Analysis

  • user interaction
    yes
  • max time kernel
    60s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/08/2026, 00:58

General

  • Target
    Kawaii Animes.msi
  • Size 173.8MB
  • Sample260808-bbhtgswhpb
  • SHA256 2390c5e752a7e507258cb8377b0c81c45113428e80a04a5f7769b23496f3d961
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 24 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 14 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Kawaii Animes.msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4060
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding E646A1B8621A6B5E5DDC2BD5C2E99499 C
      2⤵
      • Loads dropped DLL
      PID:3812
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FAFA0E9ADE669541E5523174EDF0D8A2 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3000
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4996
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding B0A2F88FF00DE5125F7721FED9BBDB81
        2⤵
        • Loads dropped DLL
        PID:3360
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 56705E66EC8274D48B24441397230655
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1340
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1856
    • C:\Users\Admin\AppData\Local\Kawaii Animes\Kawaii Animes.exe
      "C:\Users\Admin\AppData\Local\Kawaii Animes\Kawaii Animes.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Users\Admin\AppData\Local\Kawaii Animes\Kawaii Animes.exe
        "C:\Users\Admin\AppData\Local\Kawaii Animes\Kawaii Animes.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of SetWindowsHookEx
        PID:2464

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58e75e.rbs

          • Path C:\Config.Msi\e58e75e.rbs
          • Size 130KB
          • SHA256 304e55aefa6e37750419a8f65e599870c4c50914bb03b070bcdde663dc9b41fe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Kawaii Animes.exe

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\Kawaii Animes.exe
          • Size 551KB
          • SHA256 e8e2f0c010017577a1509423ab9c5441788180e5f964bad6d91d706c98a5d0aa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          .package

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\.package
          • Size 13B
          • SHA256 7ea195054ba150b5b635dd511e47a24f5c9a74ae2c7aa1c814094c0c04cc76af
          • MD5 SHA1 SHA512

          CMPConnectivityMonitor-jvm-38bff93ed0180adb4b0d0c4aba57c9b.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\CMPConnectivityMonitor-jvm-38bff93ed0180adb4b0d0c4aba57c9b.jar
          • Size 426B
          • SHA256 d6c574894aecc5eff0e7488d08494c4cf715ebf5e46e29423e92ace0c5dbf7b1
          • MD5 SHA1 SHA512 TLSH

          Kawaii Animes.cfg

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\Kawaii Animes.cfg
          • Size 12KB
          • SHA256 6a6f7d6f7cc3918938461aa756c41d2c84ae6a7b918736aeaf0ff5177ca8571c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          adaptive-desktop-1.3.0-beta02-b632c7ba64d3b6f9d123a1d87040a2.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\adaptive-desktop-1.3.0-beta02-b632c7ba64d3b6f9d123a1d87040a2.jar
          • Size 20KB
          • SHA256 66254a6fffcf8d154c8e09d15eda71b396a59c6aca7416c8e60e6a168fc5fd01
          • MD5 SHA1 SHA512 SSDEEP TLSH

          adaptive-layout-desktop-1.3.0-beta02-b6c6b7f8c793058bc283884bd2828f.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\adaptive-layout-desktop-1.3.0-beta02-b6c6b7f8c793058bc283884bd2828f.jar
          • Size 514KB
          • SHA256 a0ce458a8be97fed82ca95548fc59a06b24ac6141b5e83a155680c04e9868527
          • MD5 SHA1 SHA512 SSDEEP TLSH

          adaptive-navigation-desktop-1.3.0-beta02-7c56393dda846ca167b03d6d1188f41e.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\adaptive-navigation-desktop-1.3.0-beta02-7c56393dda846ca167b03d6d1188f41e.jar
          • Size 22KB
          • SHA256 1d3f98d1b1c581a7de550f4ccc300c1e2b1342c3b2bba6d5be5f6e62dc48a1e1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          animation-core-desktop-1.11.1-3ec8687bba1c875f4630e7c99d49defc.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\animation-core-desktop-1.11.1-3ec8687bba1c875f4630e7c99d49defc.jar
          • Size 349KB
          • SHA256 fa6a65b78a8cd1b4c330bc237dd2bd05a864bf379e95a174a6d45b6cb06036ec
          • MD5 SHA1 SHA512 SSDEEP TLSH

          animation-desktop-1.11.1-3b1636eba8fac16d053e567d9b91df8.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\animation-desktop-1.11.1-3b1636eba8fac16d053e567d9b91df8.jar
          • Size 357KB
          • SHA256 969d9643630489ab54a905c40b708cc7e13b67620db5e17b208a4278864cbae9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          annotation-jvm-1.10.0-115b24fa6dc2fbca9edd40aadbce03e.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\annotation-jvm-1.10.0-115b24fa6dc2fbca9edd40aadbce03e.jar
          • Size 4KB
          • SHA256 5628c1862cd9f789b7ae65c7754a45b7c76667aefcfea00a6d8d56aaa6f10ab5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar
          • Size 186B
          • SHA256 1609324d70dc2a54ff6e810ee7a6f111fff0eca58ef33f11843f8f01005cc5aa
          • MD5 SHA1 SHA512 TLSH

          atomicfu-jvm-0.28.0-70921245a0aed3c3e3d17c34ca3dbd87.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\atomicfu-jvm-0.28.0-70921245a0aed3c3e3d17c34ca3dbd87.jar
          • Size 10KB
          • SHA256 8c69c2d9f08f1e524c1699e9027d17443c02c0356a2dea784b08b29b2dbd689a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          charset-jvm-0.0.8-ab1cc0e5b475702f69679eda02df0a3.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\charset-jvm-0.0.8-ab1cc0e5b475702f69679eda02df0a3.jar
          • Size 17KB
          • SHA256 12db44afa790b048905ceb1a01f6364ad3d662898a3fb7fcd94eb7f47690f3f2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          coil-compose-core-jvm-3.5.0-9565c4af0fad861b0bc16b7bffc53.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\coil-compose-core-jvm-3.5.0-9565c4af0fad861b0bc16b7bffc53.jar
          • Size 124KB
          • SHA256 d78805fa52e8233377b57fe662f35668dd4664ac58c6f1334d76fd1543a229c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          coil-compose-jvm-3.5.0-c0c057f9ba1311897cfbada05f910fb.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\coil-compose-jvm-3.5.0-c0c057f9ba1311897cfbada05f910fb.jar
          • Size 11KB
          • SHA256 eb5b8e083a65d5f050c4f882fac177a9de0f37cc2e477146d984bbd61a3fa9c6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          coil-core-jvm-3.5.0-73da9d924cacaf672c3cc0d09340dfa.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\coil-core-jvm-3.5.0-73da9d924cacaf672c3cc0d09340dfa.jar
          • Size 315KB
          • SHA256 f4002d4679c99b66f0273bea943cfca2c08516efe8c0194e353d9694e2181996
          • MD5 SHA1 SHA512 SSDEEP TLSH

          coil-jvm-3.5.0-4cd0fba134e919a7ce9b2982d8d52685.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\coil-jvm-3.5.0-4cd0fba134e919a7ce9b2982d8d52685.jar
          • Size 5KB
          • SHA256 ee00406646aa1a6776c751a3e115b14eb3254a2870178ac7c8cbb85749dc1b22
          • MD5 SHA1 SHA512 SSDEEP TLSH

          coil-network-core-jvm-3.5.0-ae9139c71aff8fac3760d889bf422572.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\coil-network-core-jvm-3.5.0-ae9139c71aff8fac3760d889bf422572.jar
          • Size 66KB
          • SHA256 8536a2d78b24496695057126b23b0519e91b741b417f105dd95033326b9c6e22
          • MD5 SHA1 SHA512 SSDEEP TLSH

          coil-network-ktor3-jvm-3.5.0-af8ff3d46f38f9240b7978a83b5aeb.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\coil-network-ktor3-jvm-3.5.0-af8ff3d46f38f9240b7978a83b5aeb.jar
          • Size 24KB
          • SHA256 7a9684e54750675e7d09639d0d8f49a5593a92f28ac11ccd1051f35e3a975c18
          • MD5 SHA1 SHA512 SSDEEP TLSH

          collection-jvm-1.5.0-4421442c114a4f8c8fe587cf2d668237.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\collection-jvm-1.5.0-4421442c114a4f8c8fe587cf2d668237.jar
          • Size 276KB
          • SHA256 86048a78929f406dabbfb4721ecdb8e4c949d582cb82b6fc1fe827a9a17de0bf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          composeApp-desktop.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\composeApp-desktop.jar
          • Size 12.0MB
          • SHA256 d524e9f36858516e7e57985b654683a01bc7a92c958d8fd229e3ac8851d06bda
          • MD5 SHA1 SHA512 SSDEEP TLSH

          config-1.4.9-c62e4875399181f2a41573ee1fb0d00.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\config-1.4.9-c62e4875399181f2a41573ee1fb0d00.jar
          • Size 209KB
          • SHA256 1aa1afc3d47a9a953dec66347e6c9ae86d06f36a6125468949f0e114e6608551
          • MD5 SHA1 SHA512 SSDEEP TLSH

          core-common-2.2.0-2212d240dfe1e8a7598ee117ccc316d.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\core-common-2.2.0-2212d240dfe1e8a7598ee117ccc316d.jar
          • Size 165B
          • SHA256 1c8d86bf571b39400c0dad77288de3e3f18216d2e174a259bed4a51fe4fe8fcf
          • MD5 SHA1 SHA512 TLSH

          datastore-core-jvm-1.2.1-68bd30a82462b130b953a7a0ade6b318.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\datastore-core-jvm-1.2.1-68bd30a82462b130b953a7a0ade6b318.jar
          • Size 155KB
          • SHA256 ecde81e1113b8fcaf06baac66bdf90d18400a52c29c1ab34679fa04923d031b7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          datastore-core-okio-jvm-1.2.1-38c87b659b5e43255f87474fab30457f.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\datastore-core-okio-jvm-1.2.1-38c87b659b5e43255f87474fab30457f.jar
          • Size 27KB
          • SHA256 2ca7170dabdd9e20dc23772afbb0d747bda4a237f3a2eeb4b3b45343130e4f97
          • MD5 SHA1 SHA512 SSDEEP TLSH

          datastore-jvm-1.2.1-64873d5cfe3f83e57d1a8ba9fd633d48.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\datastore-jvm-1.2.1-64873d5cfe3f83e57d1a8ba9fd633d48.jar
          • Size 4KB
          • SHA256 406397a7054ab0d3d35819dc1af748169c92838d77693bffe8459ce8e276442d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          datastore-preferences-core-jvm-1.2.1-a71e7c68fc6dd85f6237335722cd925.jar

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\app\datastore-preferences-core-jvm-1.2.1-a71e7c68fc6dd85f6237335722cd925.jar
          • Size 35KB
          • SHA256 08adc65127688c645fa1ba557c6068338db5dbf1b81c6f63210e647c1150ee51
          • MD5 SHA1 SHA512 SSDEEP TLSH

          java.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\java.dll
          • Size 109KB
          • SHA256 085aaf0936dab15573bc109df9e14b45397d597fc378772c0017d08127c51591
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jimage.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\jimage.dll
          • Size 22KB
          • SHA256 0561e25176b5f41512997dd2b36e64d86d3298a2016a480c14828bbf6c045938
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jli.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\jli.dll
          • Size 77KB
          • SHA256 fbad23e683e02cb29bb39f26ee73f2fb2d00c11589268e57d7fa3c25e200902d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          msvcp140.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\msvcp140.dll
          • Size 554KB
          • SHA256 e0a22a594e148fa55ceef3e49969bfa77011a801267a0bd7805b681b593c9d0b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          net.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\net.dll
          • Size 47KB
          • SHA256 a798655cb181543810df4896042dea705a8630b1bb13183640ae809172901036
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nio.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\nio.dll
          • Size 68KB
          • SHA256 354677f7fb2d9312ead788608f2766a21b0bcebab51d355b9ced7e13ec2cc46a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jvm.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\server\jvm.dll
          • Size 13.4MB
          • SHA256 75772abfa60fabb40fc74f03e158dc42eb5235cf0178e82302e9d4460ac14126
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vcruntime140.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\vcruntime140.dll
          • Size 96KB
          • SHA256 c179d8914ba8e57b2f8f4d6c101c2c550c7c6712a7f0f9920a97db340f9d9574
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vcruntime140_1.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\vcruntime140_1.dll
          • Size 37KB
          • SHA256 7cf38d20d00b6640d510eab70171e1c6f8fa2e42040832e17c7433ab61d94a8e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zip.dll

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\bin\zip.dll
          • Size 77KB
          • SHA256 36c261aa32b2026b23f59eaba1bfe66e79ce3b2860a197a4b1832d0591db1d84
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LICENSE

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\legal\java.desktop\LICENSE
          • Size 33B
          • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
          • MD5 SHA1 SHA512

          ADDITIONAL_LICENSE_INFO

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\legal\java.naming\ADDITIONAL_LICENSE_INFO
          • Size 49B
          • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
          • MD5 SHA1 SHA512

          ASSEMBLY_EXCEPTION

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\legal\java.prefs\ASSEMBLY_EXCEPTION
          • Size 44B
          • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
          • MD5 SHA1 SHA512

          jvm.cfg

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\lib\jvm.cfg
          • Size 29B
          • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
          • MD5 SHA1 SHA512

          release

          • Path C:\Users\Admin\AppData\Local\Kawaii Animes\runtime\release
          • Size 199B
          • SHA256 b21cc9a14b06bb8d6d0b3f309f1d7f4f3b1f93beb0da683b6232e1f77fd5d9ee
          • MD5 SHA1 SHA512 TLSH

          MSIACC5.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\MSIACC5.tmp
          • Size 391KB
          • SHA256 92b22c880ada232c643fb864db2103d607a8bd15d5b6b41e6205497d73fb9855
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MSIB448.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\MSIB448.tmp
          • Size 113KB
          • SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kawaii.db

          • Path C:\Users\Admin\AppData\Roaming\KawaiiAnimes\kawaii.db
          • Size 15.1MB
          • SHA256 f8a763cc9e5b32abc84d3f2d666a901456d9ea2a4bf232b0a8c02069997be240
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MSIE8A7.tmp

          • Path C:\Windows\Installer\MSIE8A7.tmp
          • Size 211KB
          • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
          • MD5 SHA1 SHA512 SSDEEP TLSH

          metadata-2

          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.6MB
          • SHA256 4265f5ca175c2f74b13d1e3747332dd7a3d856b305174d5835121bbd2e64537f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          {d01d4ae4-2fb8-4858-a9ac-12cbfd7695f0}_OnDiskSnapshotProp

          • Path \??\Volume{67a68b58-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d01d4ae4-2fb8-4858-a9ac-12cbfd7695f0}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 76f416592603b076ebd38d0f26f58108ff3915bf49f96c4b7cd9e6bb77649d6a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/2464-497-0x000001FF0FCB0000-0x000001FF0FCB1000-memory.dmp

          memory/2464-498-0x000001FF0FCB0000-0x000001FF0FCB1000-memory.dmp

          memory/2464-528-0x000001FF6AEF0000-0x000001FF6BCBD000-memory.dmp

          memory/2464-496-0x000001FF0FCB0000-0x000001FF0FCB1000-memory.dmp

          memory/2464-593-0x000001FF6AEF0000-0x000001FF6BCBD000-memory.dmp