d594bbf60894b08733f6b8545ce48cd540fa8a49439db0a3ea63a97f94d37c7e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 26.0MB
Sample260527-tymp3aev6v
SHA256 d594bbf60894b08733f6b8545ce48cd540fa8a49439db0a3ea63a97f94d37c7e
MD5 e8164aebdf106d34eb4e684590cdb940
SHA1 55742314fea851fead5bf15739bd890e87efd1e8
SHA512 5e67728732a214fabe066a6e2915444c083cc47978fa73d6c4d231bd501abaeaf737700d19d7b08409e1c670513b00e093e1e05da2a83ed4ff0f22442275bf88
SSDEEP 3072:HC72o0130OyWzl0TuEu/SZqkmM6MsQleHqAnf7NLf8QjPbDCCOpP6wrHRthml8E6:HC72lze7uqZqkmMVtl6qMfZTnCdDA
TLSH
T16A576D1AF7A514F9E9A7953CC8424906DA72BC574760E7CF03A04A973F236D09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x001e00000002b4b4-47.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001e00000002b4b4-47.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001e00000002b4b4-47.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral2/files/0x001e00000002b4b4-47.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x001e00000002b4b4-47.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe
3120	powershell.exe
2468	powershell.exe
4792	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	3456	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2680	netsh.exe
2592	netsh.exe
5724	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
6032	sertja.exe
5352	sertja.exe
5224	sertja.exe
5072	sertja.exe
5300	sertja.exe
5520	sertja.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\sertja.exe"	sertja.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\sertja.exe"	sertja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\ProgramData\\Microsoft\\Windows\\sertja.exe"	sertja.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	7	Go-http-client/1.1
HTTP User-Agent header	8	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5608	schtasks.exe
4080	schtasks.exe
4024	schtasks.exe
4028	schtasks.exe
3608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe
3120	powershell.exe
3120	powershell.exe
6032	sertja.exe
2468	powershell.exe
2468	powershell.exe
4792	powershell.exe
4792	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6032	sertja.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 2876	3456	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	80
PID 3456 wrote to memory of 4440	3456	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	81
PID 3456 wrote to memory of 3120	3456	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	83
PID 3456 wrote to memory of 6032	3456	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	85
PID 6032 wrote to memory of 2468	6032	sertja.exe	87
PID 6032 wrote to memory of 5608	6032	sertja.exe	89
PID 6032 wrote to memory of 4080	6032	sertja.exe	91
PID 6032 wrote to memory of 4024	6032	sertja.exe	93
PID 6032 wrote to memory of 2680	6032	sertja.exe	95
PID 6032 wrote to memory of 4792	6032	sertja.exe	97
PID 6032 wrote to memory of 4028	6032	sertja.exe	103
PID 6032 wrote to memory of 3608	6032	sertja.exe	105
PID 6032 wrote to memory of 2592	6032	sertja.exe	107
PID 6032 wrote to memory of 5724	6032	sertja.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\deagmtgasvi'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Users\Admin\AppData\Local\deagmtgasvi\sertja.exe
  "C:\Users\Admin\AppData\Local\deagmtgasvi\sertja.exe"
  2⤵
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe';$s.WindowStyle=7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClient /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe\" /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5608
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClientBoot /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe\" /sc ONSTART /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClientPerf /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe\" /sc MINUTE /mo 5 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4024
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule "name=RemoteX Client"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WindowsSystemComponent.lnk');$s.TargetPath='C:\ProgramData\Microsoft\Windows\sertja.exe';$s.WindowStyle=7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClientSystem /tr \"C:\ProgramData\Microsoft\Windows\sertja.exe\" /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClientSystemBoot /tr \"C:\ProgramData\Microsoft\Windows\sertja.exe\" /sc ONSTART /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3608
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule "name=RemoteX Client" dir=out action=allow program=C:\Users\Admin\AppData\Local\deagmtgasvi\sertja.exe
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2592
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule "name=RemoteX Client In" dir=in action=allow program=C:\Users\Admin\AppData\Local\deagmtgasvi\sertja.exe
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5724

C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe
1⤵
- Executes dropped EXE
PID:5352

C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe"
1⤵
- Executes dropped EXE
PID:5224

C:\ProgramData\Microsoft\Windows\sertja.exe
C:\ProgramData\Microsoft\Windows\sertja.exe
1⤵
- Executes dropped EXE
PID:5072

C:\ProgramData\Microsoft\Windows\sertja.exe
"C:\ProgramData\Microsoft\Windows\sertja.exe"
1⤵
- Executes dropped EXE
PID:5300

C:\PROGRA~3\MICROS~1\Windows\sertja.exe
C:\PROGRA~3\MICROS~1\Windows\sertja.exe
1⤵
- Executes dropped EXE
PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c82f2726f8ce51fc0d84eb392397b748700470a79032acae4a60c63d1067edcb
MD5 782e4d43fee2487ad2471a9e11efb280
SHA1 17dc94ce4aa72d53aff8024409de3033cfa358f5
SHA512 d16f50a54a1a7c3c1babdc7b90e1b203cf74a18a8f922dcd12d337b31a8ec54a769f7749841116d43dab39bf93cf14acdc5da4a27a0e6127b803bf95f1712541
TLSH
T12421AB33B79CC135C8D9117A108CAD01B1B5C3C7449ECECB7B84C518A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c9b56837ca861acafe77991fba23ab5ddf3da4f92e07e707aabfb5f0e65aa709
MD5 5cea8066fa4213e74bbf8db55817f9af
SHA1 58d772752e98ee187ac8475eba9fd1172404b13a
SHA512 fed7a23446306ca014bcb30f0e1a1cd62c50694a6204704d724bbb08f8ea6f35436615645cac4744a088c7c8bf14a41ddc2f95cdcd79acdbeaf94af29669e8e4
TLSH
T16D218633B79CC134C8C911BA108DAD01B2B5C3C7449ECE8B7BC4C528A5BF89ADF681A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 422e18074b81f7ca32184c40ba843a0fea307ee65e51174231b5e379321d20b5
MD5 1de8b38009e35c287575b36b868d2057
SHA1 f5f50ae42faaffa7d0f5e5a46bd5d89cabc4107e
SHA512 ea4bbb3e43410125990c6fb8e48e7bb21cf4b66b03445bcd4c260cff4bb2a2678c0a24429b840495e22f13f3c1246667952275ce767daa2014cc4bdd8510c838
TLSH
T1F1117A33B79CC135C8D9117A1089AD01B2B4C3D7049EDE8B7AC4C519E5BF58ADFA41E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pysc4mjb.ulk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pysc4mjb.ulk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sertja.exe

Path C:\Users\Admin\AppData\Local\deagmtgasvi\sertja.exe
Size 19.6MB
SHA256 4d6b7e54dbe5dd99761ea72e7dd9bfbac319f93853c021a96ffb3de0c08bb9cf
MD5 6247a55b51a19efbb254b3b2206bb4be
SHA1 022abe713e17cadb4ea398e73050223054d0fa19
SHA512 9642d478ca4348d407f53e2c35e6dcca218ba23b8fb76d9cac1874a55901a8658804312b83dfb170cda40d01203979da3cb7de04a0937770cecd833545fc2d56
SSDEEP 393216:1Tph6pH92xPZZSjZ/DSNEdXMw1s5bR+8e:1Tph6pH9iqZ7RXDs5bR+/
TLSH
T1A7279D47ECA545E4C0AA9135CA669267BB717C884F3163C72F90F7282F32BD0AE79750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4440-16-0x000001D879640000-0x000001D87965C000-memory.dmp

Download

memory/4440-24-0x000001D879780000-0x000001D87978A000-memory.dmp

Download

memory/4440-19-0x000001D879750000-0x000001D87976C000-memory.dmp

Download

memory/4440-20-0x000001D879730000-0x000001D87973A000-memory.dmp

Download

memory/4440-21-0x000001D879790000-0x000001D8797AA000-memory.dmp

Download

memory/4440-22-0x000001D879740000-0x000001D879748000-memory.dmp

Download

memory/4440-23-0x000001D879770000-0x000001D879776000-memory.dmp

Download

memory/4440-18-0x000001D879720000-0x000001D87972A000-memory.dmp

Download

memory/4440-25-0x000001D8773F0000-0x000001D877400000-memory.dmp

Download

memory/4440-17-0x000001D879660000-0x000001D879713000-memory.dmp

Download

memory/4440-0-0x000001D8773F0000-0x000001D877400000-memory.dmp

Download

memory/4440-15-0x00007FF41D9C0000-0x00007FF41D9D0000-memory.dmp

Download

memory/4440-8-0x000001D8773F0000-0x000001D877400000-memory.dmp

Download

memory/4440-6-0x000001D8795A0000-0x000001D8795C2000-memory.dmp

Download