Overview

overview

8

Static

static

5

Corporate_...12.zip

windows10-2004-x64

1

Corporate_...12.zip

windows11-ltsc_2024-x64

1

x/발냄�...1.pptx

windows10-2004-x64

1

x/발냄�...1.pptx

windows11-ltsc_2024-x64

8

x/발냄�...7.pptx

windows10-2004-x64

1

x/발냄�...7.pptx

windows11-ltsc_2024-x64

1

x/발냄�...3.pptx

windows10-2004-x64

1

x/발냄�...3.pptx

windows11-ltsc_2024-x64

1

x/발냄�...4.docx

windows10-2004-x64

1

x/발냄�...4.docx

windows11-ltsc_2024-x64

1

x/발냄�...�.pptx

windows10-2004-x64

1

x/발냄�...�.pptx

windows11-ltsc_2024-x64

1

x/발냄�...�.pptx

windows10-2004-x64

1

x/발냄�...�.pptx

windows11-ltsc_2024-x64

8

x/발냄�...7.xlsx

windows10-2004-x64

1

x/발냄�...7.xlsx

windows11-ltsc_2024-x64

8

x/발냄�...�.xlsx

windows10-2004-x64

1

x/발냄�...�.xlsx

windows11-ltsc_2024-x64

8

x/발냄�...�.xlsx

windows10-2004-x64

1

x/발냄�...�.xlsx

windows11-ltsc_2024-x64

1

x/발냄�...�.pptx

windows10-2004-x64

1

x/발냄�...�.pptx

windows11-ltsc_2024-x64

8

x/발냄�...4.docx

windows10-2004-x64

1

x/발냄�...4.docx

windows11-ltsc_2024-x64

8

x/발냄�...1.xlsx

windows10-2004-x64

1

x/발냄�...1.xlsx

windows11-ltsc_2024-x64

1

x/발냄�...1.pptx

windows10-2004-x64

1

x/발냄�...1.pptx

windows11-ltsc_2024-x64

1

x/발냄�...1.docx

windows10-2004-x64

1

x/발냄�...1.docx

windows11-ltsc_2024-x64

8

x/발냄�...5.pptx

windows10-2004-x64

1

x/발냄�...5.pptx

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    900s
  • max time network
    847s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 10:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    x/발냄새일지/낮잠성지/주말계획표/고양이밥그릇현황_20200421_511.pptx
  • Size 5KB
  • Sample261102-mtxadavv2j
  • SHA256 0426ef1ff5383d4690712bc62684f5e60eaf02d5613ee9db5c67871a3e0dfc9f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Documents\x\발냄새일지\낮잠성지\주말계획표\고양이밥그릇현황_20200421_511.pptx" /ou ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:5652
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4876
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5628
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4936
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5968
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:2220

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 607B
            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            cabC3F2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC3F2.tmp
            • Size 19KB
            • SHA256 93a2f873acf5bead4bc0d1cc17b5e89a928d63619f70a1918b29e5230abead8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC403.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC403.tmp
            • Size 22KB
            • SHA256 345aa5ca2496f975b7e33c182d5e57377f8b740f23e9a55f4b2b446723947b72
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC413.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC413.tmp
            • Size 19KB
            • SHA256 16c08547239e5b969041ab201eb55a3e30ead400433e926257331cb945dff094
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC414.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC414.tmp
            • Size 23KB
            • SHA256 298fd9dadf0acebb2aa058a09eebfae15e5d1c5a8982dee6669c63fb6119a13d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC415.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC415.tmp
            • Size 19KB
            • SHA256 3ee9ae1f8dab4c498bd561d8fcc66d83e58f11b7bb4b2776df99f4cda4b850c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC416.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC416.tmp
            • Size 21KB
            • SHA256 4a7dc4ed098e580c8d623c51b57c0bc1d601c45f40b60f39bba5f063377c3c1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC428.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC428.tmp
            • Size 20KB
            • SHA256 b217393fd2f95a11e2c594e736067870212e3c5242a212d6f9539450e8684616
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC43C.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC43C.tmp
            • Size 20KB
            • SHA256 6b1633dd765a11e7ed26f8f9a4dd45023b3e4adb903c934df3917d07a3856bff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC44F.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC44F.tmp
            • Size 21KB
            • SHA256 5c70dd1551eb8b9b13efafeeaf70f08b307e110caee75ad9908a6a42bbccb07e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC451.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC451.tmp
            • Size 21KB
            • SHA256 e555a610a61db4f45a29a7fb196a9726c25772594252ad534453e69f05345283
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC473.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC473.tmp
            • Size 30KB
            • SHA256 f747dd8b79fc69217fa3e36fae0ab417c1a0759c28c2c4f8b7450c70171228e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC475.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC475.tmp
            • Size 21KB
            • SHA256 773ac516c9b9b28058128ec9be099f817f3f90211ac70dc68077599929683d6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC477.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC477.tmp
            • Size 18KB
            • SHA256 e3be3f1e341c0fa5e9cb79e2739cf0565c6ea6c189ea3e53acf04320459a7070
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC478.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC478.tmp
            • Size 24KB
            • SHA256 f2db1e60533f0d108d5fb1004904c1f2e8557d4493f3b251a1b3055f8f1507a3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC488.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC488.tmp
            • Size 26KB
            • SHA256 aa03afb681a76c86c1bd8902ee2bba31a644841ce6bcb913c8b5032713265578
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC49C.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC49C.tmp
            • Size 20KB
            • SHA256 1cf5c2d0f6188ffff117932c424cc55d1459e0852564c09d7779263abd116118
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC4AD.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC4AD.tmp
            • Size 21KB
            • SHA256 557e0714d5536070131e7e7cdd18f0ef23fe6fb12381040812d022ec0fee7957
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC676.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC676.tmp
            • Size 476KB
            • SHA256 4087d3c1e0d93567e67fc8f17cd3ad5587c2fc203b1bbeb8d7a01a750d54e924
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC6C6.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC6C6.tmp
            • Size 484KB
            • SHA256 34a36ff02892fd8f89c77992ec7a7eb0fd1459483eccbbee139c38646e8685ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC8DB.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC8DB.tmp
            • Size 300KB
            • SHA256 3744bfa286cfcff46e51e6a68823a23f55416cd6619156b5929fed1f7778f1c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC8ED.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC8ED.tmp
            • Size 706KB
            • SHA256 9af92b1671772e8e781b58217dab481f0afbcf646de36bc1bffc7d411d14e351
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC96C.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC96C.tmp
            • Size 264KB
            • SHA256 372572dcbad590f64f5d18727757cbdf9366dde90955c79a0fcc9f536dab0384
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC9BC.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC9BC.tmp
            • Size 288KB
            • SHA256 6cb03cebab2c28bf5318b13eeee49fbed8dcedaf771de78126d1bfe9bd81c674
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabC9FC.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabC9FC.tmp
            • Size 225KB
            • SHA256 6a3801c1d4cf0c19a990282d93ac16007f6cacb645f0e0684ef2edac02647833
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabCA2D.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabCA2D.tmp
            • Size 217KB
            • SHA256 217ec1b6e00a24583b166026dec480d447fb564cf3bca81984684648c272f767
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabCA6E.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabCA6E.tmp
            • Size 270KB
            • SHA256 b4bc3cd34bd328aaf68289cc0ed4d5cf8167f1ee1d7be20232ed4747ff96a80a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabCC35.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabCC35.tmp
            • Size 442KB
            • SHA256 1d9c6c49026503e16d584633211df49b82191f3988f466c7f12d29c8ae5e4e4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabCCB4.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabCCB4.tmp
            • Size 255KB
            • SHA256 849e2e915aa61e2f831e54f337a745a5946467d539ccbd0214b4742f4e7e94ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabCCC5.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabCCC5.tmp
            • Size 1.5MB
            • SHA256 80adc8c9ede235ad8cd45eeace2f40227aba01d9fef261756f4a4c44eafb146b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabCF86.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabCF86.tmp
            • Size 1.0MB
            • SHA256 30aec7f9ecdad690a2cb38ba6a2e07c8158175140b76f17aae7d828a42a727a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabCFA8.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabCFA8.tmp
            • Size 2.0MB
            • SHA256 ad50810112e08b981e967a5984dab3da6c4aaa890316ba38d44f39d80ccbb4e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabCFF8.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabCFF8.tmp
            • Size 2.0MB
            • SHA256 c8b322819a2f84bf80acd654aaaac3e08debb533b1086021078effba27968a37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabD25B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabD25B.tmp
            • Size 681KB
            • SHA256 3732eb6166945db2bf792da04199b5c4a0fb3c96621ecbfdeaf2ea1699ba88ee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabD3E4.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabD3E4.tmp
            • Size 1.3MB
            • SHA256 9f4cd66a196d3874ba6bc74f9320f4eadde09586dcb0ae00adf0a56ec3eee5f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabD50F.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabD50F.tmp
            • Size 2.6MB
            • SHA256 3779e325d94b6fa8023669da99cf47a3169e6648913018886647ecb9e6f735e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabD56E.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabD56E.tmp
            • Size 537KB
            • SHA256 4e2e93ebac4ad3f8690b020040d1ae3f8e7905ab7286fc25671e07aa0282cac0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabD580.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabD580.tmp
            • Size 1.0MB
            • SHA256 4c3b008e0eb10a722d8fedb325bfb97edaa609b1e901295f224dd4cb4df5fc26
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabD5A1.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabD5A1.tmp
            • Size 931KB
            • SHA256 8b0631da4dc79e036251379a0a68c3ba977f14bcc797ba0eb9692f8bb90ddb4d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabDC3B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabDC3B.tmp
            • Size 1.8MB
            • SHA256 8af4c7cac47d2b9c7adeadf276edae830b4cc5ffe7e765e3c3d7b3fadcb5f273
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabDC6C.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabDC6C.tmp
            • Size 1.2MB
            • SHA256 ada7eff0676d9cce1935d5485f3dde35c594d343658fb1da42cb5a48fc3fc16a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabDD39.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabDD39.tmp
            • Size 1.0MB
            • SHA256 69b2675e47917a9469f771d0c634bd62b2dfa0f5d4af3fd7afe9196bf889c19e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabDE64.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabDE64.tmp
            • Size 1.7MB
            • SHA256 640ad075b555d4a2143f909eafd91f54076f5dde42a2b11cd897bc564b5d7ff7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabE05A.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabE05A.tmp
            • Size 7.8MB
            • SHA256 8fba95d2c1904dfd921417ce8829fa9198cb650e7b1c0e7344743a7007bc22f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabE07B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabE07B.tmp
            • Size 2.4MB
            • SHA256 ad26761d59f1fa9783c2f49184a2e8fe55fcd46cd3c49ffc099c02310649dc67
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabE1B5.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabE1B5.tmp
            • Size 2.5MB
            • SHA256 a44166f5c9f2553555a43586ba5db1c1de54d72d308a48268f27c6a00076b1ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabE2FF.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabE2FF.tmp
            • Size 2.8MB
            • SHA256 a1acf9d982a2531697766e894faab8ad73690e87ec341097fb0f5682e1b76e21
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cabE330.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\cabE330.tmp
            • Size 3.1MB
            • SHA256 42323dd1d3e88c3207e16e0c95ca1048f2e4cd66183ad23b90171da381d37b58
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4936-471-0x00000123170F0000-0x00000123171F0000-memory.dmp
            Download

            memory/4936-470-0x0000012304C20000-0x0000012304C40000-memory.dmp
            Download

            memory/4936-491-0x0000012304E80000-0x0000012304EA0000-memory.dmp
            Download

            memory/4936-505-0x0000012317890000-0x00000123178B0000-memory.dmp
            Download

            memory/4936-460-0x0000012303440000-0x0000012303540000-memory.dmp
            Download

            memory/5628-652-0x000000000ED90000-0x000000000EE3E000-memory.dmp
            Download

            memory/5652-4-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp
            Download

            memory/5652-0-0x00007FF882B60000-0x00007FF882B70000-memory.dmp
            Download

            memory/5652-14-0x00007FF87FE30000-0x00007FF87FE40000-memory.dmp
            Download

            memory/5652-12-0x00007FF87FE30000-0x00007FF87FE40000-memory.dmp
            Download

            memory/5652-13-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp
            Download

            memory/5652-11-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp
            Download

            memory/5652-8-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp
            Download

            memory/5652-10-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp
            Download

            memory/5652-7-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp
            Download

            memory/5652-26-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp
            Download

            memory/5652-6-0x00007FF882B60000-0x00007FF882B70000-memory.dmp
            Download

            memory/5652-28-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp
            Download

            memory/5652-27-0x00007FF8C2B7F000-0x00007FF8C2B80000-memory.dmp
            Download

            memory/5652-5-0x00007FF882B60000-0x00007FF882B70000-memory.dmp
            Download

            memory/5652-2-0x00007FF882B60000-0x00007FF882B70000-memory.dmp
            Download

            memory/5652-3-0x00007FF882B60000-0x00007FF882B70000-memory.dmp
            Download

            memory/5652-1-0x00007FF8C2B7F000-0x00007FF8C2B80000-memory.dmp
            Download

            memory/5652-9-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp
            Download