909e84888bacd90cc8d213bab6c087c3976321010fea075b0485161ba85bc7a5

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
Size 78.3MB
Sample260804-glsdkadh74
SHA256 909e84888bacd90cc8d213bab6c087c3976321010fea075b0485161ba85bc7a5
MD5 ad02be78e7c765a1152c03c72e16d039
SHA1 056ee8747c056a57b4d709cb6590100b7c8bb6be
SHA512 4ad8d7225b726cd2fea4bf75267ab02ef5555c5ba8669f604891fd4bb70f096220a38223fcba975fade173d96c2f1ffbf7497c34762e0408c506b55694f2364e
SSDEEP 1572864:a111C1113111C1113111C111G111C1113111C1113111C111w9:u
TLSH
T10B08AF09FD8744F1D92B51B00DDBE3BF8A707A25C4228EBAFB4DCB1B7923B615418256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2008	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
420	svchost_BCBBCACCBBACCABCCACBCBABCABBABCCCCCABCBBCCBCCBBBBCAABAA.exe
3808	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBBCBBCACCCACCAAACBABAAAAAAABBCAABBCCAACCBABBCAABCBABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCACCBBACCABCCACBCBABCABBABCCCCCABCBBCCBCCBBBBCAABAA.exe"	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCACBCBAAACAACCCACBBBAABAACCBBBBACCBAAABCCBCBBBABBBBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe"	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2924	sc.exe
2416	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1340	cmd.exe
4300	cmd.exe
3260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCACCBBACCABCCACBCBABCABBABCCCCCABCBBCCBCCBBBBCAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4508	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
4508	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
4508	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
4508	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
2008	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
2008	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
2008	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
2008	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
3808	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
3808	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
Token: SeDebugPrivilege	2008	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
Token: SeDebugPrivilege	3808	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4324	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1340	4508	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe	103
PID 1340 wrote to memory of 4148	1340	cmd.exe	105
PID 2008 wrote to memory of 1212	2008	svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe	106
PID 1212 wrote to memory of 408	1212	notepad.exe	107
PID 4508 wrote to memory of 4300	4508	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe	111
PID 4300 wrote to memory of 2924	4300	cmd.exe	113
PID 4508 wrote to memory of 3260	4508	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe	114
PID 3260 wrote to memory of 2416	3260	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABCCAABBAACABCAABBCCABAACACBBCAAAAACAAAABCCCBABACCBBBBACBABBCABBACABBCCCBBABABAACBBBBBACCAABCCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABCCAABBAACABCAABBCCABAACACBBCAAAAACAAAABCCCBABACCBBBBACBABBCABBACABBCCCBBABABAACBBBBBACCAABCCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBABCCCACACBBCBCCBACCACABCBCAAAACCABBACACBAACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe" start= auto displayName= "UserDataSvc_CBBCBABCCCACACBBCBCCBACCACABCBCAAAACCABBACACBAACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBABCCCACACBBCBCCBACCACABCBCAAAACCABBACACBAACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe" start= auto displayName= "UserDataSvc_CBBCBABCCCACACBBCBCCBACCACABCBCAAAACCABBACACBAACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBABCCCACACBBCBCCBACCACABCBCAAAACCABBACACBAACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBABCCCACACBBCBCCBACCACABCBCAAAACCABBACACBAACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACCBBACCABCCACBCBABCABBABCCCCCABCBBCCBCCBBBBCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACCBBACCABCCACBCBABCABBABCCCCCABCBBCCBCCBBBBCAABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCACBACCCABCAABAAACBACACAACBABABCBCBCABBCCBACAABABA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 33e3497539dd6c8e271807f34dc92bd494aa920d509d82dea8821d556309d0d2
MD5 0d54397e7bf2a9b17b483246988c8c7f
SHA1 69ad4e924df2e1c734b6aca2f0f7c0bfb37f3288
SHA512 76e671eb5132a8b11b16a8b88751750bb375498556a29ceddce9ef93d502c11ffb97f4a0243717783997965a742102c1cb05c0da7890b52a9170588ecb902406
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 60a9e8ef172b60278a4ecd9853964f6026054bc96a666695ce80a876c8ed107d
MD5 8b1e178bba0e49e58aaf5f51663b8f9e
SHA1 e41b79b2652da1471041d782b325a1fa65ad13a4
SHA512 986f82f866f9dba62186d83dae3a4902a6f214f01dcda6e777f08bd88788cf557374cd099699d537b39893a763bae31ff620aa69c3adad0e2f3104d890564acd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 0347d9ed8ece726469f666b7d43325141868af4bf63400c8cee3859fd64090a7
MD5 2736fb30622c51cad03eaface018e342
SHA1 d013dc277ddfadcfc2747eedc803e769d93b0bce
SHA512 29f47dcb71005422ac76b3a8a845a3c1181580289dd888fb94e45304c255803c265b19db1d177e62ec3b9cd52e1c770bd7aa17febc5626f60007aef2f0f694d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 c19b817a84dd388429c238a911c1295f711330c3bfd20dddbdcc04a54be6155e
MD5 9b32d70a571d7f48b2d3ac170a63070f
SHA1 4a2d8274f31476cbf37409a2c01e611fd0f06ae6
SHA512 5b9a8051588716dc34da1cc1ce9025e487c59157d3d76bbfa1cba41fc01109a76f69bc7a6ffd9980555975343270bef143286649d3e33fd81e49cb35583ac2c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4183a43aaa949bbfad19ef76ea0f2634417d6597bb795a235ccc1c629ce5963e
MD5 d24b2118272b9fffd68cc933f846249e
SHA1 7261123e9ccdd6ddf150018de719c9894bd8382d
SHA512 414cbdfe5656789f28ab9a1b6472a24f177b56393fd4eda42a24f54a4a5b271d93472f7bbd6416f0f9339a99ca36b28942dcee35f3af9761fda9ba3cc5538549
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4970bd9e782980252988ffe6a4819549dc4baf1286f99ca3d1202d772df69af8
MD5 632f9ab53fdb4f3a0d37125614155056
SHA1 cbe02fdade9b4fb6680c8548ff8d80de2c9040c4
SHA512 9953f523826cbe3c1542dfd5b8e95ad7610fc1b25a4b04939b3d5379fcfa0e7d2a173e9d523e0f795bb75580d64e29d49619f42dc3c254853afbe79b97674f3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7120a5941d5be686e096a9dee715650a7827cb3a60c1b6d52820abb5189732e6
MD5 10a79ca6257b084c903061a3c5d1f9c9
SHA1 f0fcec5738011760bffdf13d04dfc7c5b3ca5ec6
SHA512 53b2b5e9621a6f536b668f98da80c8e4ec55f1c8e78ac6043c5c06d54880ce9fb35a21e6039ac1c41136ab346959397c097d8a6c5b8837b341f5d3af171a6ae5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ed079257aa5a807089e5acfb4b8e027ca1c039c16cdbae704a27e103b8f346e
MD5 4d904987c3554d3b4d8c520c67fc0603
SHA1 c555ab8730eef3535e3b00129646375f6b0f5684
SHA512 c0b539b5774f371784385aa9b483cbbfa1bee800b07a18ac0576988f256ce35fd60f95b9430bcd2bb6b1ea2f2d551871f67edc9adc380b7660dcf3391086b952
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9558ee95ca76bedbcaae5840f9c3b57fa68323bd5e96ab65936baea850449c5b
MD5 19b44e76a94399aac461f31243c476f2
SHA1 e612410405cb39bf7ccac15894a6d6b0dc7f141f
SHA512 ad1fb1181305bf53b3fa210a8a3a457c6b541139a6bd48ec24dda29276332af5d8bfee06c4d27543c968f191cec6095bb944fbeb013cb0fa464f72c6b0a16f59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dafc06d540266506f0fb21b88a0a2331b0d8dfff72b250503e25deddd97e41ad
MD5 538950c1f552281e2252a02b210f5ccb
SHA1 db9e828faec9c2535d11cb979f15838dd7b3c5b1
SHA512 eec7416e9102640745c4969dbfedbb8c19bf68be48f232662bfaa717c2d5ec0586cf131f0b75798af5683b2112d5c39717e31aaa3d1104885b5437ada44ad104
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 d69c2ff7f9ff9edbd1e5256a80ea5792d7b0dbc3510cc6604f9b0558f8193a7b
MD5 0fac5a40b5d2514f746d6280a94abe9f
SHA1 6ae4a1f91563a810df34ecf9e49add6f097f5d81
SHA512 9d720e7b50319de25086aaba8336649c81c6533adae6eb66f9e709c1388afd9391eec969e9752ded2ba22cd91560ee10871c62621962254203137431c84e8b34
TLSH
T1C3014E20D0EADC63D47165CF5A25CAC20CE5774A6C9C7A40A35D410CBF94C334F164D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/420-72-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/1212-59-0x0000000002C80000-0x0000000002C81000-memory.dmp

Download

memory/2008-36-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/3808-372-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4508-0-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/4508-7-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download