phorphiex | 2181e3938d19e6b620e9f95f0790504d64ba19d3f450c34f4ec4d1e87c39026d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 10KB
Sample260708-e5axhsay8w
SHA256 2181e3938d19e6b620e9f95f0790504d64ba19d3f450c34f4ec4d1e87c39026d
MD5 80e7089cffdbeb0595e33227e9b4bbd6
SHA1 994f9d84007faab75d516b997331fd010c18956d
SHA512 1078a0ef5de9eb52e08049bff4a519d7334b11696ba9f21f67bb012eaf25ec9e251d4f45e612a01c46de2854b17c34c53aa51fb8e5dc47f1e5fbee6694fa22fe
SSDEEP 192:A6LoqaTBgx+ealq50350EPFJxTEZmFhSKOmV:A6LoxWwpBPFwZ4V
TLSH
T11A22192A7E4A0331D3D488F45479838F653D5563A787E3EBF373A59A0BA63488440DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution phorphiex xmrig loader miner persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://91.92.242.107/lmix/
http://178.16.55.240/nmixx/
http://178.16.55.240/nmix/
http://178.16.55.240/
http://130.12.180.190/us/
http://130.12.180.190/xxx/
http://130.12.180.190/omix/
http://130.12.180.190/corp/

Mutex

aefaeffea

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36

Signatures

Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/1192-55-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-56-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-59-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-57-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-60-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-61-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-58-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-68-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-69-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-71-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-70-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-67-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-65-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-62-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-72-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1192-73-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig

Downloads MZ/PE file 9 IoCs

flow	pid	Process
13	1020	file.exe
13	1020	file.exe
13	1020	file.exe
13	1020	file.exe
13	1020	file.exe
13	1020	file.exe
13	1020	file.exe
13	1020	file.exe
13	1020	file.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 11 IoCs

pid	Process
3992	2418613541.exe
3304	1781024919.exe
1740	1392235431.exe
1676	1003413175.exe
4516	2816623683.exe
1324	2427834195.exe
216	2039011939.exe
1328	1650222451.exe
1424	3463432960.exe
1128	3074610703.exe
2380	syswinprdrvc.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 1192	2380	syswinprdrvc.exe	113

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3640	sc.exe
2856	sc.exe
3028	sc.exe
4800	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2418613541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1392235431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1003413175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2816623683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1650222451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3463432960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1781024919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2427834195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2039011939.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1128	3074610703.exe
1128	3074610703.exe
1128	3074610703.exe
1128	3074610703.exe
2380	syswinprdrvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1192	dwm.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 3992	1020	file.exe	86
PID 1020 wrote to memory of 3304	1020	file.exe	91
PID 1020 wrote to memory of 1740	1020	file.exe	93
PID 1020 wrote to memory of 1676	1020	file.exe	96
PID 1020 wrote to memory of 4516	1020	file.exe	97
PID 1020 wrote to memory of 1324	1020	file.exe	98
PID 1020 wrote to memory of 216	1020	file.exe	99
PID 1020 wrote to memory of 1328	1020	file.exe	100
PID 1020 wrote to memory of 1424	1020	file.exe	101
PID 1020 wrote to memory of 1128	1020	file.exe	103
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113
PID 2380 wrote to memory of 1192	2380	syswinprdrvc.exe	113

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Local\Temp\2418613541.exe
  C:\Users\Admin\AppData\Local\Temp\2418613541.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\1781024919.exe
  C:\Users\Admin\AppData\Local\Temp\1781024919.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3304
- C:\Users\Admin\AppData\Local\Temp\1392235431.exe
  C:\Users\Admin\AppData\Local\Temp\1392235431.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\1003413175.exe
  C:\Users\Admin\AppData\Local\Temp\1003413175.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1676
- C:\Users\Admin\AppData\Local\Temp\2816623683.exe
  C:\Users\Admin\AppData\Local\Temp\2816623683.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\2427834195.exe
  C:\Users\Admin\AppData\Local\Temp\2427834195.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\2039011939.exe
  C:\Users\Admin\AppData\Local\Temp\2039011939.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:216
- C:\Users\Admin\AppData\Local\Temp\1650222451.exe
  C:\Users\Admin\AppData\Local\Temp\1650222451.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1328
- C:\Users\Admin\AppData\Local\Temp\3463432960.exe
  C:\Users\Admin\AppData\Local\Temp\3463432960.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\3074610703.exe
  C:\Users\Admin\AppData\Local\Temp\3074610703.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "winmgr"
    3⤵
    - Launches sc.exe
    PID:3640
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "winmgr" binpath= "C:\ProgramData\winmgr\syswinprdrvc.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2856
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4800
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "winmgr"
    3⤵
    - Launches sc.exe
    PID:3028

C:\ProgramData\winmgr\syswinprdrvc.exe
C:\ProgramData\winmgr\syswinprdrvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1003413175.exe

Path C:\Users\Admin\AppData\Local\Temp\1003413175.exe
Size 15KB
SHA256 5ad4fbf16c18e012d7a5f98b4900b45531e134ccbaf2a21d0b40d9066550f92b
MD5 51cc8cf534985359bfd1802472d10a79
SHA1 20870739bb86b262fc75b0f3ee18e7add5099e09
SHA512 2126fa4b7163a738152266e9e2559625c8da44ab1d289be91fcebd2769d515a56bf2b5c6a51556ac4332b493a39399346ca3cafab82cd49d2d4d2fb5656f0b27
SSDEEP 192:AWEEsGnjXgjk8LMRAW4NJTMpJFeIFFBKUSf/zwsd1gJxTmv8U9cthO9ik:ACSMqYUl/Zyav8U9cQX
TLSH
T1FE623C0BB8818035EBE14474827F526645BDACB623D4F9CBF7E0A48A5EB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1392235431.exe

Path C:\Users\Admin\AppData\Local\Temp\1392235431.exe
Size 15KB
SHA256 ac39d18b75cecb1c62e4b70e3343bc8b8fc2b69b10e6c7d4ab3340031073804c
MD5 f99be7974538164679301cc28289de43
SHA1 fe04aab98bca17923439afd3423c61917bed8fdd
SHA512 d2ae5b6f0017da1e38ca89c13d61cc20f3173e89902cd2c17421cb5b657027050188be54dcc3f40a85d78151b8789c87c1ee3a50030ceb55ea7352b95f48c2c2
SSDEEP 192:AW5sGnjXgjk8LcRAWIdJDMlIfeF5oIV1BKUSf/zwcd1gJxTmv8U9cthg9ik:AAScqdferoF/Jyav8U9cmX
TLSH
T118624C0BA4818036EBE14474827F526645FEACB623D4F9DBF7E068894EB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1650222451.exe

Path C:\Users\Admin\AppData\Local\Temp\1650222451.exe
Size 15KB
SHA256 4a8aa017e3bda8b370335b21c58a8918c5ea163e8b4364837fb15fccdbd15e02
MD5 cdbb0e5c27d6debc8bedaa701f9de00d
SHA1 6b488a3e731dd3fea573c5313d815e28d33cdabf
SHA512 78e5d45c03116873910b9dbd234ed9d569856286c2ce696204d8679c97e0d2bbbd1b1950286e570b4ddc08106a34e3cf410c346ebcc720cdbac1619f6fdbbe45
SSDEEP 192:AWisGnjXgjk8LMRAW4NJTMRJFeIFFBKUSf/zwsd1gJxTmv8U9cthk9ik:AvSMqAUl/Zyav8U9cqX
TLSH
T1EE624C0BB8818035EBE14474827F526645BDACB623D4F9CBF7E0648A5EB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1781024919.exe

Path C:\Users\Admin\AppData\Local\Temp\1781024919.exe
Size 15KB
SHA256 3b2466d82fa7901766556b9f64fc16440477a2791fb9df01ee9d9c7c4b016c06
MD5 b52d381c2a92fec89f6a78232f36d58a
SHA1 0bdaaae5bfcd7861bfdfd8faa8fea425bd60e9e5
SHA512 1a741ec4c5df5bbdb2eb4dc0144f3ae5b6a65512b3b875e52abbf563ad4815c4fe93a50577cb8d3438d382690ef08cc18611b22c1590e437db27cd128c1a936c
SSDEEP 192:AWQsGnjXgjk8LMRAW4NJTMpJFeIFFBKUSf/zwsd1gJxTmv8U9cthB9ik:ANSMqYUl/Zyav8U9c7X
TLSH
T126623C0BB8818035EBE14474827F526645BDACB623D4F9CBF7E0A48A5EB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2039011939.exe

Path C:\Users\Admin\AppData\Local\Temp\2039011939.exe
Size 15KB
SHA256 2012c7af2da6b649bc2bb58f54837b200cafecc44ceda8d5e2e43b0ea205ac97
MD5 11ac874e42b051aa5fa54ee1fef48819
SHA1 f6a44ae87468d81226dd5ca366e00cd90bc68e7d
SHA512 fd489fdb4eb78453a3e98e019391debd6e3ffe3a3d7ace48d56a0239fb4667980bc12c80ed512af10e3edff569d47da545cd7bf071ee32326673ada87f7c4b1a
SSDEEP 192:AW/sGnjXgjk8LcRAWIdJDMlIfeF5oIV1BKUSf/zwcd1gJxTmv8U9cthE9ik:AeScqdferoF/Jyav8U9cKX
TLSH
T148623C0BA4818035EBE14474827F526649FEACB623D4F9DBF7E064894AB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2418613541.exe

Path C:\Users\Admin\AppData\Local\Temp\2418613541.exe
Size 18KB
SHA256 f70b6a0341300dbb1fcad771e03a62544a9bb00abc14161cdcfb68b4022abdf7
MD5 d01264955ef941463bc61e1b6693dfc1
SHA1 0799c3a229f0541b337da359c9e363a4124afcbf
SHA512 1b52733e3d493635db5edd250433f2b0c86807e86dd4a1d8e67444396545ba8ef34fcd222ff43a67e989222e088e1038db8547f494e38085befdd4780da70a57
SSDEEP 192:daISCngTBvqQ1jV6lXwIXZ5qh4le6qo/fKUSiu9zw+gj5tBOgbOBqmEdEFWEo/GU:VIqQlV6lOh40uu9JgFtfUhav8U9ckF
TLSH
T1BE825C0FB9424726C0E110B49676873BDA786872338854DBFB944AED0B686D6FC3365F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2427834195.exe

Path C:\Users\Admin\AppData\Local\Temp\2427834195.exe
Size 15KB
SHA256 f3121b85cca17df3fe49fe45f70a3afbdf7861bcb5057a46bc8f79e6475795e2
MD5 d6dde7103e057acdabfef9cba08e22d4
SHA1 9d31664c3483489b5a4880e4d144cb6242c3d522
SHA512 1619fed9d65073309645e77309e1b2a4f913b10dbba7db2904e3b8551fa0ab1bf77547903781f2873efd6000a5beda97edb65c88db519d3f8bb8abb7af1f5f59
SSDEEP 192:AWesGnjXgjk8LMRAW4NJTMpJFeIFFBKUSf/zwsd1gJxTmv8U9cthB9ik:AfSMqYUl/Zyav8U9c7X
TLSH
T1ED623C0BB4818035EBE14474827F526645BDACB623D4F9CBF7E0A48A5EB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2816623683.exe

Path C:\Users\Admin\AppData\Local\Temp\2816623683.exe
Size 15KB
SHA256 94c0b9560299cbe10c23b062f08849ac03e2bed78a71581e3adf5ddc015ca615
MD5 b83b76361910a414cd4e15c98c5fd94f
SHA1 dbeca2018e179b33b8f67865c36e82c155018f54
SHA512 714d8e788215a2debbf0af4afda7272d933d5aa528b7cdbce561d27b008ffa714690ce8bfed7ea9b798e31ebf82a8466b9cc1d4ab6cc0507ad82fdeb8979b1f0
SSDEEP 192:AWctsGnjXgjk8LMRAW4NJTMRJFeIFFBKUSf/zwsd1gJxTmv8U9cthp9ik:ANSMqAUl/Zyav8U9cTX
TLSH
T184624C0BB8818035EBE14474827F526645BDACB623D4F9CBF7E0648A5EB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3074610703.exe

Path C:\Users\Admin\AppData\Local\Temp\3074610703.exe
Size 6.8MB
SHA256 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4
MD5 083d5895283755a910b5c59d60a5348b
SHA1 0d94bf4d0418061907ff7977e3f25a463cb25188
SHA512 4ae34f0e50843182f780d1e31b1226db5f831e6d48c1cfe9448c0c2da558a334f0ee37d00dfbe84c80e7d54a17eed1cc8b56b34da71123b65541a4dc58076f10
SSDEEP 196608:Od8aiP1kVGff0MYA9ZHP6mJhimlsM0sH86TTS6k:OWlMyhJDse/5
TLSH
T188660246297FA774A367A3848BD1E5739AAF4639FE55853036233CEB9F1049400B0EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3463432960.exe

Path C:\Users\Admin\AppData\Local\Temp\3463432960.exe
Size 15KB
SHA256 d117ee4a244959625a761696a9c719d161e6b11a7e880ada14ec8dde3f88d0ef
MD5 504dabe5363684f91a38690962c97a30
SHA1 707b490de6c0571e5d2867788e9bf8743549bac9
SHA512 b3561e33b0c0ca4965a21f096da6c5ab3e94659ee049b553938ba5d1e4893b2529a9e3b7ebafb002c9b6e802ffbb364d624804af98fecbf7b50f7cd97d66f8f1
SSDEEP 192:AWzsGnjXgjk8LMRAW4NJTMRJFeIFFBKUSf/zwsd1gJxTmv8U9cthq9ik:AeSMqAUl/Zyav8U9cMX
TLSH
T1EE624C0BB4808035EBE14474827F526645BDACB623D4F9CBF7E0648A5EB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1192-57-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-68-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-56-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-59-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-54-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-60-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-61-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-58-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-66-0x00000273843C0000-0x00000273843E0000-memory.dmp

Download

memory/1192-55-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-69-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-71-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-70-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-67-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-65-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-62-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-72-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1192-73-0x0000000140000000-0x000000014082E000-memory.dmp

Download