        Download

        memory/5460-764-0x00007FFFA6A20000-0x00007FFFA6A45000-memory.dmp
        Download

        memory/5460-831-0x00007FFFA2590000-0x00007FFFA25AB000-memory.dmp
        Download

        memory/5460-766-0x00007FFFA6F50000-0x00007FFFA6F5F000-memory.dmp
        Download

        memory/5460-834-0x00007FFF8FAD0000-0x00007FFF8FB91000-memory.dmp
        Download

        memory/5460-809-0x00007FFFA2620000-0x00007FFFA262B000-memory.dmp
        Download

        memory/5460-837-0x00007FFF90E30000-0x00007FFF90E5C000-memory.dmp
        Download

        memory/5460-811-0x00007FFF9B640000-0x00007FFF9B668000-memory.dmp
        Download

        memory/5460-842-0x00007FFFA16F0000-0x00007FFFA1700000-memory.dmp
        Download

        memory/5460-770-0x00007FFFA6A00000-0x00007FFFA6A19000-memory.dmp
        Download

        memory/5460-845-0x00007FFF9B640000-0x00007FFF9B668000-memory.dmp
        Download

        memory/5460-846-0x00007FFF9B1A0000-0x00007FFF9B2BA000-memory.dmp
        Download

        memory/5460-805-0x00007FFF9B600000-0x00007FFF9B633000-memory.dmp
        Download

        memory/5460-848-0x00007FFF8FC00000-0x00007FFF8FD7F000-memory.dmp
        Download

        memory/5460-787-0x00007FFFA25D0000-0x00007FFFA2606000-memory.dmp
        Download

        memory/5460-850-0x00007FF73DDB0000-0x00007FF73DE1F000-memory.dmp
        Download

        memory/5460-859-0x00007FFFA25D0000-0x00007FFFA2606000-memory.dmp
        Download

        memory/5460-861-0x00007FFFA25B0000-0x00007FFFA25C4000-memory.dmp
        Download

        memory/5460-851-0x00007FFF90390000-0x00007FFF90A52000-memory.dmp
        Download

        memory/5460-860-0x00007FFFA2930000-0x00007FFFA293D000-memory.dmp
        Download

        memory/5460-863-0x00007FFF9B600000-0x00007FFF9B633000-memory.dmp
        Download

        memory/5460-779-0x00007FFFA69A0000-0x00007FFFA69AD000-memory.dmp
        Download

        memory/5460-873-0x00007FFF8FAD0000-0x00007FFF8FB91000-memory.dmp
        Download

        memory/5460-869-0x00007FFF8FC00000-0x00007FFF8FD7F000-memory.dmp
        Download

        memory/5460-867-0x00007FFF9B1A0000-0x00007FFF9B2BA000-memory.dmp
        Download

        memory/5460-871-0x00007FFF9B170000-0x00007FFF9B19F000-memory.dmp
        Download

        memory/5460-874-0x00007FFF9B5A0000-0x00007FFF9B5CA000-memory.dmp
        Download

        memory/5460-870-0x00007FFF9B5A0000-0x00007FFF9B5CA000-memory.dmp
        Download

        memory/5460-866-0x00007FFF9B640000-0x00007FFF9B668000-memory.dmp
        Download

        memory/5460-862-0x00007FFF8FE50000-0x00007FFF90383000-memory.dmp
        Download

        memory/5460-865-0x00007FFFA2620000-0x00007FFFA262B000-memory.dmp
        Download

        memory/5460-868-0x00007FFF9B5D0000-0x00007FFF9B5F4000-memory.dmp
        Download

        memory/5460-876-0x00007FFFA16F0000-0x00007FFFA1700000-memory.dmp
        Download

        memory/5460-875-0x00007FFF90E30000-0x00007FFF90E5C000-memory.dmp
        Download

        memory/5460-864-0x00007FFF8FD80000-0x00007FFF8FE4E000-memory.dmp
        Download

        memory/5460-858-0x00007FFFA2950000-0x00007FFFA295F000-memory.dmp
        Download

        memory/5460-857-0x00007FFFA69A0000-0x00007FFFA69AD000-memory.dmp
        Download

        memory/5460-856-0x00007FFFA69B0000-0x00007FFFA69C9000-memory.dmp
        Download

        memory/5460-855-0x00007FFFA69D0000-0x00007FFFA69FC000-memory.dmp
        Download

        memory/5460-854-0x00007FFFA6A00000-0x00007FFFA6A19000-memory.dmp
        Download

        memory/5460-853-0x00007FFFA6F50000-0x00007FFFA6F5F000-memory.dmp
        Download

        memory/5460-852-0x00007FFFA6A20000-0x00007FFFA6A45000-memory.dmp
        Download

        memory/5460-792-0x00007FFFA2930000-0x00007FFFA293D000-memory.dmp
        Download

        memory/5460-791-0x00007FF73DDB0000-0x00007FF73DE1F000-memory.dmp
        Download

        memory/5460-756-0x00007FFF90390000-0x00007FFF90A52000-memory.dmp
        Download

        memory/5460-797-0x00007FFFA25B0000-0x00007FFFA25C4000-memory.dmp
        Download

        memory/5460-784-0x00007FFFA2950000-0x00007FFFA295F000-memory.dmp
        Download

        memory/5460-796-0x00007FFF90390000-0x00007FFF90A52000-memory.dmp
        Download

        memory/5460-802-0x00007FFF8FE50000-0x00007FFF90383000-memory.dmp
        Download

        memory/5460-803-0x00007FFFA6A20000-0x00007FFFA6A45000-memory.dmp
        Download

        memory/5460-804-0x00007FFF8FD80000-0x00007FFF8FE4E000-memory.dmp
        Download