80cca6b05ddf4a7ed45c41263079782f93a277547a54fb2de4b27e8ecc128aac

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 11.8MB
Sample260813-ejrm5saq4y
SHA256 80cca6b05ddf4a7ed45c41263079782f93a277547a54fb2de4b27e8ecc128aac
MD5 a6e055147c00fe80cf952d241d4b7012
SHA1 4e3b89fe436307805c13f25cfb2ab9c8044c96ea
SHA512 15fc6700f1662cb0af66b484feeff460a0148a6a25fda381a116da51ae9fef0222b37e8ae694a45682d8a5e45a5e272d390e13857a7448f0e4603ae033734446
SSDEEP 49152:U+Ef+EPiw25+Ef+EPiw25+E0qatgll+Ef+EPiw25+Ef+EPiw25+E0qatgll+Ef+3:rPPPPPPP7KjKWQckVgtev5mnlNLW
TLSH
T1D2C65C09BBDD4461E4B7623149A7C27ADAB1B8514B32C7DFA384833E5E33BD0A934B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3500	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
2144	svchost_AAACBCBBBBACBCCCCAACABCACAABCABABBBCCCCCAABACBBACCAAAAA.exe
2932	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBCCBBABBACBCCBCAAABCBBCCCABACAAAACCBAAAABABCBAACABCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe"	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCAABAACBABCCCBCAABAABCACACABCAAACCACBACAAACBBCCCBBAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACBCBBBBACBCCCCAACABCACAABCABABBBCCCCCAABACBBACCAAAAA.exe"	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2292	sc.exe
4708	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe
4228	cmd.exe
2304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBCBBBBACBCCCCAACABCACAABCABABBBCCCCCAABACBBACCAAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3976	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3976	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3976	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3976	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3500	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
3500	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
3500	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
3500	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
2144	svchost_AAACBCBBBBACBCCCCAACABCACAABCABABBBCCCCCAABACBBACCAAAAA.exe
2144	svchost_AAACBCBBBBACBCCCCAACABCACAABCABABBBCCCCCAABACBBACCAAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	3500	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
Token: SeDebugPrivilege	2144	svchost_AAACBCBBBBACBCCCCAACABCACAABCABABBBCCCCCAABACBBACCAAAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4948	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4672	3976	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 4672 wrote to memory of 2768	4672	cmd.exe	102
PID 3500 wrote to memory of 3532	3500	svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe	103
PID 3532 wrote to memory of 2856	3532	notepad.exe	104
PID 3976 wrote to memory of 4228	3976	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	108
PID 4228 wrote to memory of 2292	4228	cmd.exe	110
PID 3976 wrote to memory of 2304	3976	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	111
PID 2304 wrote to memory of 4708	2304	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACAAABBCAAAAABABBACCAAACCCAAABBCBABCCCBCCCCCBABBCACBCBBACACBCBACBCBAACBACACBACBAABABBABABBBABAABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACAAABBCAAAAABABBACCAAACCCAAABBCBABCCCBCCCCCBABBCACBCBBACACBCBACBCBAACBACACBACBAABABBABABBBABAABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBCCCBACABCBBBABCCBCCCACBAACCBBCBAABBBCABBCCCACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe" start= auto displayName= "UserDataSvc_BCBBCCCBACABCBBBABCCBCCCACBAACCBBCBAABBBCABBCCCACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBCCCBACABCBBBABCCBCCCACBAACCBBCBAABBBCABBCCCACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe" start= auto displayName= "UserDataSvc_BCBBCCCBACABCBBBABCCBCCCACBAACCBBCBAABBBCABBCCCACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBCCCBACABCBBBABCCBCCCACBAACCBBCBAABBBCABBCCCACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBCCCBACABCBBBABCCBCCCACBAACCBBCBAABBBCABBCCCACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBBBBACBCCCCAACABCACAABCABABBBCCCCCAABACBBACCAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBBBBACBCCCCAACABCACAABCABABBBCCCCCAABACBBACCAAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
1⤵
- Executes dropped EXE
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc7269e77b3aa3cfe434f1f5d6c7f66271a0a79c91bc5f07b654e7b7beee3169
MD5 ecfe642bb063a5fc51e8c1815481c354
SHA1 ec9679db7d3538a4c6836de844a05115fee71a89
SHA512 5a3afb30267da4fb1026a98c430173169af2582f33792a8a3f4f18e8aa9ade3ac110da89f4bef18be283c12fb3a8dd89f7b94516d2afba0755928316ad355880
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 628538d52b26013dd1a42b59930a1fbda8ce87738d84a9004da98d9cfa3ab2e0
MD5 789fe61b8aaebc27c9d7273c9689f431
SHA1 c359e996ab82ab9c0a0cffd85a065ccb28e4f1c3
SHA512 debacab9c26fde5b01a07c4312b428a7e1a1881555acbe7e34305b452ca35eaf1c7f1ca6af708102de09a2c2ba808bda8d984aaa604c2d9e31130c856a82870c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 667f4b3a8252dad0baff8202d5aeb9f1e4e1f1063a2615c5fd9487eb8f198404
MD5 421117cd3bb32910437c5bde5b4d6807
SHA1 6b790cf9d7d23b692065094e0068718f05288276
SHA512 19b11b1dd87dc8949c69e5e514622ea901df7220b4ee39526a8230a50f34d103daf1be3133a78e605ba7aff3ce31cd3a7c417849b750b3ae6c970454fc753fe6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 daaaf100f32cdcf6d5fc2599c5108e03a8c02c4dca7953f02b5e0244d7d8ad46
MD5 9a45d478365703b4668831d73ddeaf41
SHA1 8ab3c126c5a256280d881e25bf425149392d6f59
SHA512 6fcb38ddb9258bf6c90a5d64397ef41c2aff97c11752d553de924f94f1f1ed917db96a62ad51b53b829c14c4317791ac94ff9378feb147a104aed0d101e8aade
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea78d742b68edfd841b1d05754dc0157c9dc26c5868f73b59c2a931ba5110cbf
MD5 7195608fdc8c25d3d618be2de49801be
SHA1 0dde598213034160ba426a57122011ec77d513e4
SHA512 249fe79f4f1caeef9267b74feb0a40bd0ee414b5f533e4575a078ec4dbce654d71506752ed3317ed6c0ade15556f4b829b459cbcd4ad5aff8bcd2f83a8329e2d
MD5 SHA1 SHA512

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 1.9MB
SHA256 6c783224289d753fa679e06c175a9a36dea3c6c33680c9d41635de0e06cc1b23
MD5 a028d531c757f68f9418adb2ff2d4fde
SHA1 027692550edb42864da338086365d0dd98fcfa58
SHA512 1e1be436b598bd63f440416a2e7056dc78b477131747c59490e4733e7a98a5ab85b2607effccc5494f789fb66ecdf3ebd55060d39e0e2edcc2c27b08001d123b
SSDEEP 49152:U+Ef+EPiw25+Ef+EPiw25+E0qatgll+Ef+EPiw25+Ef+E:r
TLSH
T173953B09F6DE4461E8B7617049A7C27ADAB1B8518B32C6DFA344C33E5E33BD0A934B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 70ae8df853114c281dc775c431351fbeb9bb152b1ae31cfec96f19e6b9c8501e
MD5 87ca47335422284e15dfe42d225fc22b
SHA1 17881d0bd2d03870906a32d7fde5423e69b42145
SHA512 7c8b3f46a611745c73c14a15134a356e32ee83acd86168b7252e6d13e3f215aa352c7a2756af15d89a5b469d252b27c0b383fea5fd1bb31857f9a7ed5c3c951a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7ef5fcaafdd48d1961c49f73c500b84f11192ddadc31195cc60423c641da2ccc
MD5 9ca90d1cca7d7a9ae0269a56e95d76b2
SHA1 7059f129f3ef27fdf7430ab0a0976fc6edd301aa
SHA512 a033c72b6fe4a0cdce5a2cf6a55c285b281a8a656b69dc561ecfa624523d518eaaeaef70c8719ce38c360c1127b53f561d0d831f2853864c91d5c23f47e4647a
MD5 SHA1 SHA512

Submit Download

svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBCCBCABACCBCCBACCBACCCBACACBCCACCBAACABCCCCABAA.exe
Size 11.8MB
SHA256 80cca6b05ddf4a7ed45c41263079782f93a277547a54fb2de4b27e8ecc128aac
MD5 a6e055147c00fe80cf952d241d4b7012
SHA1 4e3b89fe436307805c13f25cfb2ab9c8044c96ea
SHA512 15fc6700f1662cb0af66b484feeff460a0148a6a25fda381a116da51ae9fef0222b37e8ae694a45682d8a5e45a5e272d390e13857a7448f0e4603ae033734446
SSDEEP 49152:U+Ef+EPiw25+Ef+EPiw25+E0qatgll+Ef+EPiw25+Ef+EPiw25+E0qatgll+Ef+3:rPPPPPPP7KjKWQckVgtev5mnlNLW
TLSH
T1D2C65C09BBDD4461E4B7623149A7C27ADAB1B8514B32C7DFA384833E5E33BD0A934B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 1ee6cc084911fa53bcf68b422bf2d723b877796e80753eb7fe4bfe1d008eb1db
MD5 aa62e99df7d76a967aa318c4dd141023
SHA1 1dd595d12677c474b767b31e592965710cf12c33
SHA512 a3406f9ec8b0cb8a4362087ede635a33a07e8f6d3ccfb05ff20cc81cafb6e6ca34f1f3dc0c39b031b951b69cc4879bf9413f5d304d82964697ff63c97ee98591
TLSH
T12711E232D9F59C53E92228CB662EBB530CB4738BE85C7B082308421AA745D76CD558D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2144-107-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/3500-115-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/3500-75-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/3500-51-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/3532-79-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/3976-76-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/3976-25-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/3976-0-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/3976-12-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/3976-52-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download