cd41755f3a0520a2e58255f140183fad39866b50ac7062cc5f83216c598520ef

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Size 27.6MB
Sample260811-drvt4avbpc
SHA256 cd41755f3a0520a2e58255f140183fad39866b50ac7062cc5f83216c598520ef
MD5 51c7f1b367ef449444004710db7e416f
SHA1 18c9a3f707589a4ee5168490779010c240c423bd
SHA512 383f9b7060a23ed48bea2b563fc904d24333b3b3b797354ca5c7e99d71be7fc35a12a0d600e5fc95deae23cbf4e78e96e1a65926b1e0128943cc9aa50717003d
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+Es:lp7SA91pH2WpjHrgBFFu416AWvv
TLSH
T165575B05F94350F5D92B50B04DDBD3BACA707E2282224BEBF65DDB1B2E337A16C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4332	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
4736	svchost_AACACBAAAAACCCBBAACCCBBCBCCCBAACCACABBBBABACCBACCAACBCC.exe
4080	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBCBCBACCCCBAACBCBCCCBBABCCACAACBAABBBCACCABBCABBBBBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe"	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBBAAAAACCBCCBAABABCAAABABBACCCCCBCABACAABBBBBBCBCBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACACBAAAAACCCBBAACCCBBCBCCCBAACCACABBBBABACCBACCAACBCC.exe"	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
540	sc.exe
364	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2620	cmd.exe
3260	cmd.exe
408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACACBAAAAACCCBBAACCCBBCBCCCBAACCACABBBBABACCBACCAACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1316	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
1316	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
1316	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
1316	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
4332	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
4332	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
4332	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
4332	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Token: SeDebugPrivilege	4332	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3216	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2620	1316	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe	103
PID 2620 wrote to memory of 5096	2620	cmd.exe	105
PID 4332 wrote to memory of 2420	4332	svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe	108
PID 2420 wrote to memory of 4504	2420	notepad.exe	109
PID 1316 wrote to memory of 3260	1316	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe	113
PID 3260 wrote to memory of 540	3260	cmd.exe	115
PID 1316 wrote to memory of 408	1316	2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe	116
PID 408 wrote to memory of 364	408	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_51c7f1b367ef449444004710db7e416f_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBACBCBAABBCBCABBCACBACACBAACABBABBBCBCCBBBCBCABCBBACCBBCCBBACBBCBACBABCCACACBBCBABABBCABCAAABBCAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBACBCBAABBCBCABBCACBACACBAACABBABBBCBCCBBBCBCABCBBACCBBCCBBACBBCBACBABCCACACBBCBABABBCABCAAABBCAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBBABACBCCBACBCBBCACCCBACABCCCBCCABABCCAACBACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe" start= auto displayName= "UserDataSvc_CCBBBABACBCCBACBCBBCACCCBACABCCCBCCABABCCAACBACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBBABACBCCBACBCBBCACCCBACABCCCBCCABABCCAACBACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe" start= auto displayName= "UserDataSvc_CCBBBABACBCCBACBCBBCACCCBACABCCCBCCABABCCAACBACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBBABACBCCBACBCBBCACCCBACABCCCBCCABABCCAACBACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBBABACBCCBACBCBBCACCCBACABCCCBCCABABCCAACBACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4504

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAAAAACCCBBAACCCBBCBCCCBAACCACABBBBABACCBACCAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAAAAACCCBBAACCCBBCBCCCBAACCACABBBBABACCBACCAACBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
1⤵
- Executes dropped EXE
PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e913a2fe30a0e3247f0140425ae2c878df0f7e5fc25c8b7385bd97bcf86e6ff3
MD5 6e0a046f75f498ed784663ee59bf9302
SHA1 ef123be717f756ba365c33dfd5c54d182bc48af4
SHA512 b84fa0b849f0dc99bcb3d1a02ca91b907dbec424108309bccf3ad3a82f165827f5ad0f4960b9eafda8de27162383887c0af155ba048491b4f96853eff3a99736
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 473af03b682d8339954dc15a804ec72ca98f03c8d2858c4dc587fd8af08670b9
MD5 1b226250b396307b4f2d614c44783dc4
SHA1 b09d44a5680ec3ded52cc6fe9cf94fd0f0545101
SHA512 ece5d0c384d8efd038e2a58ea54d5a171f17bc8108f1facc004d302da47b83fec3544c84737fb7ac0ac5f515f5d27b0e5888b68d8b409ce123f51768e0abc96c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 94b92d0c25926bea4707603896d3a3a66f7937c041cd7e1293bb4c5d3eda0b1b
MD5 9919512f7e5095205f4dd27c210ba261
SHA1 1bebee7c2fb961b5b688aa36b955ed38cde12a01
SHA512 57ffdac5992d70a75dc7a0b66d739575ef50fe1c89951d0912b0079cd5eadae0ca14503caf05abed273e05e7cfa7e95c7716786bcd0e5107f91e0a0c17250886
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 520edf8baab8dda419383c41c3c01b8dcc307ea293d6070b5ae9afce237a2b69
MD5 0759dfbd6630575221dd965f884cf54c
SHA1 a8046a73fe30c51fef0a9db7131999a7a846c9c3
SHA512 2213f58ad93a6925068f2061c6c2d2a7bccbe1dcd7f61de70591b5e61a19438f02dfc431e1db35b36394d89df6205cf1e773c79a985e8748e1c51d430553c3f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1374f61d8e9f19e300ab271696c0ec94c0aa9864c966b7a619d29016db1305d9
MD5 742609aa5eb6beeb704ec922ed8c76f4
SHA1 10aebd36deef96dc6dd59260bc9829c41aae5893
SHA512 a6b54023306796b9c040981fd9d1bbbd08210299aae58f6e0d46293758751d71148d00606a86b2aa5f6185b8f436fa2b1b0c083dd72c4d43b7f12e63f9d88745
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 47ca04c5d1b457ae5465d12a050abe10a1be418e8d0f693f0446651dbf6f8687
MD5 34fd39039eaa0e2d932be708b5bdfbca
SHA1 24cbd306e7d3bd6367ceb0f8b741086c10287445
SHA512 7f0cfe0f4bfd276de182365e68f243152e197a096cac1df77013d8279a0271ecde68b2972da073665d58e61b8801e3b10690e6a6d3bc64539fa1301b7cdedff5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 230d1ec696f0829a7f188e767f11417b65884486e35d6ae9cb359388523dbf0e
MD5 eacbef35e1426ee640638802b283eb05
SHA1 ca545315d52c9ef302507222b616920e8a07925f
SHA512 de0cf07d0fc7f6472099938652cee6c55f970b8a11af6c3685cfb70a52dce3573b8a1ba730672b00914713fa36b1fc7b60dc703b33e40df6b8229a8853c1d113
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cc0dcf77224f18163335d63099e1af25b538febbb04cdd40ca7362d809378ea2
MD5 51d2c27f575cc7e0c2929b0ab475a552
SHA1 9559ca9af64efbcff3514da984f50a125c4b4c1d
SHA512 123b5a4d01e77a64fc7d9421a3d64574f047fc9f9975a7990283d13a96f7284184b55a5e0dd32775dd10926af2f475e1268637512077d8cb52c27af204ced0f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1295c84304d84029f00c5c27e35fd634a15f93ca69e33a25c84eb559c28b8aed
MD5 01fe1d3df4f4d2e545ad68a2ef2c5283
SHA1 f038a57078d441aa3bc22297b45b6d468a4e0576
SHA512 d71683dd1f21c9a73d056f44c8aeeb8410de7913cc9aa57f4e4d48f1faad2261603a6ee45b60242e85f1fcf0d0941b9b84bb459a08d41a6fdb04d2995d5e86f5
MD5 SHA1 SHA512

Submit Download

svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABCBABBCAAABCCCBAAAAABCBCBAABBBAACBBACCCBBCBCBBBAC.exe
Size 27.6MB
SHA256 cd41755f3a0520a2e58255f140183fad39866b50ac7062cc5f83216c598520ef
MD5 51c7f1b367ef449444004710db7e416f
SHA1 18c9a3f707589a4ee5168490779010c240c423bd
SHA512 383f9b7060a23ed48bea2b563fc904d24333b3b3b797354ca5c7e99d71be7fc35a12a0d600e5fc95deae23cbf4e78e96e1a65926b1e0128943cc9aa50717003d
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+Es:lp7SA91pH2WpjHrgBFFu416AWvv
TLSH
T165575B05F94350F5D92B50B04DDBD3BACA707E2282224BEBF65DDB1B2E337A16C28651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-11-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/1316-94-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/1316-0-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/1316-24-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/1316-74-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/1316-50-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/2420-78-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Download

memory/4080-103-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/4332-75-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/4332-36-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/4332-51-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/4332-102-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/4736-95-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download