Overview

overview

8

Static

static

3

entry_1_0/...8K.exe

windows10-2004-x64

8

entry_1_0/...8K.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    599s
  • max time network
    480s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 19:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    entry_1_0/$R6ZTP8K.exe
  • Size 15.8MB
  • Sample260806-xvq5vsstdz
  • SHA256 e1a92b8257a50a34255a776f291ddbeaede606327820930eeb0671fae499dc90
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\entry_1_0\$R6ZTP8K.exe
    "C:\Users\Admin\AppData\Local\Temp\entry_1_0\$R6ZTP8K.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_20\jre1.6.0_20.msi" METHOD=joff-s
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5128
      • C:\Users\Admin\AppData\Local\Temp\MSI71FD.tmp
        "C:\Users\Admin\AppData\Local\Temp\MSI71FD.tmp" C:\Program Files (x86)\Java\jre6\;C
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2544
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\AU\au.msi" ALLUSERS=1 /qn
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:6120
    • C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
      "C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.6.0_20-b02
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5228
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 636618952862A69F7C0D075A24A34B7F C
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2620
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1200
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding FB452D04C6207CC18D66DD7CBE726DB5
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Program Files (x86)\Java\jre6\bin\javaws.exe
          "C:\Program Files (x86)\Java\jre6\bin\javaws.exe" -silent -import -reverse -javafx -system -J-Dkernel.download.dialog=false "http://dl.javafx.com/javafx-cache.jnlp"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5600
          • C:\Program Files (x86)\Java\jre6\bin\javaw.exe
            "C:\Program Files (x86)\Java\jre6\bin\javaw.exe" -Dkernel.background.download=false -classpath "C:\Program Files (x86)\Java\jre6\lib\deploy.jar" com.sun.deploy.panel.JreLocator
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3596
          • C:\Program Files (x86)\Java\jre6\bin\javaw.exe
            "C:\Program Files (x86)\Java\jre6\bin\javaw.exe" "-Xbootclasspath/a:C:\Program Files (x86)\Java\jre6\lib\javaws.jar;C:\Program Files (x86)\Java\jre6\lib\deploy.jar;C:\Program Files (x86)\Java\jre6\lib\plugin.jar" -classpath "C:\Program Files (x86)\Java\jre6\lib\deploy.jar" "-Djava.security.policy=file:C:\Program Files (x86)\Java\jre6\lib\security\javaws.policy" -DtrustProxy=true -Xverify:remote "-Djnlpx.home=C:\Program Files (x86)\Java\jre6\bin" -Dsun.awt.warmup=true -Djnlpx.origFilenameArg=http://dl.javafx.com/javafx-cache.jnlp -Djnlpx.remove=false -Djava.awt.headless=true -Dkernel.download.dialog=false "-Djnlpx.jvm=C:\Program Files (x86)\Java\jre6\bin\javaw.exe" -Djnlpx.vmargs=-Dkernel.download.dialog=false com.sun.javaws.Main -silent -import -reverse -javafx -system http://dl.javafx.com/javafx-cache.jnlp
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4872
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding FB8E9CD4751C4CC057C0D23DEFA6EAB9 E Global\MSI0000
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Program Files (x86)\Java\jre6\zipper.exe
          "C:\Program Files (x86)\Java\jre6\zipper.exe" "C:\Program Files (x86)\Java\jre6\core.zip" "C:\Program Files (x86)\Java\jre6\" "C:\Users\Admin\AppData\Local\Temp\java_install.log"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:4508
        • C:\Program Files (x86)\Java\jre6\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\rt.pack" "C:\Program Files (x86)\Java\jre6\lib\rt.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:988
        • C:\Program Files (x86)\Java\jre6\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\jsse.pack" "C:\Program Files (x86)\Java\jre6\lib\jsse.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5936
        • C:\Program Files (x86)\Java\jre6\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\plugin.pack" "C:\Program Files (x86)\Java\jre6\lib\plugin.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6012
        • C:\Program Files (x86)\Java\jre6\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\javaws.pack" "C:\Program Files (x86)\Java\jre6\lib\javaws.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4312
        • C:\Program Files (x86)\Java\jre6\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\deploy.pack" "C:\Program Files (x86)\Java\jre6\lib\deploy.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4520
        • C:\Program Files (x86)\Java\jre6\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\charsets.pack" "C:\Program Files (x86)\Java\jre6\lib\charsets.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3620
        • C:\Program Files (x86)\Java\jre6\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jre6\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre6\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre6\lib\ext\localedata.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          PID:5228
      • C:\Program Files (x86)\Java\jre6\bin\javaw.exe
        "C:\Program Files (x86)\Java\jre6\bin\javaw.exe" -Xshare:dump
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1416
      • C:\Program Files (x86)\Java\jre6\bin\javaw.exe
        "C:\Program Files (x86)\Java\jre6\bin\javaw.exe" com.sun.servicetag.Installer -source "Windows JRE installer"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C WMIC computersystem get model
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3452
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            WMIC computersystem get model
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2988
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C WMIC computersystem get model
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2828
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            WMIC computersystem get model
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4360
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C WMIC computersystem get manufacturer
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5728
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            WMIC computersystem get manufacturer
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5716
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C WMIC bios get serialnumber
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2220
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            WMIC bios get serialnumber
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1472
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C WMIC cpu get manufacturer
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4692
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            WMIC cpu get manufacturer
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2644
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:5800
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:5932

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59e324.rbs
            • Path C:\Config.Msi\e59e324.rbs
            • Size 10KB
            • SHA256 81fdb2777cac34d4f9770e5f7db44fe65d51a453a78d1f0825be4c86d7393b7c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcr71.dll
            • Path C:\Program Files (x86)\Java\jre6\bin\msvcr71.dll
            • Size 340KB
            • SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            npdeployJava1.dll
            • Path C:\Program Files (x86)\Java\jre6\bin\npdeployJava1.dll
            • Size 401KB
            • SHA256 268f79e3411208d876be0678e4e2f8b9db5785ce2f17c2a53f345170ac9090cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            regutils.dll
            • Path C:\Program Files (x86)\Java\jre6\bin\regutils.dll
            • Size 264KB
            • SHA256 c1761321da76c3a008f47f659dd8c35c13978977412dc2a5ed8eccc360c34c17
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unpack200.exe
            • Path C:\Program Files (x86)\Java\jre6\bin\unpack200.exe
            • Size 129KB
            • SHA256 923e59af092a9c6dc7b218f342dc90ee59aa3359361652799e2a673573b1d58d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            core.zip
            • Path C:\Program Files (x86)\Java\jre6\core.zip
            • Size 33.7MB
            • SHA256 5d03d7b01780029d3a2a141c28447edd6fd01ad78c8c0da2842ffbad19f0106d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jsse.pack
            • Path C:\Program Files (x86)\Java\jre6\lib\jsse.pack
            • Size 129KB
            • SHA256 a896aac236f220ab4ccb791b489747464418711edf2fa43fd0f7de1617fe3bb7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            plugin.pack
            • Path C:\Program Files (x86)\Java\jre6\lib\plugin.pack
            • Size 449KB
            • SHA256 c6443a1d72c51f8d2328c4a6c430dfd736f7488e18d7e21e32effcaa3420d6fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rt.pack
            • Path C:\Program Files (x86)\Java\jre6\lib\rt.pack
            • Size 10.5MB
            • SHA256 fc8c65ef4e52c96e59788274268999fa2361f3a7a76a6b3f93b0e89fa309e3fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GMT
            • Path C:\Program Files (x86)\Java\jre6\lib\zi\GMT
            • Size 27B
            • SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
            • MD5 SHA1 SHA512
            Submit Download

            zipper.exe
            • Path C:\Program Files (x86)\Java\jre6\zipper.exe
            • Size 64KB
            • SHA256 73aa371bd1582bbc8822cf541ecfc08719812411695086fbe03d9a26962977bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Data1.cab
            • Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_20\Data1.cab
            • Size 12.4MB
            • SHA256 3e9de3bc438a3511ac9a43391a627214e9643e80c43e551edc2a61f9eec78926
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jre1.6.0_20.msi
            • Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_20\jre1.6.0_20.msi
            • Size 567KB
            • SHA256 c704b3b9ce0b0e3edb21a7be17603fd969b3a0f8bbaed128dcdda9f0b6658a0c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI60B4.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI60B4.tmp
            • Size 108KB
            • SHA256 4919c429f5562ef5649ce25bf520c0d7156c36f3160be6c32af56019af21974b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI71FD.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI71FD.tmp
            • Size 216KB
            • SHA256 01f573d5a68e44943d8c2ca973375d15f50ffe02cc21b01c9a4114859045a836
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java_install.log
            • Path C:\Users\Admin\AppData\Local\Temp\java_install.log
            • Size 24KB
            • SHA256 43b6af4b28736bff0496fbf3bada109e5999569f91eaf40cd6ddc00255abb30c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java_install.log
            • Path C:\Users\Admin\AppData\Local\Temp\java_install.log
            • Size 25KB
            • SHA256 eb2a0f019cbb59e7964f10a51882f93ef7c2fd62900c05c4ebec82844161c4da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java_install.log
            • Path C:\Users\Admin\AppData\Local\Temp\java_install.log
            • Size 27KB
            • SHA256 9951bf1d5b03bc29f3e1ea6baa9a53ef599a5cba4be828d65f4a83aed8e61532
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java_install_reg.log
            • Path C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
            • Size 2KB
            • SHA256 a16dd69b49d61dd5cf814133129886e65991d01ce27b2f97c15e840b7869bd89
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            jusched.log
            • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
            • Size 164KB
            • SHA256 eecd53a20bebc34ce94319c5dac54c0ff24722aa2eb3c5a977bfbc29af06f04c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 04abafc50ac7225233957324f7733c8d5dfd8e1b6b8c011182a78c4e2b54f978
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {daed9160-71f1-49fa-a3d1-eec34103b3ef}_OnDiskSnapshotProp
            • Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{daed9160-71f1-49fa-a3d1-eec34103b3ef}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 1ae8fd3df0fd5e4ecffe0f93774d2814702b1797a33490de00afd900e7683752
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1232-1-0x0000000000400000-0x00000000013D7000-memory.dmp
            Download

            memory/1232-943-0x0000000000400000-0x00000000013D7000-memory.dmp
            Download

            memory/1416-830-0x0000000001F60000-0x0000000001F61000-memory.dmp
            Download

            memory/3596-887-0x0000000002090000-0x0000000002091000-memory.dmp
            Download

            memory/3720-840-0x0000000039EB0000-0x0000000039EC0000-memory.dmp
            Download

            memory/3720-933-0x0000000002090000-0x0000000002091000-memory.dmp
            Download

            memory/4872-928-0x0000000000870000-0x0000000000871000-memory.dmp
            Download

            memory/4872-934-0x0000000000870000-0x0000000000871000-memory.dmp
            Download

            memory/4872-954-0x0000000000870000-0x0000000000871000-memory.dmp
            Download

            memory/4872-958-0x0000000000870000-0x0000000000871000-memory.dmp
            Download