0ffb66b1c799a218d1e2512338e79e2b34a651a4015115d0464d61a9b98b437d

Analysis

max time kernel
40s
max time network
42s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/08/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DIVINE_protected.exe
Size 14.7MB
Sample260805-lp4cfsdl21
SHA256 0ffb66b1c799a218d1e2512338e79e2b34a651a4015115d0464d61a9b98b437d
MD5 42050fcda2c747033c2c7c37dc81c2ed
SHA1 8794fd682adaf4c86a93463f97c99ef0c9f53261
SHA512 34f193930177ba90abb961e1a4f8d813d1c2aef768db34e946d1146c978b8b008a5b9f7de9f962c1e0a29a0478bdc0bc5a35d25b763b5773680125488441e306
SSDEEP 196608:gpxZdQmcb9MjitgSYuvitXwsTNArdJPzlFZcXjalhRGYWBiVg0DpiKsepBqX4XPw:MxZymSOEYuvcRSJREahMARMKjpBqSq1
TLSH
T19DF63315B3CA7DB6C031AAF59A1428792393F4A786C9B1E314FF8769CC1624C9FE3605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DIVINE_protected.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DIVINE_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DIVINE_protected.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DIVINE_protected.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1800	DIVINE_protected.exe
1800	DIVINE_protected.exe
1800	DIVINE_protected.exe
1800	DIVINE_protected.exe
1800	DIVINE_protected.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1800	DIVINE_protected.exe
1800	DIVINE_protected.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4472	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	DIVINE_protected.exe
Token: SeShutdownPrivilege	1800	DIVINE_protected.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4472	1800	DIVINE_protected.exe	84
PID 4472 wrote to memory of 5096	4472	msedgewebview2.exe	85
PID 4472 wrote to memory of 5080	4472	msedgewebview2.exe	86
PID 4472 wrote to memory of 5080	4472	msedgewebview2.exe	86
PID 4472 wrote to memory of 5080	4472	msedgewebview2.exe	86
PID 4472 wrote to memory of 3788	4472	msedgewebview2.exe	87
PID 4472 wrote to memory of 4244	4472	msedgewebview2.exe	88
PID 4472 wrote to memory of 4244	4472	msedgewebview2.exe	88
PID 4472 wrote to memory of 2196	4472	msedgewebview2.exe	89
PID 4472 wrote to memory of 2196	4472	msedgewebview2.exe	89
PID 4472 wrote to memory of 2196	4472	msedgewebview2.exe	89

C:\Users\Admin\AppData\Local\Temp\DIVINE_protected.exe
"C:\Users\Admin\AppData\Local\Temp\DIVINE_protected.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=DIVINE_protected.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1800.2660.17830914765816319295
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd4385b078,0x7ffd4385b084,0x7ffd4385b090
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView" --webview-exe-name=DIVINE_protected.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1840,i,402906179367762736,8491353808132996284,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView" --webview-exe-name=DIVINE_protected.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2076,i,402906179367762736,8491353808132996284,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView" --webview-exe-name=DIVINE_protected.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,402906179367762736,8491353808132996284,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView" --webview-exe-name=DIVINE_protected.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3520,i,402906179367762736,8491353808132996284,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fda542851147f119f6b8d4d4aa1feb240225c12917e6a73f47c31770f34732a8
MD5 42f89023c41ab78ba10ba0938659503d
SHA1 457493bf1a36d0e92cc46f7ea592f43203cafacf
SHA512 b6883361dfc0ac31907919b40a6ee6066102b0373bb0edad56170c6dffdef4ac0020402f7fe620558e106b31cffc3e787a3fe30db82695facd3249b5556beea8
TLSH
T10FD004F053114D40D00017331411D11145414C14500731100151350D44401454035314
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d112e45256ea0a073673d3cc9916f33e1c670de9626e6b4da4e54aa3f9f53ad9
MD5 9de4849a944c0399b1cedbd348fb9e32
SHA1 f3a4c94792a4c873aabe6997efedd71eb131c62f
SHA512 00326bc6aa95bc5e79cd7f10ef4f572a8e341327da4f70811e8f544a1fec0e5ab3d1f5df32a1d1aa3dfde53d6e50401d22f475ceb3f1f6f439a45f46815e1082
TLSH
T146D012A233124A74C01026331403B1090841C51F800A60005429AA1E5A040940936551
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\GrShaderCache\index
Size 256KB
SHA256 924351ce8ed305356e9035edbaeaeddc8c3122488ed6cb712e5dabcdbb40ff54
MD5 d665dac22a6e7fa11ecc30e24043cd59
SHA1 d62d9e118a01d169a2a1109f43b95f209a3919a6
SHA512 3c4012dc96e2ba7cbea27e73d1f7201f30b283c9f0214025ed42af80231b6715e0e803581442328781bec6244d399affc723e0bef388e98d4454c831d576c42f
SSDEEP 3:LstlNllklkXln3Sal:LsX3lP3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Local State
Size 1KB
SHA256 7ed72457e7ee2c9d646f9cd15c2a94b4126738551b800e87c7601c8cce60a232
MD5 0c5c4288c683a7f5a4da546248f792c2
SHA1 e6351fe641d0f56bdba9bd4b6bb60d9243c38769
SHA512 40dc76a2afff971701a063d4f8886917f8e8b9f90d2c2985b67445c26c96f68efe62d32b15f51c77efde4eeda43bd43a2f1c1c0d8e10210de42ac0cf6d040039
TLSH
T1543165B298A0BF766C929A41B1067F679E20102BC2154F58F5DE5B2C02EB2AC5637C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Local State
Size 2KB
SHA256 4c7be83842ae51d105280f9100d56784a44b8be171d27ee23e5e9f5156ee2e6a
MD5 a1db67d7536804a96aa9a5d0ddd065fd
SHA1 4a09add75d673b5dde9d404797fa7975651b256f
SHA512 82c709145b41bbb9138c652f54208010aad5c057bfd7b7f14818f98c4afdc2ca5765e83048a018925512fce8bc61c24e10cd7308fad91e797053439dbb7adccc
TLSH
T1E65187736C24FB7749E34A04B50A7F23DA35616696562F64E9DD1B1C01DB2AC2312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Local State
Size 3KB
SHA256 4b8a2317431f61be648d3e3bd1f8049b443f9bb38145570def392d8b483aa9cf
MD5 73326d146fddb057d68da47f89103295
SHA1 ed7b0ad127a74e876e2350b38a81f8445861aa80
SHA512 06ec908fb6f95e4327d00b82b5b716d06c0489735c7ef84a903388a1a55792d6d47b85b96e35d6d98464d22add8a9cb4249355f39b5da0d2e34ab2cecdf91d77
TLSH
T10E719372A974EA2B0DE39A00B8862F16A6651137D6953FA8D9ED0F1C01DB3A82312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Local State
Size 4KB
SHA256 d107743324fd4f525f12f6dd4bb4330195f0f3903d39d24cd69759c8f1c80efa
MD5 17c162a2f7eda92465eeda6c688be3d1
SHA1 c241f1b959e7018ab0350df6456284719139d1fe
SHA512 27140ecc68b8a249d022b74bc9bef48f47b6dfa49d2e8caccfea52fcaf26e7e7b27b0aad4ac5d311bbba36e81d9744c7231f96e4fc3537a65ca71d46552b5325
SSDEEP 96:zu4u0Ik3NkCEjZfhCAEy7V8Frh/cInURoDotoN50JcD0NwBudZcg6xBZb4TVZlts:zDu0Ik3NbgCQKooDUa000N0udZcvgVa
TLSH
T1FB918262AD74BA374DF3DA05B8463F16A6A5602795A53FA8D9ED0F0C01DB3DC2312C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe582c1c.TMP

Path C:\Users\Admin\AppData\Roaming\DIVINE_protected.exe\EBWebView\Local State~RFe582c1c.TMP
Size 1KB
SHA256 94cdde5d32c2fa87710bc0031bdc803ffb1decd7a46bd5c29188e6db8a2217f7
MD5 9e9c82615fd1dc3d1a8da333ac160faa
SHA1 a3f21d35931a8df1aaa87072fabcbc34442c7bc4
SHA512 4036070f6d4890035cb3ac2cd344fd5a933b2e44b0084765572b0acbab494953c5e93b4d8c6a7851c1a3fcb904d5f2cbef64fc5a834f6498ffe1553b7aaf8774
TLSH
T14D2110B3C8A4BB766D928A40B012AF5A5E50502A86195F18F5DE162C02EB2BC4B37C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1800-4-0x0000000140000000-0x0000000141BF0000-memory.dmp

Download

memory/1800-0-0x0000000140000000-0x0000000141BF0000-memory.dmp

Download

memory/1800-5-0x0000000140000000-0x0000000141BF0000-memory.dmp

Download

memory/1800-6-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/1800-7-0x00007FFD602E0000-0x00007FFD602E1000-memory.dmp

Download

memory/1800-3-0x0000000140000000-0x0000000141BF0000-memory.dmp

Download

memory/1800-338-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/1800-138-0x0000000000450000-0x0000000000451000-memory.dmp

Download

memory/1800-2-0x0000000140000000-0x0000000141BF0000-memory.dmp

Download

memory/1800-1-0x0000000140000000-0x0000000141BF0000-memory.dmp

Download

memory/1800-336-0x0000000140000000-0x0000000141BF0000-memory.dmp

Download

memory/2196-92-0x00007FFD5F8F0000-0x00007FFD5F8F1000-memory.dmp

Download

memory/4244-87-0x00007FFD5EA20000-0x00007FFD5EA21000-memory.dmp

Download

memory/4244-88-0x00007FFD5E360000-0x00007FFD5E361000-memory.dmp

Download

memory/5080-33-0x00007FFD5F8F0000-0x00007FFD5F8F1000-memory.dmp

Download