76debf64d4c9b5467ea38f653a1aac4005b21cd57f2b5b28da4b7ff1de1cbe1f

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_bb02c9883b0131f5e572e5e55a68295a_coinminer_driverpack_elex_wannacry.exe
Size 3.2MB
Sample261002-e43k5svdjf
SHA256 76debf64d4c9b5467ea38f653a1aac4005b21cd57f2b5b28da4b7ff1de1cbe1f
MD5 bb02c9883b0131f5e572e5e55a68295a
SHA1 77fb10f1c2c5d56562e3c46c3358bd3ba5923951
SHA512 1e71d6b8d55091ec7c4d368b3d01401354e984f58f1d4f8ec5cdd4ef818f1f53190c56a0665856c1b75b50081b6ad7f88d43ebac4787dc15c1936d538cbe19ec
SSDEEP 98304:W5aFJwSjbuwJurWW6GfhNaPExgLBcdBq8M/ta:W5aFJwSjjPtWo2gabqt/ta
TLSH
T110F5330035A78271E5D363312E04ABA7E5B0AD354B7E97CB8BA13E354F761E1BA381D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5428	powershell.exe
5900	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1192	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
3184	Setup.exe
2068	7z.exe

Loads dropped DLL 6 IoCs

pid	Process
3184	Setup.exe
3184	Setup.exe
3184	Setup.exe
3184	Setup.exe
3184	Setup.exe
2068	7z.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2740	cmd.exe
3820	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_bb02c9883b0131f5e572e5e55a68295a_coinminer_driverpack_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5428	powershell.exe
5428	powershell.exe
5900	powershell.exe
5900	powershell.exe
5900	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe
Token: 33	5428	powershell.exe
Token: 34	5428	powershell.exe
Token: 35	5428	powershell.exe
Token: 36	5428	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeIncreaseQuotaPrivilege	5900	powershell.exe
Token: SeSecurityPrivilege	5900	powershell.exe
Token: SeTakeOwnershipPrivilege	5900	powershell.exe
Token: SeLoadDriverPrivilege	5900	powershell.exe
Token: SeSystemProfilePrivilege	5900	powershell.exe
Token: SeSystemtimePrivilege	5900	powershell.exe
Token: SeProfSingleProcessPrivilege	5900	powershell.exe
Token: SeIncBasePriorityPrivilege	5900	powershell.exe
Token: SeCreatePagefilePrivilege	5900	powershell.exe
Token: SeBackupPrivilege	5900	powershell.exe
Token: SeRestorePrivilege	5900	powershell.exe
Token: SeShutdownPrivilege	5900	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeSystemEnvironmentPrivilege	5900	powershell.exe
Token: SeRemoteShutdownPrivilege	5900	powershell.exe
Token: SeUndockPrivilege	5900	powershell.exe
Token: SeManageVolumePrivilege	5900	powershell.exe
Token: 33	5900	powershell.exe
Token: 34	5900	powershell.exe
Token: 35	5900	powershell.exe
Token: 36	5900	powershell.exe
Token: SeRestorePrivilege	2068	7z.exe
Token: 35	2068	7z.exe
Token: SeSecurityPrivilege	2068	7z.exe
Token: SeSecurityPrivilege	2068	7z.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3184	4400	2026-10-01_bb02c9883b0131f5e572e5e55a68295a_coinminer_driverpack_elex_wannacry.exe	89
PID 3184 wrote to memory of 2740	3184	Setup.exe	90
PID 2740 wrote to memory of 5428	2740	cmd.exe	92
PID 3184 wrote to memory of 3820	3184	Setup.exe	94
PID 3184 wrote to memory of 2836	3184	Setup.exe	95
PID 3820 wrote to memory of 5900	3820	cmd.exe	97
PID 3820 wrote to memory of 2068	3820	cmd.exe	99
PID 3820 wrote to memory of 1192	3820	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-10-01_bb02c9883b0131f5e572e5e55a68295a_coinminer_driverpack_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_bb02c9883b0131f5e572e5e55a68295a_coinminer_driverpack_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\ProgramData\Launcher\Setup.exe
  "C:\ProgramData\Launcher\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Launcher\extract2.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionProcess 'powershell.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Launcher\extract3.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5900
  - - C:\ProgramData\Launcher\7z.exe
      7z x Launcher.7z -pool=77
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2068
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall set opmode disable
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1192
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\ProgramData\Launcher\7z.dll
Size 1.8MB
SHA256 69fd4df057985c40e510e2fac182881c7f85e90aa13ec703f763a8fdb2ce61f8
MD5 58c9628787bce8db529dd668e1825630
SHA1 f59f722a9a0064fdc2c762100383d7babb0a57b6
SHA512 da68b7bc3281bb0f7dc1ed7dcd234dddbbb1f5992bb156f6a844f8c8bea42fecee93f953d6f4a1c7d324b456e2fe56246601f334b13badc3c21e307958117327
SSDEEP 24576:h8yTPwShrEtNwWdhpmBi/33fR8x4cWNFhzNXuzrMnM:hzTPwZ/wUhwucOrbn
TLSH
T14E954C1BF6748270D0B6C075C5E2AB9AEE7134869B30A6C712859B3D2F17EF5863D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\ProgramData\Launcher\7z.exe
Size 562KB
SHA256 83967f1b02b43c4efeda302795722c809e0e81b8307de73558d10484d5676a7d
MD5 0355ea40d9046173bb1435b41bfc118e
SHA1 abb27eaed3b878a16ebe5463301b9d70f4580b76
SHA512 cbc0d427f14bd6ba67caf6e6e279a381f96bcda72fc26df4c3f8083f63ca8b9d3b0ff4d38971b346f1f1f3e5eb1e5c2d95b42c933f9fad98746d8b25b62190f5
SSDEEP 12288:t5xAeJRYzx/uXbpb7ykox5r6f5y82XpdC8t:uIYF/EJy2zIPt
TLSH
T1C3C4F726F6748335D073C0B9C5D2A69AE97130865B308ACB4286C77C3F676E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.7z

Path C:\ProgramData\Launcher\Launcher.7z
Size 1.7MB
SHA256 aae3ee9f6082676d2d9035d7b6beba659d7444554d0b96ae00113409ce1b49ad
MD5 a75a4fda04f109dd5da1827f48250811
SHA1 4d78908c312dba68341d707fe4903661952cbe0d
SHA512 554d2201424ee1f9366fced16f96fa4f8c16c7aeda32a925f8d68d7457817a55d7637b0f8393eda845b543ddb40825682ae20e9a390e9b29a3e0c7f43fa56a6b
SSDEEP 49152:PyDBvle0bu+D81GXAS/iHmy+Qzg7ZYSmsDAk8:KNdbbu+agxM/Sm2Ak8
TLSH
T19F8533883123D722878AE24B6F34CB9BEC70FD54977FE3578AD64E748A8D16875100B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\ProgramData\Launcher\Setup.exe
Size 34KB
SHA256 8e347ef52c18a9f479a5d82729de5b4889e1e4ad74b7dab6ac17183882c5b4bf
MD5 1d7c6066058c4b69c5a144c74f839f52
SHA1 f46fd60cc3a1980d685adc53ade5baa3484e615b
SHA512 b830bbe16c175d953ccab63ca38f7b527b358508f436107b488ebf1d41fab7f27bf91d0160baa2519259d71c4bddee9ee5e098ae8307cea951e6c211dff75c3e
SSDEEP 384:IiannYJLOKiXyWkn3BX05x4GGY+hoUGxaQAwZ0oK78hUZZZgYa8IFDAcM8:IpnKO3X4n3BX0v4cFqkhUZZZ3DIr
TLSH
T1EDF2C541AA1C05F1E961DB39192FDF02C765BC3A9990E16762EE3EDA99F1050133BB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extract2.bat

Path C:\ProgramData\Launcher\extract2.bat
Size 84B
SHA256 4d30e07de90e884457243e8e4a20ae5b960890212792581944d1510efcb98e61
MD5 f188dec7ed26b4d829969675090e1e3c
SHA1 308d36faefbb1cffe217345340c93a6647157849
SHA512 826206d55e48e4a0caa1661491e7db106f8032b2a8e96d075d8d2674478da99697554f9f9147a50f45ac1292388ba98971bebefdf9dc9bc478d2bb3b85e36daa
TLSH
T1F9A01222011840DD8BE90458F011054A248B8020401F009331289C08190053CD3B9C0C
MD5 SHA1 SHA512 TLSH

Submit Download

extract3.bat

Path C:\ProgramData\Launcher\extract3.bat
Size 152B
SHA256 0075dee650a31a4e9911743f33e01b79db7e392105725499cda28928ccc6d6b4
MD5 8bedeb85d87b182f0b55a06b20fdb8a4
SHA1 7f581191766e62ad467417ccce7113497c1e30ad
SHA512 66b137cfebe9f75f3a264b96b9ee17727d02a04c88d739edea6a5128f8da4fa350754ff334e3cfb02927dbb3cef841032af5e793b01ec891681edc903abf07d5
TLSH
T1ADC08C15009A0046FDB0AF644228031CD20B827A602E80B63839CA05254EC6CE674D04
MD5 SHA1 SHA512 TLSH

Submit Download

rtl70.bpl

Path C:\ProgramData\Launcher\rtl70.bpl
Size 766KB
SHA256 a2c9f2055886327d03724c2aef95566c9a731f83b568ff88c48ccc0dc74218f0
MD5 123015c8c70d81aff1e6d3b316ddf00e
SHA1 a401df86057c3d8cf11fb1dde177fcb549433145
SHA512 550e8d1ae8f1994765cf2310519b45ec87331ad72b5004f3feb1a0291070044acde37841e3f44195a021256ad16d294665edc9d44604bca2edcd4ef604d4ad5d
SSDEEP 12288:RnJoCnL9vbHcONNBbiaeV/PzUW6SIg3N8Ts0urVyU08v/fHTE/JW+A9IpDNOej3q:RnJzdH9tYG8vHkW+A9ITOej3+Jr2z
TLSH
T185F48C21F24889FBD6B3273D451DBE37C5B97E209620CEDA69F84D49D9605803F283DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl70.bpl

Path C:\ProgramData\Launcher\vcl70.bpl
Size 1.3MB
SHA256 976e20f397d19ba3b5b3347a3299c061ca325b7b915a46baf6e57cce5779a9cf
MD5 563e6aeeb20c98bc1f8917ec3f04a0ac
SHA1 82678ab71e3eacd679a0137d1b46eb3bab87c050
SHA512 bf7ebe2a5746c6347d880eeb9b4c225a7641f206c6f9e6cac6b2da4b95110ff05af652c1c71d5cebafc0e8e09100e861b6b6962941e9bce1b2873510300fca15
SSDEEP 12288:eYURhofl6VUvxusfIuJ25+G1gMBpSFxZTemnMc3YB4gisIKXKjjgOby17fG:oof30jJBpSfZyWIGBsKHgObC
TLSH
T1E7557C51F2280CB6D4A757BC2A7F7F21D965AB106260A78E3AF48C5C5EE2D803F5134B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 fef8f70f54271e03abc614cb0744955f077ce3e6b8dd81b3496e672eda19b9b6
MD5 8d905565ea3a945fe2c27e1e45c1d46a
SHA1 6b30fb8117ae9899556df2fadb75ca5b4db274ce
SHA512 4c740c3319a37abb51a87915e4b3ef891ec2b84bedcec63dfe710f417c80f920a781fd5d4235ccd3a6712b2f2dc6ec8248c97da3a5fe62d1a44f6ed099965766
SSDEEP 384:h1eBaoT1iBG+GW14b0Uv1hqY0aeq9B2PnNIAXr48+xWb+tzKwUvYbhNaPIlRtLRR:7exZ6GNWiL1MYzclIAXrX+JVrbhNaPQZ
TLSH
T1F2A2B578203F6DC7D8D226B410D50AB7FBE4D489DAB61194BF1BDE2F4C90EBA4A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3k1pk0dh.wua.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3k1pk0dh.wua.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3184-28-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/3184-66-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3184-79-0x0000000002470000-0x0000000002537000-memory.dmp

Download

memory/3184-78-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3184-77-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3184-27-0x0000000002470000-0x0000000002537000-memory.dmp

Download

memory/3184-67-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3184-68-0x0000000002470000-0x0000000002537000-memory.dmp

Download

memory/3184-69-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/5428-41-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Download

memory/5428-50-0x0000000006110000-0x000000000615C000-memory.dmp

Download

memory/5428-63-0x00000000074B0000-0x00000000074BA000-memory.dmp

Download

memory/5428-64-0x00000000076B0000-0x0000000007746000-memory.dmp

Download

memory/5428-61-0x0000000007A80000-0x00000000080FC000-memory.dmp

Download

memory/5428-60-0x0000000007300000-0x00000000073A3000-memory.dmp

Download

memory/5428-59-0x00000000072D0000-0x00000000072F0000-memory.dmp

Download

memory/5428-52-0x000000006EEF0000-0x000000006EF3C000-memory.dmp

Download

memory/5428-51-0x0000000007270000-0x00000000072A6000-memory.dmp

Download

memory/5428-62-0x0000000007440000-0x000000000745A000-memory.dmp

Download

memory/5428-49-0x00000000060B0000-0x00000000060CE000-memory.dmp

Download

memory/5428-47-0x0000000005C00000-0x0000000005F5B000-memory.dmp

Download

memory/5428-37-0x0000000004D30000-0x0000000004D66000-memory.dmp

Download

memory/5428-40-0x0000000005B20000-0x0000000005B86000-memory.dmp

Download

memory/5428-38-0x0000000005420000-0x0000000005A6A000-memory.dmp

Download

memory/5428-39-0x0000000005310000-0x0000000005332000-memory.dmp

Download

memory/5900-97-0x0000000007520000-0x00000000075C3000-memory.dmp

Download

memory/5900-90-0x0000000070810000-0x000000007085C000-memory.dmp

Download

memory/5900-89-0x0000000006580000-0x00000000065CC000-memory.dmp

Download

memory/5900-86-0x0000000005CC0000-0x000000000601B000-memory.dmp

Download