06693a8a89c1baafc553859f6c884a71185c60269d2a9dd947cbe05a50daafca

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Size 1.1MB
Sample260728-ar78msgp7x
SHA256 06693a8a89c1baafc553859f6c884a71185c60269d2a9dd947cbe05a50daafca
MD5 14477d9e9c0eb9d6e67bc7041f8e6b4f
SHA1 011bb4666c40b11681a8ac53c670c76db184c78e
SHA512 b8f77d97069d67f6011f42f0625277664fb6df483b3fddb2aab66d28d48bd6b16a326a0b9c2ddee549291118fc536c743b4bff279e45b23617a8b81b87e0d188
SSDEEP 6144:9pqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCg:9pqiC/2OGAtkCP4cejGSOpRK3CnIi
TLSH
T1F2358E0273D680F1D85238711567E26A9B797D154726CE9BEBE03E339D311B0AF2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	system3_.exe

Executes dropped EXE 2 IoCs

pid	Process
3940	system3_.exe
1896	system3_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	system3_.exe

AutoIT Executable 8 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/4748-0-0x0000000000400000-0x00000000004EE000-memory.dmp	autoit_exe
behavioral1/files/0x000f0000000243c2-10.dat	autoit_exe
behavioral1/memory/3940-12-0x0000000000400000-0x00000000004EE000-memory.dmp	autoit_exe
behavioral1/memory/1896-15-0x0000000000400000-0x00000000004EE000-memory.dmp	autoit_exe
behavioral1/memory/1896-17-0x0000000000400000-0x00000000004EE000-memory.dmp	autoit_exe
behavioral1/memory/3940-29-0x0000000000400000-0x00000000004EE000-memory.dmp	autoit_exe
behavioral1/memory/4748-41-0x0000000000400000-0x00000000004EE000-memory.dmp	autoit_exe
behavioral1/memory/3940-42-0x0000000000400000-0x00000000004EE000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3300	cmd.exe
3648	cmd.exe
5008	cmd.exe
2676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	system3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	system3_.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4748	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
4748	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
3940	system3_.exe
3940	system3_.exe
1896	system3_.exe
1896	system3_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 3300	4748	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe	85
PID 3300 wrote to memory of 4112	3300	cmd.exe	87
PID 4748 wrote to memory of 3648	4748	2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe	88
PID 3648 wrote to memory of 864	3648	cmd.exe	90
PID 3940 wrote to memory of 5008	3940	system3_.exe	96
PID 5008 wrote to memory of 4424	5008	cmd.exe	98
PID 3940 wrote to memory of 2676	3940	system3_.exe	99
PID 2676 wrote to memory of 1392	2676	cmd.exe	101
PID 3376 wrote to memory of 1896	3376	explorer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_14477d9e9c0eb9d6e67bc7041f8e6b4f_elex_stop.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:864

C:\Users\Admin\Desktop\system3_.exe
C:\Users\Admin\Desktop\system3_.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1392

C:\Windows\explorer.exe
Explorer.exe system3_.exe
1⤵
PID:3500

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\Desktop\system3_.exe
  "C:\Users\Admin\Desktop\system3_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37996DB9BB614EAA7D6117AAB3E0F7C9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37996DB9BB614EAA7D6117AAB3E0F7C9
Size 420B
SHA256 06fb46e7b4125ff0c02d9e6318029fa9d2d9bf022d0c7a28ba38296a78bb72af
MD5 fa2e6105400416f71dae2a8130ee9da9
SHA1 99fb420d8722e3b3dfb3f88eef04cd32d0600bb3
SHA512 c72c8587a3d4ef5d353a5d7f8fc7abd2717ca5fe14f8c062e5892e789e49582de4730c03d2b11ff9ae298d973998f33a6e2b33dabf166db32d7f0dea63a71e00
TLSH
T1B0E0A3517D2E33920BD0E914D5D4C4571CF548C7191774410D31DDB18192F4DAA223CF
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

37996DB9BB614EAA7D6117AAB3E0F7C9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37996DB9BB614EAA7D6117AAB3E0F7C9
Size 192B
SHA256 8896cc56c8f4b2be6f9e660201015290939fb4ebef043e85ba522e4c330a02e5
MD5 0d0725fb776baaa0d59f959a6c5e7415
SHA1 45a72b68f5799e1de78e4a436c8c013f78078fee
SHA512 e93b848201aea9c069b538e9174c4e7eeb2f1b28bc62d9e7507f5c4387d2d4eadd2f45df9866760c5e99a63778f7064a55f3883a5f21996b0deed1f5dcf38a94
TLSH
T1C3C080043F211104D170913F0D505B0907F4511C81835B4557725A7C500CE415C70E2E
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 2e6002a5afdaf207ca336bf122193d70311f407d7a5b04f75490ae74b0b32098
MD5 77b8ed51e674b96d6ba149195005bd35
SHA1 a5a9f5a90f5dbd6f713e65d656328cadd5d022cc
SHA512 61edba26b60b00e1986b920559733d42e7865504d0cd804c0afeb9c617849493c3a87b0f174a9439d6accbc1a6a8bdbe9f5b49f3b297703e4de6ab3269e562bb
TLSH
T11AC09B043BB64159F1344E7F1657571147FAF905DE4183540F747259C61DF425CF5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 181a0579b12e2fa1d84262cfe9729eb5f9845de2c719fb8dba5caaa2ce550a7d
MD5 a9d66bfbff20eb48e33a0f9328ec1d70
SHA1 a35071ef01a95ef7813e01bc617b91f0325ea30d
SHA512 5f87127b74ce3094de482ab9d5993360f6b67ce3048d793b309e08681131c71abf064097ebe9d66b1cf19eb88799e67f3244ac2ab3d97bcb7eec37928b1d111b
TLSH
T17BC09214B3A9471AF14E213E79E61E041BBA860AF6CBD3444BB811389928A4008B2E09
MD5 SHA1 SHA512 TLSH

Submit Download

setting[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YK6WTHFY\setting[1].htm
Size 173B
SHA256 5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca
MD5 bcd560eba80b849c980a5123047bc8f8
SHA1 cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89
SHA512 1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b
TLSH
T176C0806D6B533C9874973B3950C39160E1DC503023D9041112704507F0CB1D78DC23D1
MD5 SHA1 SHA512 TLSH

Submit Download

setting[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZVQID18K\setting[3].htm
Size 178B
SHA256 2215b6324712a5453264d05ba2a50d3475a3aca173dfe1bbc46d711722487089
MD5 c423622cf60c65d6aad4acea13b9f447
SHA1 35f82dd6da0f2ec19dc2feb3d02db26266520305
SHA512 4b59628af34c8bed6f7f626a6f229cdf25be59399baf0e792d90f0075ffee94ac969a71de6d57dd481248d7e5bc26b92cc052021a68ede3c37079eb38f93e702
TLSH
T18CC012696B532C9874973A3951C39160E1DC50202299041112604607B08B1A79DC23D5
MD5 SHA1 SHA512 TLSH

Submit Download

autorun.ini

Path C:\Users\Admin\Desktop\autorun.ini
Size 102B
SHA256 94a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
MD5 948c74cd98911b420ff89dac13399bcb
SHA1 76dfc73518f003953923b1b4f2b973f4bb56a411
SHA512 b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
TLSH
T1F3B01221E3BC0950040CF48CC3800CF2F023BD401008090372E1584C838000E573FC78
MD5 SHA1 SHA512 TLSH

Submit Download

system3_.exe

Path C:\Users\Admin\Desktop\system3_.exe
Size 1.1MB
SHA256 06693a8a89c1baafc553859f6c884a71185c60269d2a9dd947cbe05a50daafca
MD5 14477d9e9c0eb9d6e67bc7041f8e6b4f
SHA1 011bb4666c40b11681a8ac53c670c76db184c78e
SHA512 b8f77d97069d67f6011f42f0625277664fb6df483b3fddb2aab66d28d48bd6b16a326a0b9c2ddee549291118fc536c743b4bff279e45b23617a8b81b87e0d188
SSDEEP 6144:9pqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCg:9pqiC/2OGAtkCP4cejGSOpRK3CnIi
TLSH
T1F2358E0273D680F1D85238711567E26A9B797D154726CE9BEBE03E339D311B0AF2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1896-17-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/1896-15-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/3940-29-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/3940-42-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/3940-12-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/4748-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/4748-1-0x000000000047D000-0x000000000047E000-memory.dmp

Download

memory/4748-41-0x0000000000400000-0x00000000004EE000-memory.dmp

Download