Overview

overview

9

Static

static

3

2026-07-04...ry.exe

windows10-2004-x64

9

2026-07-04...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/07/2026, 22:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe
  • Size 1.5MB
  • Sample260704-1wvffsew21
  • SHA256 5dd3b9e1682561a05420d22c70700961de9746bb0d91eb0d66366cdcce6cb63d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 25 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 33 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Users\Admin\AppData\Local\Temp\2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3112
      • C:\ProgramData\Application Data\wmimgmt.exe
        "C:\ProgramData\Application Data\wmimgmt.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\ProgramData\Application Data\wmimgmt.exe
          "C:\ProgramData\Application Data\wmimgmt.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /v:on /c "C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2296
            • C:\Windows\SysWOW64\findstr.exe
              findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2480
            • C:\Windows\SysWOW64\chcp.com
              chcp
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2708
            • C:\Windows\SysWOW64\net.exe
              net user
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1060
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 user
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3532
            • C:\Windows\SysWOW64\net.exe
              net localgroup administrators
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1980
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 localgroup administrators
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4204
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              6⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:512
            • C:\Windows\SysWOW64\systeminfo.exe
              systeminfo
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers system information
              PID:1416
            • C:\Windows\SysWOW64\reg.exe
              reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:116
            • C:\Windows\SysWOW64\find.exe
              find "REG_"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4052
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1624
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1752
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1220
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:756
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3704
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4364
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1780
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:4788
            • C:\Windows\SysWOW64\NETSTAT.EXE
              netstat -ano
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Connections Discovery
              • Gathers network information
              • Suspicious use of AdjustPrivilegeToken
              PID:3872
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:868
            • C:\Windows\SysWOW64\NETSTAT.EXE
              netstat -r
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              • Suspicious use of WriteProcessMemory
              PID:816
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1288
                • C:\Windows\SysWOW64\ROUTE.EXE
                  C:\Windows\system32\route.exe print
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1396
            • C:\Windows\SysWOW64\net.exe
              net start
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4292
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start
                7⤵
                • System Location Discovery: System Language Discovery
                PID:812
            • C:\Windows\SysWOW64\net.exe
              net use
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2716
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo n"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3796
            • C:\Windows\SysWOW64\net.exe
              net share
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3524
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 share
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3732
            • C:\Windows\SysWOW64\net.exe
              net view /domain
              6⤵
              • System Location Discovery: System Language Discovery
              • Discovers systems in the same network
              PID:3376
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4916
            • C:\Windows\SysWOW64\find.exe
              find /i /v "------"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4196
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4264
            • C:\Windows\SysWOW64\find.exe
              find /i /v "domain"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3792
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4148
            • C:\Windows\SysWOW64\find.exe
              find /i /v "¬A╛╣"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3144
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3188
            • C:\Windows\SysWOW64\find.exe
              find /i /v "░⌡ªµª¿"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3428
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4400
            • C:\Windows\SysWOW64\find.exe
              find /i /v "├ⁿ┴ε"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2524
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4912
            • C:\Windows\SysWOW64\find.exe
              find /i /v "completed successfully"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:644
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:3332
  • C:\ProgramData\Application Data\wmimgmt.exe
    "C:\ProgramData\Application Data\wmimgmt.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3288
    • C:\ProgramData\Application Data\wmimgmt.exe
      "C:\ProgramData\Application Data\wmimgmt.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4724
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1876
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1836
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4136
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:3956
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2196
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2180
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:3360
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3264
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:4388
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    PID:952
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:3520
  • C:\Windows\system32\spectrum.exe
    C:\Windows\system32\spectrum.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    PID:696
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:4252
  • C:\Windows\system32\TieringEngineService.exe
    C:\Windows\system32\TieringEngineService.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:4632
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
    1⤵
      PID:2456
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4600
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Executes dropped EXE
      PID:4676
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3064
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3204
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Executes dropped EXE
      PID:1708
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:4020
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
        2⤵
        • Modifies data under HKEY_USERS
        PID:3976

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Persistence

          Account Manipulation

          1
          T1098

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Account Manipulation

          1
          T1098

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          2
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Windows Credential Manager

          1
          T1555.004

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Network Service Discovery

          1
          T1046

          Network Share Discovery

          1
          T1135

          Peripheral Device Discovery

          2
          T1120

          Permission Groups Discovery

          1
          T1069

          Local Groups

          1
          T1069.001

          Process Discovery

          1
          T1057

          Query Registry

          3
          T1012

          Remote System Discovery

          1
          T1018

          System Information Discovery

          6
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Connections Discovery

          1
          T1049

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          elevation_service.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          • Size 2.7MB
          • SHA256 516666613137fd43c142063dda3614b4467755b54f9b39ef5334a810142b9682
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          maintenanceservice.exe
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          • Size 1.4MB
          • SHA256 d7df2465b2179c5fe8c7f3de9151cf6e623b79aee90528dfea031068be80905a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.exe
          • Path C:\Program Files\7-Zip\7z.exe
          • Size 1.7MB
          • SHA256 0da98e57885af67df7be288d1f964499b2e78aa63c6428469013a77f4c1c5544
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zFM.exe
          • Path C:\Program Files\7-Zip\7zFM.exe
          • Size 1.5MB
          • SHA256 e571349f5e2d26afe9e5dae7a2315b20ba3b0d876334edd223ce0314431b9020
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zG.exe
          • Path C:\Program Files\7-Zip\7zG.exe
          • Size 1.2MB
          • SHA256 933e86207fa4b91508426db131bfa839a6f208534649ea5614e580aaa570fee6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 1.2MB
          • SHA256 559e82cd1d1f225e00bc10d7341d63a9bf281996a88467da97d3608a16d45356
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVShNotify.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
          • Size 1.4MB
          • SHA256 05a0c8df51060c2ac20ede803082d22a93241638b1c160a0304127605bbe4ed8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IntegratedOffice.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
          • Size 4.6MB
          • SHA256 2c3348a3699e883474ed13f4be57b22cb699babd9d431d4a74ce903e080b842a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MavInject32.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
          • Size 1.5MB
          • SHA256 57a7c3c712596e307750328a7f2a6ed14f5071ec1c82f709c86a34d1063c8486
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OfficeC2RClient.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
          • Size 24.0MB
          • SHA256 18d4fb2c7bd99c02f33f799eeb93157d844b5dca6722e8a39b123dadc989d840
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appvcleaner.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
          • Size 2.7MB
          • SHA256 16c38003098de7aebe08aeaf40c7d6aa6f5df893b9ff70e3304b183a9e655586
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LICLUA.EXE
          • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
          • Size 1.1MB
          • SHA256 9cc2cde4eedf68d26e04b59f3b5d1239815c9e0f58b12386ebfd3505a4f40c58
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSE.EXE
          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
          • Size 1.4MB
          • SHA256 af7c22f6af2eb00b5b8afe04e0f7633ef7e61525578ed265f8fec81d854f4bb0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSTOInstaller.exe
          • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
          • Size 1.3MB
          • SHA256 e0508297fcda824b4d1d05c4bcfdb87e8efccfc0622c473877ceadace843e734
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrmstp.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
          • Size 6.6MB
          • SHA256 4ff7848bf031bce903e898fc04d97136463cefd135504a6bdcf0bc33e8ae8186
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
          • Size 6.6MB
          • SHA256 c46b87904c7edd753c9164434e56ad0229870403b0a7be7d476afd57e9b5fbf8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_pwa_launcher.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
          • Size 2.3MB
          • SHA256 5f9b2c771a1c897b5199eb644c8cdbe4b4cb61507023823da88aabee6b5a82df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevated_tracing_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
          • Size 4.0MB
          • SHA256 2702adc34d37b2c3ee9c96e7db0bd77cbac33bd6a61f4c00f4584cd74fba27f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 2.8MB
          • SHA256 bd5f93cdd8b89d3f9294beb43d5b58355c0b792ed332d6577d9e1999ffbac841
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_helper.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
          • Size 2.2MB
          • SHA256 e7abc396611ccf973d82c46aa849894e32fa09d4956691bf63fa7f4970cce02c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          os_update_handler.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
          • Size 2.4MB
          • SHA256 794e02972e368e590ddb8e2f4af29487d9128197a0dec5de2331aca989552646
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_proxy.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
          • Size 2.0MB
          • SHA256 f40c5616c7793610b45b488c006aa15bb93d399f6a1265d82b81a9d7c7a8256f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appletviewer.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
          • Size 1.2MB
          • SHA256 4c1a93f7612963295f63caa4d2eff8200e04c029035d703efa155303c012a90a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          extcheck.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
          • Size 1.2MB
          • SHA256 f2ee8dee3783672a75e622aa749f8b01da9d3d877fe8168dfb2bab15aabcb087
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          idlj.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
          • Size 1.2MB
          • SHA256 cbf4ae5b69f096c1472f6d6b9ff357a697e55717611ed6ecfa2abd6ac66f015c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jabswitch.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
          • Size 1.2MB
          • SHA256 8297ecf467f5c0986a2ce97dbe8d13d4768935a7a579a793550788f4e33e200f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jar.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
          • Size 1.2MB
          • SHA256 8eaf4685dff9ab0d9880826148881320670f075fc67893482a869aa4e3612e63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.exe
          • Path C:\Program Files\dotnet\dotnet.exe
          • Size 1.3MB
          • SHA256 630209b8d35aadc47dd147dc96f2ebae4380ba40efb167cec6d1b001db10f55e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wmimgmt.exe
          • Path C:\ProgramData\wmimgmt.exe
          • Size 1.5MB
          • SHA256 5dd3b9e1682561a05420d22c70700961de9746bb0d91eb0d66366cdcce6cb63d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          INFO.TXT
          • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
          • Size 38.1MB
          • SHA256 f56fe89b80e7441ae21366fdd5c600601ade677510a5f41dcdf70bdec6218ad4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          INFO.TXT
          • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
          • Size 12KB
          • SHA256 435136519fc937000ef6d5b9e5ec2d7fb708a5f0503d0859df821bb607bea6b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          drivers.p
          • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\drivers.p
          • Size 15B
          • SHA256 6b8ceb900443f4924efd3187693038965ad7edb488879305489aa72d78f69626
          • MD5 SHA1 SHA512
          Submit Download

          ghi.bat
          • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat
          • Size 3KB
          • SHA256 1ebd7eae014cf21830a64f251bf768e2935fa3de5223dcb86f3e69dc88c384c8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          INFO.TXT
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\INFO.TXT
          • Size 43B
          • SHA256 a0a507233d6f7fd8aa380b51a3422ddd52adef52b904a6a105f7c8b65b554afe
          • MD5 SHA1 SHA512
          Submit Download

          INFO.TXT
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\INFO.TXT
          • Size 21KB
          • SHA256 f2b790b9950808dc036936f5f042ab9c400741640e314a8191bb2bf06fbf49cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AC#584C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\AC#584C.tmp
          • Size 59B
          • SHA256 a31dae29fef8c035c25ad6b869055484e60642297c50ccfcdbb8562dfe3f2938
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          651bbf6d905883c7.bin
          • Path C:\Users\Admin\AppData\Roaming\651bbf6d905883c7.bin
          • Size 12KB
          • SHA256 86d428266f2774df7b4ef962338403f5b52759d25fd2a221e70a8ce3e0208453
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          perfhost.exe
          • Path C:\Windows\SysWOW64\perfhost.exe
          • Size 1.2MB
          • SHA256 dbd235325c46bf44b67c924a4a4699da87bee6b77307b061548cd9bf2bf1dbd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AgentService.exe
          • Path C:\Windows\System32\AgentService.exe
          • Size 1.7MB
          • SHA256 f835f1eb44b863a805bddf5028f2f0b641b7a6d431cfe3e7ba5bbd4f84bccf9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DiagnosticsHub.StandardCollector.Service.exe
          • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
          • Size 1.2MB
          • SHA256 c3197358c8dd9b173a10f34be7ccb68719c939abe0d2786fd7bc9d2d7d825bcb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Locator.exe
          • Path C:\Windows\System32\Locator.exe
          • Size 1.2MB
          • SHA256 a69223c3859e152bd0d854c7585753dee11d0a59aeb0cc26bfe3f366dabd3f6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssh-agent.exe
          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
          • Size 1.5MB
          • SHA256 7e2b9f023d29cbbefdf54b76d2a8d28d51885801236fbb343c3581a8da8c8f12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PerceptionSimulationService.exe
          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
          • Size 1.3MB
          • SHA256 527682f2a38f9d44d2f0cdbb0675d5c789dfa2ac85ad6600e5a8b086098c8a5d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SearchIndexer.exe
          • Path C:\Windows\System32\SearchIndexer.exe
          • Size 1.4MB
          • SHA256 2d554a693b31eea60dff2248599ab80fc4a2c1191ead4f5e3a8b52644c954157
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SensorDataService.exe
          • Path C:\Windows\System32\SensorDataService.exe
          • Size 1.8MB
          • SHA256 8751ec31ca214aa620dab624ebaf22f5204eb49309e7fd2e0171e65e25c17312
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Spectrum.exe
          • Path C:\Windows\System32\Spectrum.exe
          • Size 1.4MB
          • SHA256 b2d1ae2b97e4a905ded8c6aca912fc04042429e1a9d0729abae6b3ea261d1205
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TieringEngineService.exe
          • Path C:\Windows\System32\TieringEngineService.exe
          • Size 1.5MB
          • SHA256 2d529efa87efdbf2daa762430ec398d06351ce246e61c9bb199cf80937db5319
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSSVC.exe
          • Path C:\Windows\System32\VSSVC.exe
          • Size 2.0MB
          • SHA256 cf15eb6c1f96af73860495520959e487335822300e304f6c594451c7b4567268
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          alg.exe
          • Path C:\Windows\System32\alg.exe
          • Size 1.3MB
          • SHA256 19093c1d4e7dbd31d33a0dc86b057c7cf7206a33d9e8f97b76792858d6975643
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msdtc.exe
          • Path C:\Windows\System32\msdtc.exe
          • Size 1.3MB
          • SHA256 443e1ff6fa2ace52b86ff120c4d63fdee34a939b1740a8ccdf683a6b4aaa5038
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snmptrap.exe
          • Path C:\Windows\System32\snmptrap.exe
          • Size 1.2MB
          • SHA256 e5bdda372bcc068d4209bc693d42804c4a2d32e23316ca73f398916c7327e6c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vds.exe
          • Path C:\Windows\System32\vds.exe
          • Size 1.3MB
          • SHA256 5651cfd8ead0c2fcb7785fd7b965726e3434d1a4d8670f82cc54839d6c99b4cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WmiApSrv.exe
          • Path C:\Windows\System32\wbem\WmiApSrv.exe
          • Size 1.4MB
          • SHA256 c1cb047cbe2ac50da77bab84c23d028501ee44a841789faa612658c9ced99bcc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wbengine.exe
          • Path C:\Windows\System32\wbengine.exe
          • Size 2.1MB
          • SHA256 fab2993ded3e3c0adcf0e5f4c3b6201ee88c3a26a1efd0bc19175cf083a5db11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVClient.exe
          • Path C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\AppVClient.exe
          • Size 1.3MB
          • SHA256 442a6606884d03bb067b26abf7e0ae7fb8f9d437aec708c0645f7b866c98e39b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DiagnosticsHub.StandardCollector.Service.exe
          • Path C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.928_none_0f531ea0d233243b\DiagnosticsHub.StandardCollector.Service.exe
          • Size 655KB
          • SHA256 7f911e183c0891880a1c1af370baa53c58831516cd64ceec2fa8d5aaed797a42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fxssvc.exe
          • Path C:\Windows\system32\fxssvc.exe
          • Size 1.2MB
          • SHA256 2f5212de3853cee0afe6ee02e96bd80bdd510dfbb70afa8e248f4c76d189fbd1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/696-364-0x00000000006D0000-0x0000000000730000-memory.dmp
          Download

          memory/696-371-0x00000000006D0000-0x0000000000730000-memory.dmp
          Download

          memory/696-370-0x0000000140000000-0x0000000140169000-memory.dmp
          Download

          memory/696-638-0x0000000140000000-0x0000000140169000-memory.dmp
          Download

          memory/952-586-0x0000000140000000-0x00000001401D7000-memory.dmp
          Download

          memory/952-357-0x0000000140000000-0x00000001401D7000-memory.dmp
          Download

          memory/952-635-0x0000000140000000-0x00000001401D7000-memory.dmp
          Download

          memory/1152-15-0x0000000000400000-0x000000000057C000-memory.dmp
          Download

          memory/1152-8-0x00000000007A0000-0x0000000000807000-memory.dmp
          Download

          memory/1152-2-0x00000000007A0000-0x0000000000807000-memory.dmp
          Download

          memory/1152-0-0x0000000000400000-0x000000000057C000-memory.dmp
          Download

          memory/1708-428-0x0000000140000000-0x0000000140166000-memory.dmp
          Download

          memory/1836-110-0x0000000140000000-0x00000001402E9000-memory.dmp
          Download

          memory/1836-299-0x0000000140000000-0x00000001402E9000-memory.dmp
          Download

          memory/1836-108-0x0000000000720000-0x0000000000780000-memory.dmp
          Download

          memory/1836-102-0x0000000000720000-0x0000000000780000-memory.dmp
          Download

          memory/1876-85-0x00000000006B0000-0x0000000000710000-memory.dmp
          Download

          memory/1876-91-0x00000000006B0000-0x0000000000710000-memory.dmp
          Download

          memory/1876-93-0x0000000140000000-0x0000000140136000-memory.dmp
          Download

          memory/2068-431-0x0000000001770000-0x0000000001780000-memory.dmp
          Download

          memory/2068-447-0x0000000001A20000-0x0000000001A30000-memory.dmp
          Download

          memory/2068-463-0x0000000009E60000-0x0000000009E68000-memory.dmp
          Download

          memory/2068-429-0x0000000140000000-0x0000000140179000-memory.dmp
          Download

          memory/2068-468-0x000000000CDC0000-0x000000000CDC8000-memory.dmp
          Download

          memory/2068-643-0x0000000140000000-0x0000000140179000-memory.dmp
          Download

          memory/2180-467-0x0000000140000000-0x0000000140159000-memory.dmp
          Download

          memory/2180-326-0x0000000140000000-0x0000000140159000-memory.dmp
          Download

          memory/2196-138-0x00000000007D0000-0x0000000000830000-memory.dmp
          Download

          memory/2196-307-0x0000000140000000-0x000000014016F000-memory.dmp
          Download

          memory/2196-144-0x00000000007D0000-0x0000000000830000-memory.dmp
          Download

          memory/2196-147-0x0000000140000000-0x000000014016F000-memory.dmp
          Download

          memory/3064-642-0x0000000140000000-0x00000001401FC000-memory.dmp
          Download

          memory/3064-426-0x0000000140000000-0x00000001401FC000-memory.dmp
          Download

          memory/3112-22-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/3204-427-0x0000000140000000-0x0000000140216000-memory.dmp
          Download

          memory/3264-350-0x0000000000610000-0x0000000000677000-memory.dmp
          Download

          memory/3264-344-0x0000000000400000-0x0000000000537000-memory.dmp
          Download

          memory/3264-471-0x0000000000400000-0x0000000000537000-memory.dmp
          Download

          memory/3264-345-0x0000000000610000-0x0000000000677000-memory.dmp
          Download

          memory/3288-75-0x0000000000980000-0x00000000009E7000-memory.dmp
          Download

          memory/3288-82-0x0000000000400000-0x000000000057C000-memory.dmp
          Download

          memory/3288-80-0x0000000000980000-0x00000000009E7000-memory.dmp
          Download

          memory/3288-99-0x0000000000400000-0x000000000057C000-memory.dmp
          Download

          memory/3332-12-0x0000000140000000-0x000000014014A000-memory.dmp
          Download

          memory/3332-65-0x0000000140000000-0x000000014014A000-memory.dmp
          Download

          memory/3360-333-0x0000000000B50000-0x0000000000BB0000-memory.dmp
          Download

          memory/3360-470-0x0000000140000000-0x000000014014B000-memory.dmp
          Download

          memory/3360-341-0x0000000140000000-0x000000014014B000-memory.dmp
          Download

          memory/3360-339-0x0000000000B50000-0x0000000000BB0000-memory.dmp
          Download

          memory/3520-362-0x0000000140000000-0x0000000140136000-memory.dmp
          Download

          memory/3520-636-0x0000000140000000-0x0000000140136000-memory.dmp
          Download

          memory/3956-130-0x0000000000D10000-0x0000000000D70000-memory.dmp
          Download

          memory/3956-132-0x0000000140000000-0x0000000140175000-memory.dmp
          Download

          memory/3956-124-0x0000000000D10000-0x0000000000D70000-memory.dmp
          Download

          memory/3956-135-0x0000000000D10000-0x0000000000D70000-memory.dmp
          Download

          memory/3956-146-0x0000000140000000-0x0000000140175000-memory.dmp
          Download

          memory/3976-485-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-489-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-474-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-479-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-480-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-481-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-482-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-488-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-494-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-495-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-496-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-497-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-498-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-499-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-500-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-472-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-473-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-477-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-476-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-475-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-478-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-487-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-486-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-490-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-484-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-483-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-493-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-492-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/3976-491-0x000002A485320000-0x000002A485330000-memory.dmp
          Download

          memory/4136-113-0x0000000000890000-0x00000000008F0000-memory.dmp
          Download

          memory/4136-300-0x0000000140000000-0x00000001402D4000-memory.dmp
          Download

          memory/4136-119-0x0000000000890000-0x00000000008F0000-memory.dmp
          Download

          memory/4136-121-0x0000000140000000-0x00000001402D4000-memory.dmp
          Download

          memory/4252-382-0x0000000000720000-0x0000000000780000-memory.dmp
          Download

          memory/4252-639-0x0000000140000000-0x00000001401A2000-memory.dmp
          Download

          memory/4252-424-0x0000000140000000-0x00000001401A2000-memory.dmp
          Download

          memory/4388-553-0x0000000140000000-0x0000000140135000-memory.dmp
          Download

          memory/4388-354-0x0000000140000000-0x0000000140135000-memory.dmp
          Download

          memory/4580-71-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/4580-310-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/4580-66-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/4580-320-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/4580-314-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/4580-73-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/4580-316-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/4580-298-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/4600-389-0x0000000140000000-0x00000001401C0000-memory.dmp
          Download

          memory/4632-430-0x0000000140000000-0x0000000140182000-memory.dmp
          Download

          memory/4676-425-0x0000000140000000-0x0000000140147000-memory.dmp
          Download

          memory/4784-30-0x0000000000970000-0x00000000009D7000-memory.dmp
          Download

          memory/4784-36-0x0000000000400000-0x000000000057C000-memory.dmp
          Download

          memory/4784-23-0x0000000000970000-0x00000000009D7000-memory.dmp
          Download