mofksys | ec818f054b76f07192e850e987819f968699d8e14d84caaf5be5c292ce844eb8

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
Size 3.5MB
Sample260710-d91hasdz6w
SHA256 ec818f054b76f07192e850e987819f968699d8e14d84caaf5be5c292ce844eb8
MD5 7dd7503def1553925ee2017bc5e5670b
SHA1 5243d3093bd1561994b87d3dfb12f95afee41a74
SHA512 14f57c525a09e2b40f3936b30a675988ab642faeafdecd029bf1cae9bde3811f9cb3f331d848e201942c916380526aeff5c33048375852da42336a991c0b5e4c
SSDEEP 49152:/Yz7zglZTo7c+2M5VWgtwkJyShV5VRz/dtmSp1YTLfNEi:Qz7zglZ+2QXwkJFh/VRDSSp1Ufz
TLSH
T1EB067D26F2519437C2732974DD5793E8A829BF102E28684B3BE07E8CAF757C23935197
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery mofksys persistence worm

Malware Config

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys

Detects Mofksys worm 12 IoCs

resource	yara_rule
behavioral2/memory/2704-0-0x0000000000400000-0x0000000000441000-memory.dmp	family_mofksys
behavioral2/files/0x001b00000001c511-13.dat	family_mofksys
behavioral2/files/0x000f00000001c550-18.dat	family_mofksys
behavioral2/files/0x000e00000001c552-30.dat	family_mofksys
behavioral2/files/0x000e00000001c554-39.dat	family_mofksys
behavioral2/memory/1088-48-0x0000000000400000-0x0000000000441000-memory.dmp	family_mofksys
behavioral2/memory/2760-51-0x0000000000400000-0x0000000000441000-memory.dmp	family_mofksys
behavioral2/memory/6020-52-0x0000000000400000-0x0000000000441000-memory.dmp	family_mofksys
behavioral2/memory/2704-53-0x0000000000400000-0x0000000000441000-memory.dmp	family_mofksys
behavioral2/files/0x000e00000001c557-54.dat	family_mofksys
behavioral2/memory/2036-55-0x0000000000400000-0x0000000000441000-memory.dmp	family_mofksys
behavioral2/memory/3472-56-0x0000000000400000-0x0000000000441000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
4220	2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
6020	icsys.icn.exe
2036	explorer.exe
2760	spoolsv.exe
3472	svchost.exe
1088	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6020	icsys.icn.exe
6020	icsys.icn.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
3472	svchost.exe
3472	svchost.exe
3472	svchost.exe
3472	svchost.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
2036	explorer.exe
3472	svchost.exe
3472	svchost.exe
2036	explorer.exe
2036	explorer.exe
3472	svchost.exe
3472	svchost.exe
2036	explorer.exe
2036	explorer.exe
3472	svchost.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
3472	svchost.exe
2036	explorer.exe
2036	explorer.exe
3472	svchost.exe
3472	svchost.exe
2036	explorer.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
2036	explorer.exe
3472	svchost.exe
3472	svchost.exe
3472	svchost.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2036	explorer.exe
3472	svchost.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2704	2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
2704	2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
6020	icsys.icn.exe
6020	icsys.icn.exe
2036	explorer.exe
2036	explorer.exe
2760	spoolsv.exe
2760	spoolsv.exe
3472	svchost.exe
3472	svchost.exe
1088	spoolsv.exe
1088	spoolsv.exe
2036	explorer.exe
2036	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 4220	2704	2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe	86
PID 2704 wrote to memory of 6020	2704	2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe	87
PID 6020 wrote to memory of 2036	6020	icsys.icn.exe	88
PID 2036 wrote to memory of 2760	2036	explorer.exe	89
PID 2760 wrote to memory of 3472	2760	spoolsv.exe	90
PID 3472 wrote to memory of 1088	3472	svchost.exe	91
PID 3472 wrote to memory of 1300	3472	svchost.exe	92
PID 3472 wrote to memory of 5736	3472	svchost.exe	96
PID 3472 wrote to memory of 4432	3472	svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- \??\c:\users\admin\appdata\local\temp\2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
  c:\users\admin\appdata\local\temp\2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4220
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6020
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2760
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3472
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Windows\SysWOW64\at.exe
        
        at 23:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1300
      - C:\Windows\SysWOW64\at.exe
        
        at 23:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
      - C:\Windows\SysWOW64\at.exe
        
        at 23:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-10_7dd7503def1553925ee2017bc5e5670b_darkgate_elex_gcleaner_glassworm_wannacry.exe
Size 3.3MB
SHA256 480cdccfa85f39861eae9a842a8bbaa8c8e25331ee826e476940f36ff4463e93
MD5 482383625afe37e564f986e964a0d2ba
SHA1 6a6f8a830585f2e79e20bf885775bcf832a95787
SHA512 a0885d8f8fbfc2dfe8ce566f2ab1c054b5f9d609a8dd9af96c3b74dc28d635dce45123d608a32dba7f289b3a4b8779cfdeb35e3c7efc971ceba167652391118e
SSDEEP 49152:g7zglZTo7c+2M5VWgtwkJyShV5VRz/dtmSp1YTLfNE:g7zglZ+2QXwkJFh/VRDSSp1Uf
TLSH
T1BDF57D26F2519437C2733938DD5793E8A829BF502E28688B3BE07D8CAF757C13925197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 206KB
SHA256 a18e11ab86c06d7dda2f8783e46b429e59303f3e10805c4a0c23201f401ebf6c
MD5 ef582563ca67f80981a67221920a3eb1
SHA1 486d14f88e2ff42cc8e5df305d7d6049033923c2
SHA512 6286e24da831b9e6270dd78a6e4326d7c7c8a48be8969ed22a08e1827e003ae23761b5c4fa207d624c0f297c0ddf06bccfda45fa64110df12c758b4603489d47
SSDEEP 3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unq:+vEN2U+T6i5LirrllHy4HUcMQY6l
TLSH
T127242C6FFA40702ED59289F0146676AAB5216D321FE1AC0F63A09F4A34B1A53F5F530F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 206KB
SHA256 19719cec23bb2f640fe413090f7b51d7e92ef4f55c538bcedb01b621378fe69c
MD5 673f20aa8ddac9b5a647799a98870770
SHA1 dcfc08e814cacc5c4df17cccac33565afd2c08e1
SHA512 55d2ee386dc362fa21785e0b0f7a75889555802e7606ddaf9cf84067b8b57058fb9c54d5873da3237b7e11822fb75298fd627df19cd31183877c3f41dff91221
SSDEEP 3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unl:+vEN2U+T6i5LirrllHy4HUcMQY66
TLSH
T1B824F827EB44702EE467C6F52462A176BB212F212BC1AC4F27C0AB5A78B1553B1F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 206KB
SHA256 b089d432f2faa248b2c8d22cf42263b10a3a37e95ce290a4232c0a4e85fe0b1d
MD5 9a2269dcc57835b8907c83f2bdfea99e
SHA1 297d6a1ff6e1222ab8d13ab95853951f281d67ec
SHA512 fa4e864cd4631e96656a893274e207b32e629d85d805285a14cc20417d1b721a5665a30fc60968727e5d99ae76fbe9978e84ee86e3938300e2003f76f776b51a
SSDEEP 3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uny:+vEN2U+T6i5LirrllHy4HUcMQY6H
TLSH
T1FE240A2BEA40702EE8A789F05927B5A6BA366D312BD05C0F66D26F813476543F4F431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 206KB
SHA256 dc563714de9834289be4b6b97fe57a35c20aee35f4f78841f2d91aac2661e221
MD5 dd3561fa5959e2612e59fb6a7337d19b
SHA1 778d356d1a76be2edbcb669710039a15a908c2f5
SHA512 16d5602a06f0221ca95279ae0c7ce82ed3142df55ebd62e6e95b1a01261153f7325e7c9f1f674dff98ae499027cf2fdc772fb90caee40e04a41e9cd7edb7ccfa
SSDEEP 3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un3:+vEN2U+T6i5LirrllHy4HUcMQY6w
TLSH
T144241927EE00702ED4A3D6F06825616ABB257E250BD1AC4F23D0EF9A2171943B5F671F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 206KB
SHA256 aa4f9aa0ee68ee367fbc973126149e50f93f5623ebeb68ab35f91b7a2e7d43ba
MD5 52a4b2dfa0e78028988d5fe7d6185e34
SHA1 49349b8f1bc926cfca6098d9ccfb49e7b94af7c2
SHA512 9fc2f4c045c476756665b21328efa88e802acbb9db945048d7e5d25f6acb8b9001e2b42268948bc65b781cf9e7147aa35c6f3c901b0660aeda611156ed2bf74d
SSDEEP 3072:+vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6und:+vEN2U+T6i5LirrllHy4HUcMQY6w
TLSH
T1C624E82BBA40702EE867C9F01466A2AAB9726D212BD0DC4F63D26F5534B1903F5F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-48-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2036-55-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2704-53-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2704-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2760-51-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3472-56-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/6020-52-0x0000000000400000-0x0000000000441000-memory.dmp

Download