Overview

overview

10

Static

static

3

WindowsHos...er.exe

windows10-2004-x64

10

WindowsHos...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/09/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WindowsHostManager.exe
  • Size 5.7MB
  • Sample260919-sdkvassbrc
  • SHA256 8ea4f9ae650ba1fbe211f72403d78038d132ac3d8c5b3610a29eb5e8910b037e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceransomwaretrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 23 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies firewall policy service 3 TTPs 8 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs
    ransomwareevasion
  • Renames multiple (101) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
    defense_evasion
  • Windows security modification 2 TTPs 15 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Modifies Security services 2 TTPs 1 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 16 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • System policy modification 1 TTPs 21 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsHostManager.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsHostManager.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Windows security bypass
    • Windows security modification
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe
      "C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /c mountvol z: /S
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Windows\system32\mountvol.exe
          mountvol z: /S
          4⤵
            PID:2580
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c mountvol z: /D
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5592
          • C:\Windows\system32\mountvol.exe
            mountvol z: /D
            4⤵
            • Enumerates connected drives
            PID:3668
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c mountvol z: /S
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Windows\system32\mountvol.exe
            mountvol z: /S
            4⤵
              PID:2124
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c mountvol z: /D
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1288
            • C:\Windows\system32\mountvol.exe
              mountvol z: /D
              4⤵
              • Enumerates connected drives
              PID:3192
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c mountvol z: /S
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3168
            • C:\Windows\system32\mountvol.exe
              mountvol z: /S
              4⤵
                PID:3872
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c mountvol z: /D
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5968
              • C:\Windows\system32\mountvol.exe
                mountvol z: /D
                4⤵
                • Enumerates connected drives
                PID:1988
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c mountvol z: /S
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3300
              • C:\Windows\system32\mountvol.exe
                mountvol z: /S
                4⤵
                  PID:4552
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /c mountvol z: /D
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:3232
                • C:\Windows\system32\mountvol.exe
                  mountvol z: /D
                  4⤵
                  • Enumerates connected drives
                  PID:2676
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /c mountvol z: /S
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:5488
                • C:\Windows\system32\mountvol.exe
                  mountvol z: /S
                  4⤵
                    PID:4156
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /c mountvol z: /D
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:920
                  • C:\Windows\system32\mountvol.exe
                    mountvol z: /D
                    4⤵
                    • Enumerates connected drives
                    PID:5716
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /c mountvol z: /S
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2376
                  • C:\Windows\system32\mountvol.exe
                    mountvol z: /S
                    4⤵
                      PID:3860
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /c mountvol z: /D
                    3⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:3404
                    • C:\Windows\system32\mountvol.exe
                      mountvol z: /D
                      4⤵
                      • Enumerates connected drives
                      PID:4972
                  • C:\Users\Admin\AppData\Local\Temp\RWL_20260919_150131.exe
                    "C:\Users\Admin\AppData\Local\Temp\RWL_20260919_150131.exe"
                    3⤵
                    • Modifies WinLogon for persistence
                    • Modifies Windows Defender DisableAntiSpyware settings
                    • Modifies Windows Defender Real-time Protection settings
                    • UAC bypass
                    • Disables RegEdit via registry modification
                    • Drops file in Drivers directory
                    • Event Triggered Execution: Image File Execution Options Injection
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Checks whether UAC is enabled
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:4904
                    • C:\Users\Admin\AppData\Local\Temp\023xwr2.exe
                      "C:\Users\Admin\AppData\Local\Temp\023xwr2.exe" -kill -paralyze "SecurityHealthService.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:576
                    • C:\Windows\System32\ReAgentc.exe
                      "C:\Windows\System32\ReAgentc.exe" /disable
                      4⤵
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      PID:3872
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:4752
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2016
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {current} recoveryenabled false
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1476
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {current} optionsedit false
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1988
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {current} advancedoptions false
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1272
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {current} bootmenupolicy legacy
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:6000
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {bootmgr} bootsequence {current}
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:4276
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {bootmgr} timeout 0
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1088
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu no
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:4552
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {bootmgr} displayorder {default} /addfirst
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1500
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {fwbootmgr} displayorder {bootmgr} /addfirst
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:5844
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {current} safeboot No
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2676
                    • C:\Windows\System32\bcdedit.exe
                      "C:\Windows\System32\bcdedit.exe" /set {bootmgr} removeoptions
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2408
                    • C:\Windows\system32\def_none.exe
                      "C:\Windows\system32\def_none.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:4092
                    • C:\Windows\SYSTEM32\taskkill.exe
                      taskkill.exe /im Explorer.exe /f
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2404
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /c mountvol z: /S
                    3⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:4196
                    • C:\Windows\system32\mountvol.exe
                      mountvol z: /S
                      4⤵
                        PID:2668
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /c mountvol z: /D
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4684
                      • C:\Windows\system32\mountvol.exe
                        mountvol z: /D
                        4⤵
                        • Enumerates connected drives
                        PID:3308
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /c mountvol z: /S
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1524
                      • C:\Windows\system32\mountvol.exe
                        mountvol z: /S
                        4⤵
                          PID:1592
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c mountvol z: /D
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3180
                        • C:\Windows\system32\mountvol.exe
                          mountvol z: /D
                          4⤵
                          • Enumerates connected drives
                          PID:4280
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1328
                  • C:\Windows\system32\def_none.exe
                    "C:\Windows\system32\def_none.exe" -s -worker -tilog
                    1⤵
                    • Modifies Windows Defender DisableAntiSpyware settings
                    • Modifies Windows Defender Real-time Protection settings
                    • Modifies Windows Defender TamperProtection settings
                    • Modifies Windows Defender notification settings
                    • Modifies firewall policy service
                    • Modifies security service
                    • Event Triggered Execution: Image File Execution Options Injection
                    • Executes dropped EXE
                    • Impair Defenses: Safe Mode Boot
                    • Windows security modification
                    • Modifies Security services
                    • Modifies data under HKEY_USERS
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4500
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE
                      2⤵
                        PID:5548
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE
                        2⤵
                          PID:6076
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE
                          2⤵
                            PID:3352
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE
                            2⤵
                              PID:5912
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /Change /TN "\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /DISABLE
                              2⤵
                                PID:1800
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k GPSvcGroup
                              1⤵
                                PID:4616
                              • C:\Windows\system32\AUDIODG.EXE
                                C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x0000000000000508
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3976

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    1
                                    T1059

                                    Windows Command Shell

                                    1
                                    T1059.003

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Winlogon Helper DLL

                                    1
                                    T1547.004

                                    Create or Modify System Process

                                    6
                                    T1543

                                    Windows Service

                                    6
                                    T1543.003

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Image File Execution Options Injection

                                    1
                                    T1546.012

                                    Privilege Escalation

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Winlogon Helper DLL

                                    1
                                    T1547.004

                                    Create or Modify System Process

                                    6
                                    T1543

                                    Windows Service

                                    6
                                    T1543.003

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Image File Execution Options Injection

                                    1
                                    T1546.012

                                    Defense Evasion

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Impair Defenses

                                    10
                                    T1562

                                    Disable or Modify System Firewall

                                    1
                                    T1562.004

                                    Disable or Modify Tools

                                    7
                                    T1562.001

                                    Safe Mode Boot

                                    1
                                    T1562.009

                                    Modify Registry

                                    13
                                    T1112

                                    Credential Access

                                    Discovery

                                    Peripheral Device Discovery

                                    1
                                    T1120

                                    Query Registry

                                    2
                                    T1012

                                    System Information Discovery

                                    3
                                    T1082

                                    System Network Configuration Discovery

                                    1
                                    T1016

                                    Internet Connection Discovery

                                    1
                                    T1016.001

                                    Lateral Movement

                                    Collection

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Inhibit System Recovery

                                    1
                                    T1490

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    last-run.log
                                    • Path C:\ProgramData\defender-control\last-run.log
                                    • Size 1KB
                                    • SHA256 d39fd2cd795c727d58b440aefe556905839ee694bd42eb40d4184bbc48f02b4a
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    023xwr2.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\023xwr2.exe
                                    • Size 352KB
                                    • SHA256 e23cfbd6b2c598758a2b5b20359c8d5b5cf2212f57ee0a95f5aac55bd7cf9f2e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    RWL_20260919_150131.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\RWL_20260919_150131.exe
                                    • Size 13.1MB
                                    • SHA256 2f6cad8b3c3d3e69fdf9536605547cc1af15495d59bf9cba5486a190a6d0def4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    wallpaper_ncrypt.jpg
                                    • Path C:\Users\Admin\AppData\Local\Temp\wallpaper_ncrypt.jpg
                                    • Size 195KB
                                    • SHA256 17518c61d6bdecbe6e466384425fdb65f10ac5c3d170c464ff89c996b74542b4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WindowsHostManager.exe
                                    • Path C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe
                                    • Size 5.7MB
                                    • SHA256 8ea4f9ae650ba1fbe211f72403d78038d132ac3d8c5b3610a29eb5e8910b037e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    whm_ws.log
                                    • Path C:\Users\Admin\AppData\Roaming\whm_ws.log
                                    • Size 188B
                                    • SHA256 626af503e3e44b3c3b22118b6a6485f2c11cd759b8728b8a459feb2b6b4f8377
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    readme.txt
                                    • Path C:\Users\Admin\Downloads\readme.txt
                                    • Size 2B
                                    • SHA256 ea7ea1e7bd82684fe8e5be43ca12bbe5e47ec31dc2c0de0f5b4395f5deb44113
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    def_none.exe
                                    • Path C:\Windows\System32\def_none.exe
                                    • Size 280KB
                                    • SHA256 897307c0487c3f7376eedf6b3f999559e0aa16855571f30aef4621583f7ff46e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    hosts
                                    • Path C:\Windows\System32\drivers\etc\hosts
                                    • Size 24KB
                                    • SHA256 b57c550fc90e4d8058173c4782e266bcd751b79379c08da6dbabaa5f9686b3fa
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/1888-18-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-40-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-21-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-22-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-23-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-29-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-19-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-36-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-37-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-38-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-39-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/1888-20-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/4904-72-0x000001FA2B6D0000-0x000001FA2C3FC000-memory.dmp
                                    Download

                                    memory/4904-374-0x000001FA47E60000-0x000001FA47E78000-memory.dmp
                                    Download

                                    memory/4904-375-0x000001FA47E80000-0x000001FA47EA6000-memory.dmp
                                    Download

                                    memory/4904-376-0x000001FA47EC0000-0x000001FA47EC8000-memory.dmp
                                    Download

                                    memory/4904-377-0x000001FA47ED0000-0x000001FA47EEE000-memory.dmp
                                    Download

                                    memory/4920-0-0x00007FF97F35F000-0x00007FF97F360000-memory.dmp
                                    Download

                                    memory/4920-17-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/4920-15-0x0000020A33F90000-0x0000020A33FA6000-memory.dmp
                                    Download

                                    memory/4920-4-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/4920-3-0x0000020A33510000-0x0000020A339E8000-memory.dmp
                                    Download

                                    memory/4920-2-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                    Download

                                    memory/4920-1-0x0000020A18A90000-0x0000020A19052000-memory.dmp
                                    Download