8b877245b94a28fac7f1e0f028a0fcb883d01ac2644d89d4135629faaa3adf3c

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_c0fc970c6843c1f140e5f47b8bfd6845_coinminer_driverpack_elex_wannacry.exe
Size 3.2MB
Sample261002-eeta6ssv8p
SHA256 8b877245b94a28fac7f1e0f028a0fcb883d01ac2644d89d4135629faaa3adf3c
MD5 c0fc970c6843c1f140e5f47b8bfd6845
SHA1 cc50138a7dd916ba337e5fe40f254b926cc5be50
SHA512 fac1505547cfcaf16b9bb8d9c66b3e8b48f8568f6554601eaa4929d412b097553078202a425a2250e0cfc31976aedd7b0e8b41bf476fbaaf44b197a4e20f4db6
SSDEEP 98304:W5aFJwSjbuwJurWW6GfhNaPExgLBcdBq8M/tM:W5aFJwSjjPtWo2gabqt/tM
TLSH
T14EF5330035A78271E5D363312E04ABA7E5B0AD354B7E97CB8BA13E354F761E1BA381D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5384	powershell.exe
1752	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4056	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2360	Setup.exe
788	7z.exe

Loads dropped DLL 7 IoCs

pid	Process
2360	Setup.exe
2360	Setup.exe
2360	Setup.exe
2360	Setup.exe
2360	Setup.exe
2360	Setup.exe
788	7z.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1136	cmd.exe
2196	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_c0fc970c6843c1f140e5f47b8bfd6845_coinminer_driverpack_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1752	powershell.exe
1752	powershell.exe
5384	powershell.exe
5384	powershell.exe
5384	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeIncreaseQuotaPrivilege	1752	powershell.exe
Token: SeSecurityPrivilege	1752	powershell.exe
Token: SeTakeOwnershipPrivilege	1752	powershell.exe
Token: SeLoadDriverPrivilege	1752	powershell.exe
Token: SeSystemProfilePrivilege	1752	powershell.exe
Token: SeSystemtimePrivilege	1752	powershell.exe
Token: SeProfSingleProcessPrivilege	1752	powershell.exe
Token: SeIncBasePriorityPrivilege	1752	powershell.exe
Token: SeCreatePagefilePrivilege	1752	powershell.exe
Token: SeBackupPrivilege	1752	powershell.exe
Token: SeRestorePrivilege	1752	powershell.exe
Token: SeShutdownPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeSystemEnvironmentPrivilege	1752	powershell.exe
Token: SeRemoteShutdownPrivilege	1752	powershell.exe
Token: SeUndockPrivilege	1752	powershell.exe
Token: SeManageVolumePrivilege	1752	powershell.exe
Token: 33	1752	powershell.exe
Token: 34	1752	powershell.exe
Token: 35	1752	powershell.exe
Token: 36	1752	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeIncreaseQuotaPrivilege	5384	powershell.exe
Token: SeSecurityPrivilege	5384	powershell.exe
Token: SeTakeOwnershipPrivilege	5384	powershell.exe
Token: SeLoadDriverPrivilege	5384	powershell.exe
Token: SeSystemProfilePrivilege	5384	powershell.exe
Token: SeSystemtimePrivilege	5384	powershell.exe
Token: SeProfSingleProcessPrivilege	5384	powershell.exe
Token: SeIncBasePriorityPrivilege	5384	powershell.exe
Token: SeCreatePagefilePrivilege	5384	powershell.exe
Token: SeBackupPrivilege	5384	powershell.exe
Token: SeRestorePrivilege	5384	powershell.exe
Token: SeShutdownPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeSystemEnvironmentPrivilege	5384	powershell.exe
Token: SeRemoteShutdownPrivilege	5384	powershell.exe
Token: SeUndockPrivilege	5384	powershell.exe
Token: SeManageVolumePrivilege	5384	powershell.exe
Token: 33	5384	powershell.exe
Token: 34	5384	powershell.exe
Token: 35	5384	powershell.exe
Token: 36	5384	powershell.exe
Token: SeRestorePrivilege	788	7z.exe
Token: 35	788	7z.exe
Token: SeSecurityPrivilege	788	7z.exe
Token: SeSecurityPrivilege	788	7z.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2360	4628	2026-10-01_c0fc970c6843c1f140e5f47b8bfd6845_coinminer_driverpack_elex_wannacry.exe	89
PID 2360 wrote to memory of 1136	2360	Setup.exe	90
PID 1136 wrote to memory of 1752	1136	cmd.exe	92
PID 2360 wrote to memory of 2196	2360	Setup.exe	94
PID 2360 wrote to memory of 4420	2360	Setup.exe	95
PID 2196 wrote to memory of 5384	2196	cmd.exe	97
PID 2196 wrote to memory of 788	2196	cmd.exe	99
PID 2196 wrote to memory of 4056	2196	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-10-01_c0fc970c6843c1f140e5f47b8bfd6845_coinminer_driverpack_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_c0fc970c6843c1f140e5f47b8bfd6845_coinminer_driverpack_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628
- C:\ProgramData\Launcher\Setup.exe
  "C:\ProgramData\Launcher\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Launcher\extract2.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionProcess 'powershell.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Launcher\extract3.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5384
  - - C:\ProgramData\Launcher\7z.exe
      7z x Launcher.7z -pool=77
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:788
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall set opmode disable
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4056
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\ProgramData\Launcher\7z.dll
Size 1.8MB
SHA256 69fd4df057985c40e510e2fac182881c7f85e90aa13ec703f763a8fdb2ce61f8
MD5 58c9628787bce8db529dd668e1825630
SHA1 f59f722a9a0064fdc2c762100383d7babb0a57b6
SHA512 da68b7bc3281bb0f7dc1ed7dcd234dddbbb1f5992bb156f6a844f8c8bea42fecee93f953d6f4a1c7d324b456e2fe56246601f334b13badc3c21e307958117327
SSDEEP 24576:h8yTPwShrEtNwWdhpmBi/33fR8x4cWNFhzNXuzrMnM:hzTPwZ/wUhwucOrbn
TLSH
T14E954C1BF6748270D0B6C075C5E2AB9AEE7134869B30A6C712859B3D2F17EF5863D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\ProgramData\Launcher\7z.exe
Size 562KB
SHA256 83967f1b02b43c4efeda302795722c809e0e81b8307de73558d10484d5676a7d
MD5 0355ea40d9046173bb1435b41bfc118e
SHA1 abb27eaed3b878a16ebe5463301b9d70f4580b76
SHA512 cbc0d427f14bd6ba67caf6e6e279a381f96bcda72fc26df4c3f8083f63ca8b9d3b0ff4d38971b346f1f1f3e5eb1e5c2d95b42c933f9fad98746d8b25b62190f5
SSDEEP 12288:t5xAeJRYzx/uXbpb7ykox5r6f5y82XpdC8t:uIYF/EJy2zIPt
TLSH
T1C3C4F726F6748335D073C0B9C5D2A69AE97130865B308ACB4286C77C3F676E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.7z

Path C:\ProgramData\Launcher\Launcher.7z
Size 1.7MB
SHA256 aae3ee9f6082676d2d9035d7b6beba659d7444554d0b96ae00113409ce1b49ad
MD5 a75a4fda04f109dd5da1827f48250811
SHA1 4d78908c312dba68341d707fe4903661952cbe0d
SHA512 554d2201424ee1f9366fced16f96fa4f8c16c7aeda32a925f8d68d7457817a55d7637b0f8393eda845b543ddb40825682ae20e9a390e9b29a3e0c7f43fa56a6b
SSDEEP 49152:PyDBvle0bu+D81GXAS/iHmy+Qzg7ZYSmsDAk8:KNdbbu+agxM/Sm2Ak8
TLSH
T19F8533883123D722878AE24B6F34CB9BEC70FD54977FE3578AD64E748A8D16875100B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\ProgramData\Launcher\Setup.exe
Size 34KB
SHA256 8e347ef52c18a9f479a5d82729de5b4889e1e4ad74b7dab6ac17183882c5b4bf
MD5 1d7c6066058c4b69c5a144c74f839f52
SHA1 f46fd60cc3a1980d685adc53ade5baa3484e615b
SHA512 b830bbe16c175d953ccab63ca38f7b527b358508f436107b488ebf1d41fab7f27bf91d0160baa2519259d71c4bddee9ee5e098ae8307cea951e6c211dff75c3e
SSDEEP 384:IiannYJLOKiXyWkn3BX05x4GGY+hoUGxaQAwZ0oK78hUZZZgYa8IFDAcM8:IpnKO3X4n3BX0v4cFqkhUZZZ3DIr
TLSH
T1EDF2C541AA1C05F1E961DB39192FDF02C765BC3A9990E16762EE3EDA99F1050133BB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extract2.bat

Path C:\ProgramData\Launcher\extract2.bat
Size 84B
SHA256 4d30e07de90e884457243e8e4a20ae5b960890212792581944d1510efcb98e61
MD5 f188dec7ed26b4d829969675090e1e3c
SHA1 308d36faefbb1cffe217345340c93a6647157849
SHA512 826206d55e48e4a0caa1661491e7db106f8032b2a8e96d075d8d2674478da99697554f9f9147a50f45ac1292388ba98971bebefdf9dc9bc478d2bb3b85e36daa
TLSH
T1F9A01222011840DD8BE90458F011054A248B8020401F009331289C08190053CD3B9C0C
MD5 SHA1 SHA512 TLSH

Submit Download

extract3.bat

Path C:\ProgramData\Launcher\extract3.bat
Size 152B
SHA256 0075dee650a31a4e9911743f33e01b79db7e392105725499cda28928ccc6d6b4
MD5 8bedeb85d87b182f0b55a06b20fdb8a4
SHA1 7f581191766e62ad467417ccce7113497c1e30ad
SHA512 66b137cfebe9f75f3a264b96b9ee17727d02a04c88d739edea6a5128f8da4fa350754ff334e3cfb02927dbb3cef841032af5e793b01ec891681edc903abf07d5
TLSH
T1ADC08C15009A0046FDB0AF644228031CD20B827A602E80B63839CA05254EC6CE674D04
MD5 SHA1 SHA512 TLSH

Submit Download

rtl70.bpl

Path C:\ProgramData\Launcher\rtl70.bpl
Size 766KB
SHA256 a2c9f2055886327d03724c2aef95566c9a731f83b568ff88c48ccc0dc74218f0
MD5 123015c8c70d81aff1e6d3b316ddf00e
SHA1 a401df86057c3d8cf11fb1dde177fcb549433145
SHA512 550e8d1ae8f1994765cf2310519b45ec87331ad72b5004f3feb1a0291070044acde37841e3f44195a021256ad16d294665edc9d44604bca2edcd4ef604d4ad5d
SSDEEP 12288:RnJoCnL9vbHcONNBbiaeV/PzUW6SIg3N8Ts0urVyU08v/fHTE/JW+A9IpDNOej3q:RnJzdH9tYG8vHkW+A9ITOej3+Jr2z
TLSH
T185F48C21F24889FBD6B3273D451DBE37C5B97E209620CEDA69F84D49D9605803F283DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl70.bpl

Path C:\ProgramData\Launcher\vcl70.bpl
Size 1.3MB
SHA256 976e20f397d19ba3b5b3347a3299c061ca325b7b915a46baf6e57cce5779a9cf
MD5 563e6aeeb20c98bc1f8917ec3f04a0ac
SHA1 82678ab71e3eacd679a0137d1b46eb3bab87c050
SHA512 bf7ebe2a5746c6347d880eeb9b4c225a7641f206c6f9e6cac6b2da4b95110ff05af652c1c71d5cebafc0e8e09100e861b6b6962941e9bce1b2873510300fca15
SSDEEP 12288:eYURhofl6VUvxusfIuJ25+G1gMBpSFxZTemnMc3YB4gisIKXKjjgOby17fG:oof30jJBpSfZyWIGBsKHgObC
TLSH
T1E7557C51F2280CB6D4A757BC2A7F7F21D965AB106260A78E3AF48C5C5EE2D803F5134B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 ea6c246b059c27248ec70210318ed31793298d59b3a8905f506f532071921dd5
MD5 125a8bc1272e75039d95305bd85cbf39
SHA1 a07b1f95dc7fd6c43870a6121dc9118df09b1915
SHA512 634c3171c536faa7644c40a4ad83c80fbbeeebda1525f284e498fab3ea2035c59a5e0239b1e684a359e243cfc2698e2b7d12a60c3394782e785213ae56465c4f
SSDEEP 384:W1eBaoT1iBGZjW14bwh28U+QKl4UuMZPndIAXr48+tWbWtzKwEvYbhNaPolRtHRV:2exZ6GlWiUUb+Q0yu1IAXrX+FV7bhNaw
TLSH
T1CCA2C578213F6DC7D8C216B011D10AF7FBE4D489DAB61094BF1BDA2F4C90EB64A60624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0isku3on.4bx.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0isku3on.4bx.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1752-41-0x00000000059D0000-0x0000000005A36000-memory.dmp

Download

memory/1752-39-0x0000000005380000-0x00000000059CA000-memory.dmp

Download

memory/1752-46-0x0000000005F50000-0x0000000005F6E000-memory.dmp

Download

memory/1752-47-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Download

memory/1752-52-0x0000000007150000-0x0000000007170000-memory.dmp

Download

memory/1752-42-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Download

memory/1752-53-0x0000000007180000-0x0000000007223000-memory.dmp

Download

memory/1752-49-0x000000006FAB0000-0x000000006FAFC000-memory.dmp

Download

memory/1752-48-0x0000000007110000-0x0000000007146000-memory.dmp

Download

memory/1752-54-0x0000000007900000-0x0000000007F7C000-memory.dmp

Download

memory/1752-55-0x00000000072C0000-0x00000000072DA000-memory.dmp

Download

memory/1752-56-0x0000000007330000-0x000000000733A000-memory.dmp

Download

memory/1752-57-0x0000000007530000-0x00000000075C6000-memory.dmp

Download

memory/1752-38-0x0000000002B90000-0x0000000002BC6000-memory.dmp

Download

memory/1752-45-0x0000000005B50000-0x0000000005EAB000-memory.dmp

Download

memory/1752-40-0x0000000005180000-0x00000000051A2000-memory.dmp

Download

memory/2360-61-0x00000000024E0000-0x00000000025A7000-memory.dmp

Download

memory/2360-62-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/2360-72-0x00000000024E0000-0x00000000025A7000-memory.dmp

Download

memory/2360-71-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/2360-70-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2360-60-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/2360-59-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2360-29-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/2360-28-0x00000000024E0000-0x00000000025A7000-memory.dmp

Download

memory/5384-76-0x0000000006460000-0x00000000067BB000-memory.dmp

Download

memory/5384-78-0x0000000006900000-0x000000000694C000-memory.dmp

Download

memory/5384-79-0x00000000713A0000-0x00000000713EC000-memory.dmp

Download

memory/5384-82-0x0000000007BB0000-0x0000000007C53000-memory.dmp

Download