bc6818240b6af1141afadc512960f0dc5b3d4122741c717b6dad1fe73efd8f52

Analysis

user interaction
yes
max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coldperm cracked/coldperm cracked.exe
Size 6.7MB
Sample261014-bs8q8sea62
SHA256 bc6818240b6af1141afadc512960f0dc5b3d4122741c717b6dad1fe73efd8f52
MD5 ffdc7159548e1dfd1a4bf0ff043c2618
SHA1 a60df92c4ce7513e2454da6aac7455963fa89863
SHA512 ec6f032cf52b5febc02752dc42c1f6e71f6c977f3f5ac58f7036e2e583c43190d729a7c6a32fc8e37dca5384016acc45855e003849abbb95db72fb0505822091
SSDEEP 49152:MevGNemJWJN4x9khvbqy+EyaCBuuPbS6apBkHo//yTJYE33O9ZWpgYApt/U29u1K:M
TLSH
T15F6602318A842FF9CEA85A3890FE161D5FE05A8B5025B54EEF637D07BFEB904450B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4708	powershell.exe
1280	powershell.exe
1164	powershell.exe
2704	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3492	sys_1448.exe
3832	p3492.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 3 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
4508	powershell.exe
4748	powershell.exe
4148	WMIC.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5640	cmd.exe
1424	cmd.exe
5976	cmd.exe
4588	cmd.exe
6072	cmd.exe
4568	cmd.exe
1860	cmd.exe
4964	cmd.exe
4912	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	p3492.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	p3492.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4708	powershell.exe
4708	powershell.exe
4148	WMIC.exe
4148	WMIC.exe
4148	WMIC.exe
4148	WMIC.exe
4508	powershell.exe
4508	powershell.exe
4508	powershell.exe
4748	powershell.exe
4748	powershell.exe
1164	powershell.exe
1164	powershell.exe
1164	powershell.exe
2704	powershell.exe
2704	powershell.exe
2704	powershell.exe
1280	powershell.exe
1280	powershell.exe
1280	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3832	p3492.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeIncreaseQuotaPrivilege	4148	WMIC.exe
Token: SeSecurityPrivilege	4148	WMIC.exe
Token: SeTakeOwnershipPrivilege	4148	WMIC.exe
Token: SeLoadDriverPrivilege	4148	WMIC.exe
Token: SeSystemProfilePrivilege	4148	WMIC.exe
Token: SeSystemtimePrivilege	4148	WMIC.exe
Token: SeProfSingleProcessPrivilege	4148	WMIC.exe
Token: SeIncBasePriorityPrivilege	4148	WMIC.exe
Token: SeCreatePagefilePrivilege	4148	WMIC.exe
Token: SeBackupPrivilege	4148	WMIC.exe
Token: SeRestorePrivilege	4148	WMIC.exe
Token: SeShutdownPrivilege	4148	WMIC.exe
Token: SeDebugPrivilege	4148	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4148	WMIC.exe
Token: SeRemoteShutdownPrivilege	4148	WMIC.exe
Token: SeUndockPrivilege	4148	WMIC.exe
Token: SeManageVolumePrivilege	4148	WMIC.exe
Token: 33	4148	WMIC.exe
Token: 34	4148	WMIC.exe
Token: 35	4148	WMIC.exe
Token: 36	4148	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4148	WMIC.exe
Token: SeSecurityPrivilege	4148	WMIC.exe
Token: SeTakeOwnershipPrivilege	4148	WMIC.exe
Token: SeLoadDriverPrivilege	4148	WMIC.exe
Token: SeSystemProfilePrivilege	4148	WMIC.exe
Token: SeSystemtimePrivilege	4148	WMIC.exe
Token: SeProfSingleProcessPrivilege	4148	WMIC.exe
Token: SeIncBasePriorityPrivilege	4148	WMIC.exe
Token: SeCreatePagefilePrivilege	4148	WMIC.exe
Token: SeBackupPrivilege	4148	WMIC.exe
Token: SeRestorePrivilege	4148	WMIC.exe
Token: SeShutdownPrivilege	4148	WMIC.exe
Token: SeDebugPrivilege	4148	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4148	WMIC.exe
Token: SeRemoteShutdownPrivilege	4148	WMIC.exe
Token: SeUndockPrivilege	4148	WMIC.exe
Token: SeManageVolumePrivilege	4148	WMIC.exe
Token: 33	4148	WMIC.exe
Token: 34	4148	WMIC.exe
Token: 35	4148	WMIC.exe
Token: 36	4148	WMIC.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeIncreaseQuotaPrivilege	4508	powershell.exe
Token: SeSecurityPrivilege	4508	powershell.exe
Token: SeTakeOwnershipPrivilege	4508	powershell.exe
Token: SeLoadDriverPrivilege	4508	powershell.exe
Token: SeSystemProfilePrivilege	4508	powershell.exe
Token: SeSystemtimePrivilege	4508	powershell.exe
Token: SeProfSingleProcessPrivilege	4508	powershell.exe
Token: SeIncBasePriorityPrivilege	4508	powershell.exe
Token: SeCreatePagefilePrivilege	4508	powershell.exe
Token: SeBackupPrivilege	4508	powershell.exe
Token: SeRestorePrivilege	4508	powershell.exe
Token: SeShutdownPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeSystemEnvironmentPrivilege	4508	powershell.exe
Token: SeRemoteShutdownPrivilege	4508	powershell.exe
Token: SeUndockPrivilege	4508	powershell.exe
Token: SeManageVolumePrivilege	4508	powershell.exe
Token: 33	4508	powershell.exe
Token: 34	4508	powershell.exe
Token: 35	4508	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3832	p3492.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 5976	1448	coldperm cracked.exe	90
PID 5976 wrote to memory of 3492	5976	cmd.exe	91
PID 1448 wrote to memory of 4588	1448	coldperm cracked.exe	92
PID 4588 wrote to memory of 4708	4588	cmd.exe	93
PID 3492 wrote to memory of 6072	3492	sys_1448.exe	94
PID 4708 wrote to memory of 4568	4708	powershell.exe	96
PID 4568 wrote to memory of 4148	4568	cmd.exe	97
PID 4568 wrote to memory of 1716	4568	cmd.exe	98
PID 6072 wrote to memory of 3832	6072	cmd.exe	99
PID 3832 wrote to memory of 5640	3832	p3492.exe	101
PID 5640 wrote to memory of 4508	5640	cmd.exe	103
PID 3832 wrote to memory of 1860	3832	p3492.exe	104
PID 1860 wrote to memory of 4748	1860	cmd.exe	106
PID 3832 wrote to memory of 4964	3832	p3492.exe	107
PID 4964 wrote to memory of 1164	4964	cmd.exe	109
PID 3832 wrote to memory of 1424	3832	p3492.exe	110
PID 1424 wrote to memory of 2704	1424	cmd.exe	112
PID 3832 wrote to memory of 4912	3832	p3492.exe	113
PID 4912 wrote to memory of 1280	4912	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\coldperm cracked\coldperm cracked.exe
"C:\Users\Admin\AppData\Local\Temp\coldperm cracked\coldperm cracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /B C:\Users\Admin\AppData\Local\Temp\\sys_1448.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Users\Admin\AppData\Local\Temp\sys_1448.exe
    C:\Users\Admin\AppData\Local\Temp\\sys_1448.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /B C:\Users\Admin\AppData\Local\Temp\p3492.exe
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\p3492.exe
        
        C:\Users\Admin\AppData\Local\Temp\p3492.exe
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3832
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
        7⤵
        Uses WMI to collect hardware manufacturer information
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4508
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
        7⤵
        Uses WMI to collect hardware manufacturer information
        Suspicious behavior: EnumeratesProcesses
        
        PID:4748
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1164
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2704
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "& { cmd /c \"C:\Users\Admin\AppData\Local\Temp\\setup_1448.bat\" }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "& { cmd /c \"C:\Users\Admin\AppData\Local\Temp\\setup_1448.bat\" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\\setup_1448.bat
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get manufacturer,model
        5⤵
        Uses WMI to collect hardware manufacturer information
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4148
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "vmware virtualbox qemu xen parallels dady virtual vbox innotek"
        5⤵
        
        PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ccc29b2db90160f9dbd0e3782dd28e6f3f08d5db6c856e7e36b0081dd4727653
MD5 7fd7874d0ab7298c5dd772674179d241
SHA1 8de9dacd369d535758dd40a2ae2037c649c1523a
SHA512 01fb36056b6a36ffc02cbc6048688523211153fc380ba9142710a561e837285d2ba05b4656884c744546c51dc01a1d6681edcaf122746de59687da30186dfc4f
TLSH
T1DB217633B3DC8614C899003A10DDAC1036B687CB40DECF9B6B85E159A42F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bc159a43138fcc0da95637bcafaadf2cd9218008d67f591a8e9ada55596c5170
MD5 794937e97f303a8a01fb88586a9b7a6e
SHA1 b75b26b3763bfd9b4dc603d87e39d76b7b216163
SHA512 b79a904fdfdac476711d4c347cb41c0728a71fc5b43544885862c0d01c7245eb742bb6495cae60fac086fb1ef67fab011f41cfdffa01f1edf87649378cbc2cf8
TLSH
T111217637B3DC8224C8AA003A10DDAD0036B687DB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f2998c315850175fbc0b2d4ad6072dcf2e9fff67ca49416448eb90f48d4ec9dc
MD5 19e3feb9b0bc5ddca7afb8933fd0fd37
SHA1 0f95f1a0c1ee6daea2d1791203a8f015fda0385f
SHA512 11f8c8d228203318eacee0424d11d08b9c7f76c75b2a9ffad671876efa219dfb415a3d3675ce3b5867b3502b989b6ff8963be81ede210b0a06c4b22cb6b27514
TLSH
T14A219837F3DC8214CCA9003A10DDAD0036B6C7CB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c11ba17dffd1ec3a5a6a5007ff7d65ce3e4b45a168312f3ee8fd0ba259e721c1
MD5 a260df5887ad9dd47cacaff566fe9f3e
SHA1 465bc8987b1dfa7bde36052af2e143a5b7558c8d
SHA512 4a375038e82e9beff9898f7c02d384ea50df84708c39f26d955cc2e1bb8e0fe09106e22919423d20c70e79fb4ee9ac7fb51754537a40d691c8d48adea77fcd30
TLSH
T13C217633B3DC8624C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ifigym1q.jpx.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ifigym1q.jpx.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

p3492.exe

Path C:\Users\Admin\AppData\Local\Temp\p3492.exe
Size 3.4MB
SHA256 bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0
MD5 a8f950d90dafd955bd35df41a610367b
SHA1 38095bc25010440a99b7cd1ec68a062cef64f01f
SHA512 723175a95486c7512d2801ae999e2f2d54808be47be6ff02789c3786a79be90f8af145ea81ff32c1e669f2e7e4d36d288aad1c575a374fa7e62e9a097d7ba5d8
SSDEEP 49152:DhyMqPgRBl6IB/0KLkvEfZu4uCqsu7J4bVp4cjACdiQL2KhdpXJM34/7XpyYN:wY5CEfZu4uCqsu7J4REEzZM3QpyY
TLSH
T1CEF5DF2AF7A441E9C47B913CC8A6A707F3B178581731D7DB22E859581F63BE05A3E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_1448.bat

Path C:\Users\Admin\AppData\Local\Temp\setup_1448.bat
Size 191KB
SHA256 0b98da719c3c3842a76f10aeb12762fdccb056cff363660483a3f67dfe8717ce
MD5 168014f67f93b750ff9884946e0e81ec
SHA1 5016d5f5c6d424409f2e23e9ab0059be7a3d7be8
SHA512 50ed492798ef07bbd133661711a4f4566bff2720497f0e4022372f11fe4b90df8809c89abacce920f3cbb116ce4a166320cb6563161126f8db7a8a3bebc6870b
SSDEEP 3072:L6bwq0WCt88ZqkR+eUk0D4bf8XzLkONPEXWRypIvcP/+hD8TNCOg7KTQ7clMba/B:L6ELbZqkUzkNYPPyP/UD6Nrg7KTQ4lMy
TLSH
T13F1402836EB058ED3374814DC9FEAE6D8730293400DF9CF5DA65778520F7A5E0A219BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_1448.exe

Path C:\Users\Admin\AppData\Local\Temp\sys_1448.exe
Size 4.8MB
SHA256 03cc1632309b6e1f06fea7d900bb4b3cc0e17fd77330b89043b138ca8f6be986
MD5 8cb5db0bd23dc014380d0dea5dba24b2
SHA1 913181680f45cade364910010b6ce88ea46ce86f
SHA512 acbfad9417a55d656b1ea5ec378c45e99fb773ae61018968818465db46bd6e68c295c65e7d13eb56ed59cb909c7680bd62fa2829954eb3b1c694474d37ac31e3
SSDEEP 49152:nIWg9KdvDrFvA7R1AuUj6FFvnSk1H1y3KO0clAACHYkeRWkxysvbXOO7YNZMopaH:n
TLSH
T17C363321EF661CFEC549D13845BF9F602F603D998438F6AE37D0BD836E25FA0841A619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1448-29-0x00007FF6FD940000-0x00007FF6FE005000-memory.dmp

Download

memory/3492-26-0x00007FF6FE940000-0x00007FF6FEE0B000-memory.dmp

Download

memory/4508-35-0x0000016979A40000-0x0000016979A6A000-memory.dmp

Download

memory/4508-32-0x00000169799F0000-0x0000016979A0E000-memory.dmp

Download

memory/4508-33-0x0000016979C80000-0x0000016979D32000-memory.dmp

Download

memory/4508-34-0x0000016979970000-0x000001697997A000-memory.dmp

Download

memory/4508-36-0x0000016979A40000-0x0000016979A64000-memory.dmp

Download

memory/4708-12-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-23-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-18-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-28-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-17-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-16-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-15-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-14-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-11-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-7-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-10-0x000001B444CE0000-0x000001B444D02000-memory.dmp

Download

memory/4708-6-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-5-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4708-4-0x00007FFB4844F000-0x00007FFB48450000-memory.dmp

Download