Overview

overview

8

Static

static

3

2026-07-05...ar.exe

windows10-2004-x64

8

2026-07-05...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    47s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_09cbf9b0649d4755547dcc7e551282e2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 20.7MB
  • Sample260705-ejnlgshv21
  • SHA256 5ef02e9e456058cc0525738de062bf3f99027bc0793302db47683392e5e0fb9b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_09cbf9b0649d4755547dcc7e551282e2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_09cbf9b0649d4755547dcc7e551282e2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2252
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_09cbf9b0649d4755547dcc7e551282e2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-05_09cbf9b0649d4755547dcc7e551282e2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1324
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4876
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:5336
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
        PID:5504

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 21.2MB
            • SHA256 fc5f919681dd9d8a0f388e95f9724cf89047e4d5e36ee75bd751a41caf825341
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 20.7MB
            • SHA256 5ef02e9e456058cc0525738de062bf3f99027bc0793302db47683392e5e0fb9b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 20.7MB
            • SHA256 390769e426b79eb18b3b1fc7b0fabf1f9b8ebc2c29aed8d2c0802ae1edfeb25a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 41.7MB
            • SHA256 95bcc783fda9c2da3809d7c6f21596280c86594449ce2e93d96b63639edc6881
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 45.5MB
            • SHA256 e9fb6b485b739c6d51a917efe509e770b8789d50322a01794867904142b52af0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 22.8MB
            • SHA256 c2af0c7de4741741cabe6c618e5d82e3171a5638bc088eaf24ed744e3063ead6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 47.4MB
            • SHA256 031289690b41ac15674cf30bf8106b0ed102e85d733052d09e473eb40899f9c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 43.1MB
            • SHA256 75031091d1c789f03b3b6b914e84a09f85df9586803a0ee8789f68bbf47b025a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 44.8MB
            • SHA256 1a4831c67bcd47d0e274b55d8223a0a6dc4dc7897e1edb2ba7f69d1eae814c14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 43.6MB
            • SHA256 59133f68c5de6dffa04581c5a6ebcc05e0aa8a3d303b89eb117e623389c431e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
            • Size 43.0MB
            • SHA256 37a588145b22aeeab5501fc771bfcba872160f968e2cf9016be2b67483c58736
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome.exe
            • Size 44.4MB
            • SHA256 7b4a2ae31038d1adcb8084a673cb7f5a6f7229a3327493a654bf9a6925df57ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 42.8MB
            • SHA256 777d43c66ff8fda11be7a667b9046f5ec254bc876c92856258a729e5db0c5ec6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 41.4MB
            • SHA256 689b6e6fd980381fbb3965d889bf3907e982c1b61a7733941b060ef946167d6d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 41.4MB
            • SHA256 4e738827319397b17403e5c4b89561888d585c5f9bb6e4db7e79c6028519effb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 41.4MB
            • SHA256 bd1e41bef0cc132a47f76f8e564b99e7197c8de98330685d7d1ae0db05a3b4ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 41.4MB
            • SHA256 be308860bf2e60bda930e5f97323caeea06cbb32bfe51b105650ef92f12a1872
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 41.4MB
            • SHA256 b50e82cbf27c6594b260f4f7f9eb6c94b9404e5c1722fa5247d6b8ca0f2658c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 41.7MB
            • SHA256 17095ff2cf33d04a212054f0d4878ad4b2762dca7ccecf4c7df2f8b55d3716b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 41.4MB
            • SHA256 d7ba40e11c8f3458d4463bb17829f57ac936c2ba7c544a7a2ebfa07eb48a627f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 41.4MB
            • SHA256 0882514a966bdb5d375939f04b04d5a58bd94bd4bb1522ce678e9c9998e3964f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 41.5MB
            • SHA256 af8450da417c08aaca2ec72c93edd0aaa5099b2bee2ae37b1e237f414a31e1dc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 41.4MB
            • SHA256 6b1c5aab0e91d8d2b0c076ccc3eedc521ca1ef80faa233e1d07f38d4ec074f69
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 41.4MB
            • SHA256 73c87eba672e3b4e7de5254a4f56bd4b42a5cf809a38a4fc9198fc5b2b9131e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 41.5MB
            • SHA256 0e6d4f07d21441e178f3b98ff4c4676ae02125146c883a74e9387ab8986a5c6d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 41.7MB
            • SHA256 75a69bbd2bc0cf3569d8fba1c48210abc28943877018afc77c63a095fc78ba47
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 41.8MB
            • SHA256 9a81a055e8de66fab19988215b1f70195749079b1a60d8bda36ffcd5a8496b88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jcmd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
            • Size 41.4MB
            • SHA256 e85b650c35aab2eb0ff0363bb796a71bd3ce9c23bf18d24afabc6bb773d28a81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jconsole.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
            • Size 41.4MB
            • SHA256 aaa355819729b5578871f9ec9b165dc5d926f3317f0ca5967240084c95a7b747
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jdb.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
            • Size 320KB
            • SHA256 21e9dd8769a39db9165211e397543c288db6cfea67fb378fdcbfa803d9a215f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jdeps.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
            • Size 41.4MB
            • SHA256 197ebba8e0884304d5095c94cdc9e3d0ddf0fa9430649d1d3c4149ce9aa848b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jhat.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
            • Size 41.4MB
            • SHA256 66860e5380d161deb20f8b0f9709db454a0a924767707041131b360070ba2e8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jinfo.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
            • Size 41.4MB
            • SHA256 8f1a24e04fa4586eaffcf6883dadf3b547e2ac136cdc0241d116e27214c02a21
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jjs.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
            • Size 41.4MB
            • SHA256 74c378d2811759f65e824d71c42f3ca521ca7b9a8b0c54202ac81c6169708059
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jps.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
            • Size 41.4MB
            • SHA256 9e5bf82af4f27dfc692fa2634c71d8ed5abe292c8fc8026a0616bcd883ebf467
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jrunscript.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
            • Size 41.4MB
            • SHA256 7a4f042b215fc3f96ee57ae3fbce4ca513fef2d991e7bc16c5d9fa486bcbbfec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jsadebugd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
            • Size 41.4MB
            • SHA256 e851f240386bf2fe13d4e7b2afb633959bce4778b1b57938f78a4323ec497aee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jstack.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
            • Size 41.4MB
            • SHA256 d7d0615d6ec08e52b1fba43b1caeef5b3336142b4f0b79e2d0124e63c15288e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jstatd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
            • Size 41.4MB
            • SHA256 dd99382db396dd2771c526452de93a5a176480f0fd0113d14cf9a01fc9dc6ca5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            keytool.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
            • Size 41.4MB
            • SHA256 27cb0d352182e05dbb19d83e627392d06253d01cf09efaff7cbb51dae5a8e31a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kinit.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
            • Size 41.4MB
            • SHA256 72e45ebb5e5ea6da52dd72b4340c8981464bf5b4a4f77e95a2b9b888955107a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            klist.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
            • Size 41.4MB
            • SHA256 5b77dea1c55d37f1107995864689accad1a4152378164f5d7d1ad0dd92edffe9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ktab.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
            • Size 41.4MB
            • SHA256 93315669c2571e4fe3acb683b013c24b4ca7a4a23d6f1bd869c67bd4f4d65af6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            native2ascii.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
            • Size 41.4MB
            • SHA256 effaa539018f7408938bc7915ceb0fc0788b7a9c7a2cc15f25884d5932584ef7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            orbd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
            • Size 41.4MB
            • SHA256 b834dad2d9a3e6e552e2d77cc6485dc691697a6f607e495386a9c38b4852418a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pack200.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
            • Size 41.4MB
            • SHA256 3bef2a6dd70d962b459dff9b850b6e1280bcf0736ed379525d4b84ef14ff7ed5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            policytool.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
            • Size 41.4MB
            • SHA256 1e1464dc52cf20d215c23b5f21d6a442928cbd97692ea62ceb18fb27d5316658
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rmic.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
            • Size 41.4MB
            • SHA256 410ba2a3e00a00611222253337b66a58c564890888f5861dbc73eecec7d7a973
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rmid.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
            • Size 41.4MB
            • SHA256 c7074137824fe27c27276efeec6bd69cf95176bb4af6938e7496cf697b65dfae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rmiregistry.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
            • Size 41.4MB
            • SHA256 94fb4daee1f0cee96a5bdf09a18b799f7c071d4d9a06a8b97feb9b781ea5c43c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            schemagen.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
            • Size 41.4MB
            • SHA256 ff67c1770080657d6026fb20dd0b498ff3f689e39ff60c99e7488488a17b9039
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 20.8MB
            • SHA256 585b46ae9c421d57abd9cdf4f5d906a3dba456d4b958795b7d2331ac9ab0703d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            createdump.exe
            • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
            • Size 20.8MB
            • SHA256 b1c0608f69c70fafd331e3d2f3d6d1a7783f8108222310a6c7cb539cd9ee3e96
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            createdump.exe
            • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
            • Size 41.4MB
            • SHA256 28cf498acce016741dea4d0bbc59f03ffe0a067565cf8e9973e7fbefcbbfc463
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 595B
            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1324-9-0x0000000000400000-0x00000000004E4000-memory.dmp
            Download

            memory/2252-1-0x0000000000400000-0x00000000004E4000-memory.dmp
            Download

            memory/2252-0-0x0000000000400000-0x00000000004E4000-memory.dmp
            Download

            memory/5504-325-0x0000024501CE0000-0x0000024501D00000-memory.dmp
            Download

            memory/5504-327-0x0000024501EA0000-0x0000024501EC0000-memory.dmp
            Download

            memory/5504-326-0x0000024514140000-0x0000024514240000-memory.dmp
            Download

            memory/5504-341-0x0000024514420000-0x0000024514440000-memory.dmp
            Download

            memory/5504-293-0x00000245001E0000-0x00000245002E0000-memory.dmp
            Download