Overview

overview

7

Static

static

1

exodus-win....1.exe

windows10-2004-x64

7

exodus-win....1.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    1051s
  • max time network
    553s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 04:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    exodus-windows-x64-26.7.1.exe
  • Size 193.9MB
  • Sample260803-e4n3raycpb
  • SHA256 334c5ba558092afbd3dcea57ddb38269f6c36bf55005e0dcb7eb9beeb71d6b3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-26.7.1.exe
    "C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-26.7.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:796
      • C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Squirrel.exe
        "C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:124
      • C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe
        "C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe" --squirrel-install 26.7.1
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4480
        • C:\Users\Admin\AppData\Local\exodus\Update.exe
          C:\Users\Admin\AppData\Local\exodus\Update.exe --createShortcut=Exodus.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4940
        • C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe
          "C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1676,i,1549192285980499387,10863273329899987770,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1680,i,14326119640196685432,2168013186216495517,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1672 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5176
        • C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe
          "C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --field-trial-handle=1676,i,1549192285980499387,10863273329899987770,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1680,i,14326119640196685432,2168013186216495517,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1892 /prefetch:11
          4⤵
          • Executes dropped EXE
          PID:5184
      • C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe
        "C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe" --squirrel-firstrun
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe
          "C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --field-trial-handle=1784,i,13780677316038334935,794324344510813689,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,7352789914278637485,10730699001016414772,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1820 /prefetch:11
          4⤵
          • Executes dropped EXE
          PID:4896
        • C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe
          "C:\Users\Admin\AppData\Local\exodus\app-26.7.1\Exodus.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,13780677316038334935,794324344510813689,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,7352789914278637485,10730699001016414772,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1780 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5972
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2032
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4064
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3984
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3988
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:3156

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RELEASES
            • Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
            • Size 78B
            • SHA256 3be35ffe2f6917fdee744987b72e3d14f9b227e5f57dee2fa14a9d3f68247372
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Update.exe
            • Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
            • Size 1.7MB
            • SHA256 dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            background.gif
            • Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
            • Size 12.6MB
            • SHA256 d2da6ed0e7754975a11047344b92e324afbc0bee4f4de2dd3dcc6b241e875a70
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setupIcon.ico
            • Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
            • Size 352KB
            • SHA256 381905c1421a53741029db9ac3b9544bc39daabc8e14a8883ab0b64c5c0d2ca3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Exodus.exe
            • Path C:\Users\Admin\AppData\Local\exodus\Exodus.exe
            • Size 599KB
            • SHA256 53145b189a78b0bd90bff1f331d5ce0cd5d35e1f6fd88870c5dec10a0aede544
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            D3DCompiler_47.dll
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\D3DCompiler_47.dll
            • Size 4.5MB
            • SHA256 d976a24b52611b5dfcb380ac6ac26218ed1dd52799a97f2c6c509d0e6027ce61
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_100_percent.pak
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\chrome_100_percent.pak
            • Size 113KB
            • SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_200_percent.pak
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\chrome_200_percent.pak
            • Size 183KB
            • SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxcompiler.dll
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\dxcompiler.dll
            • Size 24.5MB
            • SHA256 66ea747bc987fb01f29d486cdb742a1b4525c1e62f6e9c3d296e187ee3f84055
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxil.dll
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\dxil.dll
            • Size 1.4MB
            • SHA256 8f27c046b4664a4a6e84a68308c0b70a075ee48f7343009be6780e141d0acd09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\icudtl.dat
            • Size 10.3MB
            • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libegl.dll
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\libegl.dll
            • Size 518KB
            • SHA256 213a8c96c5016ccc2db04e9e6fb8c329a3a3f64d0ba08b846ab49e5fb3afdb56
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libglesv2.dll
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\libglesv2.dll
            • Size 7.6MB
            • SHA256 297c351c8ec2a870a6cd39c97a5d2800146692f88d57112d2df0b456268c320e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\locales\en-US.pak
            • Size 548KB
            • SHA256 a15a41f74f809ae908b95645565c34b151483a5c04a94265b44aee12fd413b55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pak
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\resources.pak
            • Size 6.4MB
            • SHA256 302671ba7bf6d6352773d34de852793027d389c4afde1db0977e1b76e39d5938
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            squirrel.exe
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\squirrel.exe
            • Size 2.1MB
            • SHA256 55f4fdbd5fc93ded3565dd1af4d16479be3a27dab565243464107d8a1b114685
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            v8_context_snapshot.bin
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\v8_context_snapshot.bin
            • Size 698KB
            • SHA256 ef9f068c5a1494a02acff29f7c7cdde1a2d10d4ac46ca15b735124e8b48ddace
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader.dll
            • Path C:\Users\Admin\AppData\Local\exodus\app-26.7.1\vk_swiftshader.dll
            • Size 5.4MB
            • SHA256 47d40a57bded09df8fb787e0eeee481a55b329bd4df458f24ef904ee412a90ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Code Cache\js\index-dir\the-real-index
            • Size 48B
            • SHA256 3644e7cd230b9b45f6d17a912fa4b93abe5e7cb200a094d637b15d5466b7fde6
            • MD5 SHA1 SHA512
            Submit Download

            index
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Code Cache\wasm\index
            • Size 24B
            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Code Cache\wasm\index-dir\the-real-index
            • Size 48B
            • SHA256 a5193135d9f23a79aabe9c34d1f8a431c3f981558f5fd4d43f47fe063ad1f22a
            • MD5 SHA1 SHA512
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Local State
            • Size 434B
            • SHA256 57a3e8f4368d5b4422da150c3a9d3bf3aa4467f67df9f5a9c4347b0f881c1af2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            000003.log
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\000003.log
            • Size 30B
            • SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
            • MD5 SHA1 SHA512
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            LOG
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\LOG
            • Size 245B
            • SHA256 597113db66b9c4e3faf2d86811a615d55f12f820cd0d940dd72b5b3ac7d8d206
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Network\Network Persistent State
            • Size 111B
            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Network\Network Persistent State
            • Size 61B
            • SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Trust Tokens
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Network\Trust Tokens
            • Size 36KB
            • SHA256 fe03fb82cfe74a64c7094c810f9e8167c3b61c254c27569cc6b7db5ed84b0b18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Preferences
            • Size 127B
            • SHA256 48f74c5bd5249d54a8585e64dd065ddb737dfd1520d329aa45b5d63a93a5339c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Shared Dictionary\cache\index-dir\the-real-index
            • Size 48B
            • SHA256 eaa4d670864e3d0343deea33ec82774da6f953575d47205c12523c32df96351b
            • MD5 SHA1 SHA512
            Submit Download

            db
            • Path C:\Users\Admin\AppData\Roaming\Exodus\Shared Dictionary\db
            • Size 44KB
            • SHA256 9dfba1d139c9933668e58e9c7777804c8ae01b2942dcc2dfaaa65ac139853a59
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Exodus.lnk
            • Path C:\Users\Admin\Desktop\Exodus.lnk
            • Size 2KB
            • SHA256 57873bf442ca63e4aa8e0f0d8ba5101e6aa87abb7e88a54eaa2f1daf9d259aca
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/124-103-0x00000000000F0000-0x000000000030C000-memory.dmp
            Download

            memory/796-192-0x0000000006B30000-0x0000000006BC2000-memory.dmp
            Download

            memory/796-91-0x000000000B0F0000-0x000000000B0FE000-memory.dmp
            Download

            memory/796-90-0x000000000B120000-0x000000000B15E000-memory.dmp
            Download

            memory/796-10-0x0000000000580000-0x0000000000744000-memory.dmp
            Download

            memory/3984-236-0x0000014F80000000-0x0000014F80100000-memory.dmp
            Download

            memory/3984-281-0x0000014F94670000-0x0000014F94690000-memory.dmp
            Download

            memory/3984-262-0x0000014F94790000-0x0000014F947B0000-memory.dmp
            Download

            memory/3984-249-0x0000014F943D0000-0x0000014F944D0000-memory.dmp
            Download

            memory/3984-248-0x0000014F84020000-0x0000014F84040000-memory.dmp
            Download

            memory/4940-137-0x0000000002A90000-0x0000000002AB0000-memory.dmp
            Download