Overview

overview

8

Static

static

3

multi tool.exe

windows10-2004-x64

7

multi tool.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    120s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 03:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    multi tool.exe
  • Size 21.3MB
  • Sample260629-d4wbdscs8y
  • SHA256 f30c6896adc5c94bb36a3b2e706d5c2b746ad89f4d22286dfc2cb52821b1e2ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 38 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\multi tool.exe
    "C:\Users\Admin\AppData\Local\Temp\multi tool.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Users\Admin\AppData\Local\Temp\multi tool.exe
      "C:\Users\Admin\AppData\Local\Temp\multi tool.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:3604
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:3820
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            3⤵
              PID:3608
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cls
              3⤵
                PID:4732
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4924
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:5940
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:752
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:5680

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 607B
                • SHA256 7c21835f01895c1ee4e12f81e71ef06a0f6e2b9281de493ff8ec95f913e9680d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 599B
                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
                • Size 211KB
                • SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\VCRUNTIME140.dll
                • Size 117KB
                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140_1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\VCRUNTIME140_1.dll
                • Size 48KB
                • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _asyncio.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_asyncio.pyd
                • Size 76KB
                • SHA256 13b374175108c266f4a5bdf907f990d0ccd5b486d0313856e08a60ba9bf856cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _brotli.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_brotli.cp314-win_amd64.pyd
                • Size 836KB
                • SHA256 44f02bcf2b15519a487cf653e16b5f9c65f26d0be559592878988ad47148fc5e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_bz2.pyd
                • Size 85KB
                • SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ctypes.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_ctypes.pyd
                • Size 139KB
                • SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _hashlib.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_hashlib.pyd
                • Size 67KB
                • SHA256 58c5c9ff93f989e2a233b8c5e06420ea73dd6c013e1f08d996fb0f2828eba0aa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_lzma.pyd
                • Size 157KB
                • SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _overlapped.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_overlapped.pyd
                • Size 56KB
                • SHA256 43b9e0bdc41646fc363f144bf050600dab647ce9e7c251a2b6d0e75358cb10cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _queue.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_queue.pyd
                • Size 35KB
                • SHA256 2a7bb0a53e86ae4982a6f64e2570137829a0be66537bb1c166913af273edbf0c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _socket.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_socket.pyd
                • Size 85KB
                • SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ssl.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_ssl.pyd
                • Size 180KB
                • SHA256 06f51fbe150c831af619890eea2d9fca9ce8b49758bfe3f382883551c592e6b3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _uuid.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_uuid.pyd
                • Size 27KB
                • SHA256 35f26f7f55ded30da92ed30258fb9624a7398ba3eadee134813133c560fcbbae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _wmi.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_wmi.pyd
                • Size 39KB
                • SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _zstd.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\_zstd.pyd
                • Size 491KB
                • SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _http_parser.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\aiohttp\_http_parser.cp314-win_amd64.pyd
                • Size 254KB
                • SHA256 58600458c9e56edf441bf4b9c3da2dfb0e8e3944359c07083633a34047697473
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _http_writer.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\aiohttp\_http_writer.cp314-win_amd64.pyd
                • Size 45KB
                • SHA256 7b27d739088e56760a99a84a9bb8b3b8ae372268a13e5e1b8de8bc1854ced5c9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                base_library.zip
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\base_library.zip
                • Size 1.3MB
                • SHA256 7becb2f3d4bba1e3938c61053fc2401e98eae6893c9ec3cad84ae8155324cd25
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cacert.pem
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\certifi\cacert.pem
                • Size 266KB
                • SHA256 fc9165a12403263e7ebfbdad7be7a3eac0fa5d325d3c70465f28d3690072ca28
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cd.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\charset_normalizer\cd.cp314-win_amd64.pyd
                • Size 10KB
                • SHA256 da3ce780d6d58ae8c6920b99f806f64d58a1b33f4a01382861b01b50549199f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libcrypto-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\libcrypto-3.dll
                • Size 5.0MB
                • SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libffi-8.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\libffi-8.dll
                • Size 38KB
                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libssl-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\libssl-3.dll
                • Size 776KB
                • SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _multidict.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\multidict\_multidict.cp314-win_amd64.pyd
                • Size 75KB
                • SHA256 258d185776cf6b35c244cd134cdda9405f74de222c927d0bdbb9fd6d926ae5ce
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _helpers_c.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\propcache\_helpers_c.cp314-win_amd64.pyd
                • Size 62KB
                • SHA256 a99ae23a73ddb7ec61b251d85402ca266ce02dd5365cd8a550d8b1c6c453a57d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python3.DLL
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\python3.DLL
                • Size 72KB
                • SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python314.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\python314.dll
                • Size 6.5MB
                • SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                select.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\select.pyd
                • Size 32KB
                • SHA256 56441c3148743a0890986ccdf93fea8174155b0ee84db2493151f075d8e7c51a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Lorem ipsum.txt
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                • Size 1KB
                • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Conakry
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Africa\Conakry
                • Size 130B
                • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Djibouti
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Africa\Djibouti
                • Size 191B
                • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Kigali
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Africa\Kigali
                • Size 131B
                • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Lagos
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Africa\Lagos
                • Size 180B
                • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Curacao
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\America\Curacao
                • Size 177B
                • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Toronto
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\America\Toronto
                • Size 1KB
                • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                EST
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\EST
                • Size 149B
                • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Greenwich
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Etc\Greenwich
                • Size 111B
                • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
                • MD5 SHA1 SHA512
                Submit Download

                London
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Europe\London
                • Size 1KB
                • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Oslo
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Europe\Oslo
                • Size 705B
                • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Skopje
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Europe\Skopje
                • Size 478B
                • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MET
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\MET
                • Size 1KB
                • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                PRC
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\PRC
                • Size 393B
                • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Wallis
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Pacific\Wallis
                • Size 134B
                • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Yap
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\Pacific\Yap
                • Size 154B
                • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                UCT
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\UCT
                • Size 111B
                • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
                • MD5 SHA1 SHA512
                Submit Download

                Mountain
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\tzdata\zoneinfo\US\Mountain
                • Size 1KB
                • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                unicodedata.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\unicodedata.pyd
                • Size 740KB
                • SHA256 58013696b4f08717aee2885aefa24031f4b18b3e62faa8125248cc3e0a86af2a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _quoting_c.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\yarl\_quoting_c.cp314-win_amd64.pyd
                • Size 83KB
                • SHA256 7fcf93a3e1b34c59c731f34009e8a15592204e662e7a14207f33a2f9d1110c4a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                backend_c.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI33882\zstandard\backend_c.cp314-win_amd64.pyd
                • Size 510KB
                • SHA256 da3beaa10d453d8af37f650d04e031f2d83004c05d77d540b46407f8beda2e4f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/752-750-0x000001E300000000-0x000001E300100000-memory.dmp
                Download

                memory/752-798-0x000001E303A00000-0x000001E303A20000-memory.dmp
                Download

                memory/752-814-0x000001E313F80000-0x000001E313FA0000-memory.dmp
                Download

                memory/752-781-0x000001E3037A0000-0x000001E3037C0000-memory.dmp
                Download

                memory/752-782-0x000001E313C00000-0x000001E313D00000-memory.dmp
                Download

                memory/5680-936-0x000001F800070000-0x000001F80032C000-memory.dmp
                Download

                memory/5680-935-0x000001F84E000000-0x000001F84E691000-memory.dmp
                Download

                memory/5680-953-0x000001F800070000-0x000001F80032C000-memory.dmp
                Download