2c1088154983f1800c8a1753ea7dc00ea74783f26b5de45c60f97314bb7d7903

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coldperm cracked.exe
Size 6.7MB
Sample261011-mkk6ragc57
SHA256 2c1088154983f1800c8a1753ea7dc00ea74783f26b5de45c60f97314bb7d7903
MD5 4302bc800b35614321b40e2a6fd39569
SHA1 ac58ca0aca5fb2429847d751d3299d7af4df70b9
SHA512 6219005a124e4fda7fcfd599e283bcad32a1f05d4a5056d476624481643cd8ef5e9b069c462173df7ae867ca4600351cbc30a091ac46f901af1716c004632d90
SSDEEP 49152:7k4RUvvl49icFITl3gxzqeNJY6PBdXC9RT5O3YcVUOFHp++tszuZffZZ1KsVISaq:7
TLSH
T11E66023186C46FB9CFAC493890FE161D5FA05A8B402A758EEB637D4ABFFB504050B1D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4120	powershell.exe
1264	powershell.exe
5216	powershell.exe
928	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3872	sys_4932.exe
4152	p3872.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 3 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
5884	powershell.exe
1876	powershell.exe
2372	WMIC.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1248	cmd.exe
4772	cmd.exe
1520	cmd.exe
5964	cmd.exe
2216	cmd.exe
5028	cmd.exe
5784	cmd.exe
3240	cmd.exe
4436	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	p3872.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	p3872.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4120	powershell.exe
4120	powershell.exe
4120	powershell.exe
5884	powershell.exe
5884	powershell.exe
5884	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
2372	WMIC.exe
2372	WMIC.exe
2372	WMIC.exe
2372	WMIC.exe
1264	powershell.exe
1264	powershell.exe
1264	powershell.exe
5216	powershell.exe
5216	powershell.exe
5216	powershell.exe
928	powershell.exe
928	powershell.exe
928	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4152	p3872.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	5884	powershell.exe
Token: SeIncreaseQuotaPrivilege	5884	powershell.exe
Token: SeSecurityPrivilege	5884	powershell.exe
Token: SeTakeOwnershipPrivilege	5884	powershell.exe
Token: SeLoadDriverPrivilege	5884	powershell.exe
Token: SeSystemProfilePrivilege	5884	powershell.exe
Token: SeSystemtimePrivilege	5884	powershell.exe
Token: SeProfSingleProcessPrivilege	5884	powershell.exe
Token: SeIncBasePriorityPrivilege	5884	powershell.exe
Token: SeCreatePagefilePrivilege	5884	powershell.exe
Token: SeBackupPrivilege	5884	powershell.exe
Token: SeRestorePrivilege	5884	powershell.exe
Token: SeShutdownPrivilege	5884	powershell.exe
Token: SeDebugPrivilege	5884	powershell.exe
Token: SeSystemEnvironmentPrivilege	5884	powershell.exe
Token: SeRemoteShutdownPrivilege	5884	powershell.exe
Token: SeUndockPrivilege	5884	powershell.exe
Token: SeManageVolumePrivilege	5884	powershell.exe
Token: 33	5884	powershell.exe
Token: 34	5884	powershell.exe
Token: 35	5884	powershell.exe
Token: 36	5884	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	WMIC.exe
Token: SeSecurityPrivilege	2372	WMIC.exe
Token: SeTakeOwnershipPrivilege	2372	WMIC.exe
Token: SeLoadDriverPrivilege	2372	WMIC.exe
Token: SeSystemProfilePrivilege	2372	WMIC.exe
Token: SeSystemtimePrivilege	2372	WMIC.exe
Token: SeProfSingleProcessPrivilege	2372	WMIC.exe
Token: SeIncBasePriorityPrivilege	2372	WMIC.exe
Token: SeCreatePagefilePrivilege	2372	WMIC.exe
Token: SeBackupPrivilege	2372	WMIC.exe
Token: SeRestorePrivilege	2372	WMIC.exe
Token: SeShutdownPrivilege	2372	WMIC.exe
Token: SeDebugPrivilege	2372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2372	WMIC.exe
Token: SeRemoteShutdownPrivilege	2372	WMIC.exe
Token: SeUndockPrivilege	2372	WMIC.exe
Token: SeManageVolumePrivilege	2372	WMIC.exe
Token: 33	2372	WMIC.exe
Token: 34	2372	WMIC.exe
Token: 35	2372	WMIC.exe
Token: 36	2372	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2372	WMIC.exe
Token: SeSecurityPrivilege	2372	WMIC.exe
Token: SeTakeOwnershipPrivilege	2372	WMIC.exe
Token: SeLoadDriverPrivilege	2372	WMIC.exe
Token: SeSystemProfilePrivilege	2372	WMIC.exe
Token: SeSystemtimePrivilege	2372	WMIC.exe
Token: SeProfSingleProcessPrivilege	2372	WMIC.exe
Token: SeIncBasePriorityPrivilege	2372	WMIC.exe
Token: SeCreatePagefilePrivilege	2372	WMIC.exe
Token: SeBackupPrivilege	2372	WMIC.exe
Token: SeRestorePrivilege	2372	WMIC.exe
Token: SeShutdownPrivilege	2372	WMIC.exe
Token: SeDebugPrivilege	2372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2372	WMIC.exe
Token: SeRemoteShutdownPrivilege	2372	WMIC.exe
Token: SeUndockPrivilege	2372	WMIC.exe
Token: SeManageVolumePrivilege	2372	WMIC.exe
Token: 33	2372	WMIC.exe
Token: 34	2372	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4152	p3872.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4436	4932	coldperm cracked.exe	91
PID 4436 wrote to memory of 3872	4436	cmd.exe	92
PID 4932 wrote to memory of 1248	4932	coldperm cracked.exe	93
PID 1248 wrote to memory of 4120	1248	cmd.exe	94
PID 3872 wrote to memory of 4772	3872	sys_4932.exe	95
PID 4120 wrote to memory of 1520	4120	powershell.exe	97
PID 4772 wrote to memory of 4152	4772	cmd.exe	98
PID 4152 wrote to memory of 5964	4152	p3872.exe	99
PID 5964 wrote to memory of 5884	5964	cmd.exe	101
PID 4152 wrote to memory of 2216	4152	p3872.exe	102
PID 2216 wrote to memory of 1876	2216	cmd.exe	104
PID 1520 wrote to memory of 2372	1520	cmd.exe	105
PID 1520 wrote to memory of 4936	1520	cmd.exe	106
PID 4152 wrote to memory of 5028	4152	p3872.exe	107
PID 5028 wrote to memory of 1264	5028	cmd.exe	109
PID 4152 wrote to memory of 5784	4152	p3872.exe	110
PID 5784 wrote to memory of 5216	5784	cmd.exe	112
PID 4152 wrote to memory of 3240	4152	p3872.exe	113
PID 3240 wrote to memory of 928	3240	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe
"C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /B C:\Users\Admin\AppData\Local\Temp\\sys_4932.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Users\Admin\AppData\Local\Temp\sys_4932.exe
    C:\Users\Admin\AppData\Local\Temp\\sys_4932.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /B C:\Users\Admin\AppData\Local\Temp\p3872.exe
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\p3872.exe
        
        C:\Users\Admin\AppData\Local\Temp\p3872.exe
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4152
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
        7⤵
        Uses WMI to collect hardware manufacturer information
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5884
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
        7⤵
        Uses WMI to collect hardware manufacturer information
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1264
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5216
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& { cmd /c \"C:\Users\Admin\AppData\Local\Temp\\setup_4932.bat\" }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "& { cmd /c \"C:\Users\Admin\AppData\Local\Temp\\setup_4932.bat\" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\\setup_4932.bat
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1520
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get manufacturer,model
        5⤵
        Uses WMI to collect hardware manufacturer information
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "vmware virtualbox qemu xen parallels dady virtual vbox innotek"
        5⤵
        
        PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 67fd01eb4d7cc1099a767d02b1073aec0703b5586058f86cc08062858c27870c
MD5 d2bf7d2c5863b4ffa522907830c4de40
SHA1 de72eadd4a8cdb3b457f854e2cb41ed841929e08
SHA512 1d869e35409c613f427487d3ef7d56f0664895d5b37f70575dff2396a3d017755509035da13da2cce439b22c370af67bf95bc2e100661f90c991e609ff6cd3c5
TLSH
T1A0219833F3DC8624CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5f28ca7c73980972a3a12969bedf94ef7096391647bfc5a1e18201738d070e07
MD5 199c65a27a9a1fefe163e7b24724fc83
SHA1 f89368003cecf4aa4f2445142f538e215f027395
SHA512 0bfa4d2407222cb587dae9fca3fe9e5a1e36036a19a0991d4dcdc27bd1604f5a8be298e7a955e94f096cc3fb1a4c523a3b03ca90cb5be4c5d04684a8681aff94
TLSH
T1F0219833F3DC8224CC99013A10DDAC1036B6C7DB40DECF9B6B81E159A82F299DF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5e5e556cc47f91e2a2fc67574b3305ca32595b8229aad2e48eb9bf387c3b59e5
MD5 5a89a6c8441cf1bbf9870706f8ccf517
SHA1 b6d264de0f1e51faffd3e2c82dfd4303e833c48d
SHA512 2d4f09f8127b8f88077feb7bbe151e3abd2f180630aa3b83aad2625248f4e7c50e4fdc793d10ab57fe8740c6b1edee9593877c780e0ab0c1d3110e0e32a3191c
TLSH
T16E217633B3DC8224C899013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eqsxo52w.4xa.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqsxo52w.4xa.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

p3872.exe

Path C:\Users\Admin\AppData\Local\Temp\p3872.exe
Size 3.4MB
SHA256 bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0
MD5 a8f950d90dafd955bd35df41a610367b
SHA1 38095bc25010440a99b7cd1ec68a062cef64f01f
SHA512 723175a95486c7512d2801ae999e2f2d54808be47be6ff02789c3786a79be90f8af145ea81ff32c1e669f2e7e4d36d288aad1c575a374fa7e62e9a097d7ba5d8
SSDEEP 49152:DhyMqPgRBl6IB/0KLkvEfZu4uCqsu7J4bVp4cjACdiQL2KhdpXJM34/7XpyYN:wY5CEfZu4uCqsu7J4REEzZM3QpyY
TLSH
T1CEF5DF2AF7A441E9C47B913CC8A6A707F3B178581731D7DB22E859581F63BE05A3E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_4932.bat

Path C:\Users\Admin\AppData\Local\Temp\setup_4932.bat
Size 195KB
SHA256 2759cb0f357ec5c0999a15ba9b76cea43e14196892599ef970850e48b894499e
MD5 bb22826f62ec08a1032e8dce2086b10e
SHA1 547b15584273cc6a36620eae5de2300ae52e9dc4
SHA512 2d005958d65bcdb9b517973ce35faf99155fecf1780dee1313522f7a35bab235cdf59474e5a2182c52928247e2eb7d13a69c80d0b1a7bebb68fb6e023e34f6b0
SSDEEP 3072:f3h94QgHftkkv7kiZD4vbGdPyvM2KZB8NuL8BFIyTDA+pIMUO6WAHp6f+gj145pd:/2Jd4vbhwZB8NuIBaMA+pd/6HJjD5r
TLSH
T13B14F1074EE2A50C776C014B82772F1F469879B0052F38E96E5365DEE9E3B1DB900ABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_4932.exe

Path C:\Users\Admin\AppData\Local\Temp\sys_4932.exe
Size 4.8MB
SHA256 5b735047c7b4cf082d165ac3815a9c58fe88906410114ef67c9c95fafeb252d7
MD5 649658b613e4b924cc056805337d7142
SHA1 076c5804b13e5fa4fc924d34b9a987dba2b57217
SHA512 28c5d3eeb12b1fc0d132594e31d4b886a85ea775a0b0ec3777b94fb5989c2455d2e8b294a888e0cc4611a8d54b08ea42f4ca14071bc25df67e8dd519b570dacf
SSDEEP 49152:3kEckuYoPiHwOeTRotSLZDCUB8ObbzpuIHzWzTLQMO9ruVpNg6fUR:3
TLSH
T1CC363303EF21A8FBC55CD134157FAB256BB078A8D09DB6AE17C4E6833D2CF80452E959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3872-17-0x00007FF7DEE40000-0x00007FF7DF30B000-memory.dmp

Download

memory/4120-20-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp

Download

memory/4120-10-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp

Download

memory/4120-16-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp

Download

memory/4120-12-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp

Download

memory/4120-11-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp

Download

memory/4120-4-0x00007FFF6634F000-0x00007FFF66350000-memory.dmp

Download

memory/4120-8-0x00000283DF0C0000-0x00000283DF0E2000-memory.dmp

Download

memory/4120-9-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp

Download

memory/4120-35-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp

Download

memory/4120-18-0x00007FFF661C0000-0x00007FFF66B64000-memory.dmp

Download

memory/4932-38-0x00007FF658FB0000-0x00007FF659676000-memory.dmp

Download

memory/5884-29-0x00000209E6F30000-0x00000209E6F54000-memory.dmp

Download

memory/5884-28-0x00000209E6F30000-0x00000209E6F5A000-memory.dmp

Download

memory/5884-27-0x00000209CE980000-0x00000209CE98A000-memory.dmp

Download

memory/5884-25-0x00000209CE990000-0x00000209CE9AE000-memory.dmp

Download

memory/5884-26-0x00000209E6AD0000-0x00000209E6B82000-memory.dmp

Download