Overview

overview

8

Static

static

3

2026-07-04...r_.exe

windows10-2004-x64

8

2026-07-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    36s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 16:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_ecf2b4a532137f494504171aae08a32b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 17.7MB
  • Sample260704-ve2wbaas2s
  • SHA256 0d31d8456022d15660c5cac01903dc6ebbe6f6014ea1e9d24c58760329b09e44
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_ecf2b4a532137f494504171aae08a32b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_ecf2b4a532137f494504171aae08a32b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1192
  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_ecf2b4a532137f494504171aae08a32b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-04_ecf2b4a532137f494504171aae08a32b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2496
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3364
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5580
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
      PID:2152

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          7zG.exe
          • Path C:\Program Files\7-Zip\7zG.exe
          • Size 18.3MB
          • SHA256 7c4ee128065bf31af10e938a813d1384d8b6f1b0f337e65941b432ee900a19ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 17.7MB
          • SHA256 0d31d8456022d15660c5cac01903dc6ebbe6f6014ea1e9d24c58760329b09e44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InspectorOfficeGadget.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
          • Size 17.7MB
          • SHA256 0c4ad8435e03863264e526461202920da7fa8594aef93c8e55fd1f7c1ba9ef0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IntegratedOffice.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
          • Size 39.4MB
          • SHA256 82869fdf0fa5e608c34a9d6f3e54bc07a992adbbad22d905c4f08c1a863238d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MavInject32.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
          • Size 35.7MB
          • SHA256 69f6449ea7a4c6c1f2120a1c6f3be574644a050cf0ee65c4a85d805c4febc4b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OfficeC2RClient.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
          • Size 41.1MB
          • SHA256 a365934e31c8a717631d9bf4c3eedd03f23c9c2006d60dc27e5e65e93a16bac7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appvcleaner.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
          • Size 19.8MB
          • SHA256 2721e46bf60d29ccaa4a202468737ebe1457030bb2b5d270349d405eb8112ee4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSTOInstaller.exe
          • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
          • Size 35.4MB
          • SHA256 fca5e9eeabcbbc0095cc7db8377cdf2daa5d34acd618cd79a5242ddd7d07f5ab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrmstp.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
          • Size 41.4MB
          • SHA256 77172e6787514e78ea916c8f619cf17674519972005c69256458e76128384737
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevated_tracing_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
          • Size 38.8MB
          • SHA256 3bc2349b4c878fae5636bf04934185d73c99b5d027a0d7e6577f0b324559f0a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 37.6MB
          • SHA256 d433a1cf4828bac3e8ba083e503b34b7f16310d31c41c7d50c3cb274402fd913
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_helper.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
          • Size 37.0MB
          • SHA256 aaa3afb3e23663caabdb6aab753fbfc2ccca10f056e716e3983da2440caf97a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          os_update_handler.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
          • Size 37.2MB
          • SHA256 660611f2cf1bef20c76dbd05bf5739e978b6dc333e285021341e263a899b2d90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome.exe
          • Size 38.4MB
          • SHA256 2c55b703e6b74d340a351675158e16da5866f48ed457bce66aa0bea1945e63be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_proxy.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
          • Size 36.8MB
          • SHA256 dd306d97d409ff3292cf4da7977dd2e620c715c78a3472d0e8c19bd73628d356
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appletviewer.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
          • Size 35.4MB
          • SHA256 b7437f13fb68a0649373b76b325d5b35d106bbce2bccef008f56d9d3a402ff2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          extcheck.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
          • Size 35.4MB
          • SHA256 5821f2407f4963f178bafa5d758f0909ef86dbf3370365f547dc81d9c02124d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          idlj.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
          • Size 35.4MB
          • SHA256 22a633270aad22d190d081f9d59e71aaac06fad79a222641e8eb8e386412a18d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jabswitch.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
          • Size 512KB
          • SHA256 54a9cdeaa70d56716fea0c2b033f8174b1495f38e428abc781f5cd97cc816efb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jar.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
          • Size 35.4MB
          • SHA256 dfe2bfb8b9793f8131f38360f2be78caaeaa48df49343f091d3f7b48dd269e34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jarsigner.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
          • Size 35.4MB
          • SHA256 64d9c6223800d19030299b22bc07d72bec8aff2506cc9040b3977eede097a4a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
          • Size 35.6MB
          • SHA256 d891a07aa979618082023a59a38e1fb64326e72361829a3e446f55a4dcb3e9b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javac.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
          • Size 35.4MB
          • SHA256 5946e45e4909b304bb678714f08b8121c3775f37d74d47aa9dd1913360dde72b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javadoc.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
          • Size 35.4MB
          • SHA256 3337d039509e9379382008c7a12c95b871bf8fc170c69700d2889829cbb1ddce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javah.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
          • Size 35.4MB
          • SHA256 39665405888c056449c03561bed21434513975cfa2c034097025493d8e66ce8e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javap.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
          • Size 35.4MB
          • SHA256 4210a47e5116571e34e1ea5bfa6554f46bde66066e219b4243bbfda784382dad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javapackager.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
          • Size 35.5MB
          • SHA256 0ec02657967bfa71d1d8ac5e8d338c50d92ad3544def93f7866afc6d6493a5e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaw.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
          • Size 35.6MB
          • SHA256 7f3f67a9da115ccaff3981ff26e48154755539ff2836c3cb9d8389566bcabdfc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaws.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
          • Size 192KB
          • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jcmd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
          • Size 35.4MB
          • SHA256 6526e661bb46729deb896ff08198a3b1ce8c151de999678ae6b72ba8ff5c41fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jconsole.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
          • Size 35.4MB
          • SHA256 e99ea3049e06863db34fa1c21bed604503654eee1d513b81610c040773c8cb05
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jdb.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
          • Size 35.4MB
          • SHA256 1083a2527c952d16ee296e04c44fa79260ca479d8d699f3f4e073afddc3f39a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jdeps.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
          • Size 35.4MB
          • SHA256 498ab15bd4da280ba1bcb7ecb20272ec98527ba8a993a7f442943c6436006e18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jhat.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
          • Size 35.4MB
          • SHA256 32bd552f25c1507425592cc34f9bfba920ad46d0167f834320435b4f7ebdff66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jinfo.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
          • Size 35.4MB
          • SHA256 104f840f2a4fc3b1681e4027a07340b652e578a61d466381896514bd5d1d6a9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jjs.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
          • Size 35.4MB
          • SHA256 22adc00ee430b36abf9dec6d613c549d005cad912210f4d1844566d45ee2206c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jmap.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
          • Size 35.4MB
          • SHA256 784ea911f542c1df5456425b035972872ae5c0de6d176a7aeb200df358780669
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jps.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
          • Size 35.4MB
          • SHA256 c4fc9aad973909abe4b16d66aa4aa9d388d3d5a8cf357be43f295075941b31fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jsadebugd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
          • Size 35.4MB
          • SHA256 48b642ab78d40fd9d3685719ed4177428a8331341e5c05c86f7b12066b6a6a1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstack.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
          • Size 35.4MB
          • SHA256 7190c7068d347819dad583f70e0bf14e271a5a7b57e0c546802548ebecc2f181
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstat.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
          • Size 35.4MB
          • SHA256 daff246c1b2670a109df8f345197b2bf6cd68be1b55aae8897a72a1967e0854d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jstatd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
          • Size 35.4MB
          • SHA256 f1e8dd1ffb2a83f51be170b734736afab6b849acef642a8fc037cee32a24f85b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          keytool.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
          • Size 35.4MB
          • SHA256 9e773c1314ab69fedb3f4605bf7b2e22dffffdd9b103f86773edce644ac9f027
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kinit.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
          • Size 35.4MB
          • SHA256 8034c0d8c605f902ca7000648db0e716b1abc097e8310a37ed84bfeae0383c17
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          klist.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
          • Size 35.4MB
          • SHA256 624e416a0df7cc00350a9edb785c4a55301b30c5724e5764acd8f45e51426ef2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ktab.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
          • Size 35.4MB
          • SHA256 794eb10c0e65b84a96287085b968b49266c74f50ac85d0a494b05da945539c05
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          native2ascii.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
          • Size 35.4MB
          • SHA256 6b7fa3fc83465e008195a5b19c7305ef77394f65440d4f95e69cd79ac090c89b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          orbd.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
          • Size 35.4MB
          • SHA256 aa46b8d703aba933d567b1d51368e9140997cd1f18ad0034894c77e221b06b93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pack200.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
          • Size 35.4MB
          • SHA256 1664c264ea66abcbe520757e620de32550e2743553618fc5968c8778c0099414
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          policytool.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
          • Size 35.4MB
          • SHA256 6e0ae6737200c9c7df86a030ea70d1ab62b8b115ca76f0124cca4f2199519b28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmic.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
          • Size 35.4MB
          • SHA256 4d351606679c802a78d9abaced2fb1f78ae2ce11f3e1bfbc8582134751a6a50b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmid.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
          • Size 35.4MB
          • SHA256 1dfa9e4883c0be18cd7982e53384aebb2f9a4021ecf8d7927010ea7b5a128d0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rmiregistry.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
          • Size 35.4MB
          • SHA256 6590715cf364a149ad26acd2323c0a78dfedfe4494d4ee557ca6d7d8557a05b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          schemagen.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
          • Size 35.4MB
          • SHA256 030e078f8841b0e2adbfb559447a69396ef8256096d7ffb9d4067c849e9456b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          serialver.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
          • Size 35.4MB
          • SHA256 e97cdeda1795dbda72574d943d33a2c81bcb284394b8210dc6b8c3f2cd4e7c5d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1192-13-0x0000000000400000-0x00000000004E4000-memory.dmp
          Download

          memory/1192-0-0x0000000000400000-0x00000000004E4000-memory.dmp
          Download

          memory/2152-215-0x0000018B142E0000-0x0000018B14300000-memory.dmp
          Download

          memory/2152-190-0x0000018B03C80000-0x0000018B03CA0000-memory.dmp
          Download

          memory/2152-201-0x0000018B03CA0000-0x0000018B03CC0000-memory.dmp
          Download

          memory/2152-191-0x0000018B13E80000-0x0000018B13F80000-memory.dmp
          Download

          memory/2152-169-0x0000018B001E0000-0x0000018B002E0000-memory.dmp
          Download

          memory/2496-26-0x0000000000400000-0x00000000004E4000-memory.dmp
          Download

          memory/3364-277-0x000000000DEB0000-0x000000000E72B000-memory.dmp
          Download