darksiderat | 7b5099a2989a1e7d52ac7a1c653b5dfb22f2c33ca01a00d20cd48276fc992f76

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EAX Console.exe
Size 102KB
Sample260809-cpp1dsycpe
SHA256 7b5099a2989a1e7d52ac7a1c653b5dfb22f2c33ca01a00d20cd48276fc992f76
MD5 4ff8e9553cd105851a7b58ac3729a5e8
SHA1 b171ff8f4913366891c3222afadb34e040392a68
SHA512 8d0eafeb32230bedbe160116e4196cbe2c8d652cea15bfe2820af06390065f544927b7c0a9721ccf259e8c35b116d40aea12a78d0c5ee9668253b16b1c4fa112
SSDEEP 1536:kYvxrhs3z5F8JPDCkRNLT8vJDxXjmJe37AG8Du6+WSss/eYwp:kAxNssh9RhiJIE3UY6+WSvm
TLSH
T1BDA33A06F75354E8C51EF1F445E6E673AA32BC1540309B6A16F0FA323E70A53EE69A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution darksiderat persistence trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 8 IoCs

resource	yara_rule
behavioral1/memory/6068-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/6068-5-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/6068-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/6068-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3836-40-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3836-43-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5720-74-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5720-75-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5040	powershell.exe
5228	powershell.exe
3832	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5744	EAX Console.exe
3836	EAX Console.exe
2776	EAX Console.exe
5720	EAX Console.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
5672	cmd.exe
1244	cmd.exe
5992	cmd.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EAX Console = "C:\\Users\\Admin\\AppData\\Roaming\\EAX Console.exe"	EAX Console.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EAX Console = "C:\\Users\\Admin\\AppData\\Roaming\\EAX Console.exe"	EAX Console.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EAX Console = "C:\\Users\\Admin\\AppData\\Roaming\\EAX Console.exe"	EAX Console.exe

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	EAX Console.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	EAX Console.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	EAX Console.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	EAX Console.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	EAX Console.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	EAX Console.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3844 set thread context of 6068	3844	EAX Console.exe	87
PID 5744 set thread context of 3836	5744	EAX Console.exe	101
PID 2776 set thread context of 5720	2776	EAX Console.exe	115

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5672	cmd.exe
1244	cmd.exe
5992	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5980	schtasks.exe
444	schtasks.exe
2364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe
5228	powershell.exe
5228	powershell.exe
3832	powershell.exe
3832	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	5228	powershell.exe
Token: SeDebugPrivilege	3832	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 6068	3844	EAX Console.exe	87
PID 3844 wrote to memory of 6068	3844	EAX Console.exe	87
PID 3844 wrote to memory of 6068	3844	EAX Console.exe	87
PID 3844 wrote to memory of 6068	3844	EAX Console.exe	87
PID 3844 wrote to memory of 6068	3844	EAX Console.exe	87
PID 3844 wrote to memory of 6068	3844	EAX Console.exe	87
PID 3844 wrote to memory of 6068	3844	EAX Console.exe	87
PID 3844 wrote to memory of 5672	3844	EAX Console.exe	88
PID 5672 wrote to memory of 1180	5672	cmd.exe	92
PID 5672 wrote to memory of 5040	5672	cmd.exe	94
PID 3844 wrote to memory of 5980	3844	EAX Console.exe	95
PID 5744 wrote to memory of 3836	5744	EAX Console.exe	101
PID 5744 wrote to memory of 3836	5744	EAX Console.exe	101
PID 5744 wrote to memory of 3836	5744	EAX Console.exe	101
PID 5744 wrote to memory of 3836	5744	EAX Console.exe	101
PID 5744 wrote to memory of 3836	5744	EAX Console.exe	101
PID 5744 wrote to memory of 3836	5744	EAX Console.exe	101
PID 5744 wrote to memory of 3836	5744	EAX Console.exe	101
PID 5744 wrote to memory of 1244	5744	EAX Console.exe	104
PID 1244 wrote to memory of 4216	1244	cmd.exe	106
PID 1244 wrote to memory of 5228	1244	cmd.exe	107
PID 5744 wrote to memory of 444	5744	EAX Console.exe	108
PID 2776 wrote to memory of 5720	2776	EAX Console.exe	115
PID 2776 wrote to memory of 5720	2776	EAX Console.exe	115
PID 2776 wrote to memory of 5720	2776	EAX Console.exe	115
PID 2776 wrote to memory of 5720	2776	EAX Console.exe	115
PID 2776 wrote to memory of 5720	2776	EAX Console.exe	115
PID 2776 wrote to memory of 5720	2776	EAX Console.exe	115
PID 2776 wrote to memory of 5720	2776	EAX Console.exe	115
PID 2776 wrote to memory of 5992	2776	EAX Console.exe	118
PID 5992 wrote to memory of 3020	5992	cmd.exe	120
PID 5992 wrote to memory of 3832	5992	cmd.exe	121
PID 2776 wrote to memory of 2364	2776	EAX Console.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EAX Console.exe
"C:\Users\Admin\AppData\Local\Temp\EAX Console.exe"
1⤵
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Users\Admin\AppData\Local\Temp\EAX Console.exe
  "C:\Users\Admin\AppData\Local\Temp\EAX Console.exe"
  2⤵
  PID:6068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "EAX Console" /tr "C:\Users\Admin\AppData\Roaming\EAX Console.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5980

C:\Users\Admin\AppData\Roaming\EAX Console.exe
"C:\Users\Admin\AppData\Roaming\EAX Console.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Users\Admin\AppData\Roaming\EAX Console.exe
  "C:\Users\Admin\AppData\Roaming\EAX Console.exe"
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\system32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5228
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "EAX Console" /tr "C:\Users\Admin\AppData\Roaming\EAX Console.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:444

C:\Users\Admin\AppData\Roaming\EAX Console.exe
"C:\Users\Admin\AppData\Roaming\EAX Console.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Roaming\EAX Console.exe
  "C:\Users\Admin\AppData\Roaming\EAX Console.exe"
  2⤵
  - Executes dropped EXE
  PID:5720
- C:\Windows\system32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3832
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "EAX Console" /tr "C:\Users\Admin\AppData\Roaming\EAX Console.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 0e6517ec83b201bbab64b202a1056eb9777967f3dea5d947fc10a28b4eb62644
MD5 5762b04420f486c346bdfb3f40d33c85
SHA1 40f89abb08c4ab93ee75a068dd32fcafc54ee80e
SHA512 ca4cc48543e017fc402732d0c31b094140a5e865bd6bb8821c909d543f9bc746430c95c98bfb9828e2832c609d52aedb1b01b8cc4c7c032e56f367e05f05af25
TLSH
T1A361EE323375B0D4C8567F072A28198053BF4396EA94AF5CB258621EDA3741B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4ffe11db5be71d78ddeaf4d1af3fc1a0fd412ed15fb8c5f5a92c7ef04395414a
MD5 2224b25f9a3ab6045dda0a9fca79e6b0
SHA1 3c39edcc65e81ec8b555b4cd8244ae7a922f3f9f
SHA512 3a569de24d2aba854f1af641b14e0cf05a67139b08c97bb0f33856f747ff23a112b099e89c38c2fa43cb19d7077c277e928f2c821a04c8488b8ae062a5a59d43
TLSH
T146217433F3CC8922CC86163A509D9C1176B682C791DEDFAF6BC1D21195BF584CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 be1ab4355ebcaabdf9fbf43205d20879d156aec252e7622b52398717f4a8ceb0
MD5 ea932397ef40713ee5016c4b26fec2e4
SHA1 cff74838c954718dc2e1d6db8a048f3354b8b7cc
SHA512 65dd49f3283bcfb8e8f8dc9da4c04dc0f6ad109681831d226574e8e1682097380a513a45c1c7f2facf0b8f35a3b737947138b119626d4df1c05bbf6470e30b50
TLSH
T148217433F3CC8922CC86163A108D9C11B6B682C791DEDF9F6BC0D21195BF584CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yqmpivtg.xdo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yqmpivtg.xdo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~msnDEV-4a3a28740da4f3eb.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-4a3a28740da4f3eb.tmp
Size 4B
SHA256 f7904d6f4a4e19d37bc8824f8eabd3add0d614112a412b137c29b61222d6a4d4
MD5 5a049676afe2b7825bd7b4c28019e05e
SHA1 7e24dc87204a640b62f66e29d61880e6f70a450c
SHA512 4ca7943e92e25b648235ddf2959d40fca38471fed5c2c4bd780fda252b7758306967311f9a36b193b71d1f570110349bad6e38a562226fd2be435d6ae70c881c
MD5 SHA1 SHA512

Submit Download

~msnDEV-4a3a28740da4f3eb.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-4a3a28740da4f3eb.tmp
Size 4B
SHA256 fddaad52fcd4fef1725d6875f5cc94439963f1329b220593e08b53afcbb70653
MD5 a3a573a6695c1a5db9787965d0d8e225
SHA1 e44eeb821c79d5a8213391a3fed359f723540eac
SHA512 3219c03092f7f5106c7b16ba78303dc6a409201cea3887f7ac2999245e1814ce617a8e0ea30e287051acd268da3fc72f94cbc3abcf40b61d686ec6f4ab583bc1
MD5 SHA1 SHA512

Submit Download

EAX Console.exe

Path C:\Users\Admin\AppData\Roaming\EAX Console.exe
Size 102KB
SHA256 7b5099a2989a1e7d52ac7a1c653b5dfb22f2c33ca01a00d20cd48276fc992f76
MD5 4ff8e9553cd105851a7b58ac3729a5e8
SHA1 b171ff8f4913366891c3222afadb34e040392a68
SHA512 8d0eafeb32230bedbe160116e4196cbe2c8d652cea15bfe2820af06390065f544927b7c0a9721ccf259e8c35b116d40aea12a78d0c5ee9668253b16b1c4fa112
SSDEEP 1536:kYvxrhs3z5F8JPDCkRNLT8vJDxXjmJe37AG8Du6+WSss/eYwp:kAxNssh9RhiJIE3UY6+WSvm
TLSH
T1BDA33A06F75354E8C51EF1F445E6E673AA32BC1540309B6A16F0FA323E70A53EE69A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2776-98-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/2776-87-0x0000000285D10000-0x0000000285D6A000-memory.dmp

Download

memory/3832-86-0x0000020BB09D0000-0x0000020BB0BEC000-memory.dmp

Download

memory/3836-40-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3836-43-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3844-24-0x0000000285D10000-0x0000000285D6A000-memory.dmp

Download

memory/3844-42-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/3844-0-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/5040-6-0x000002371FE40000-0x000002371FE50000-memory.dmp

Download

memory/5040-17-0x000002371FE40000-0x000002371FE50000-memory.dmp

Download

memory/5040-8-0x000002371FE80000-0x000002371FEA2000-memory.dmp

Download

memory/5040-7-0x000002371FE40000-0x000002371FE50000-memory.dmp

Download

memory/5720-75-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5720-74-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5744-66-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/5744-55-0x0000000285D10000-0x0000000285D6A000-memory.dmp

Download

memory/5744-35-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/6068-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6068-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6068-5-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6068-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download