3497ae715b905eb1ebf1dc99d2d0aecf61e4a99521eb7cb18ec7732a8b3f46de

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 17.3MB
Sample260815-cb4lmaxwas
SHA256 3497ae715b905eb1ebf1dc99d2d0aecf61e4a99521eb7cb18ec7732a8b3f46de
MD5 0e945008a7ce069fe6054ed520f45093
SHA1 d099d88886a19455cd421c170f2ba794434f9970
SHA512 a12454f301c0eeb3f03a263a6800e19339a56ca5aa455115c130b576507067a52e4bc1bfcf3ffacc01f48ba704bb751663567ac34e383c6898d8e0ef08e5c7b8
SSDEEP 49152:U+ES+ElIDx8obnyMWmddjZ7xlF+ES+ElIDx8obnyMWmddjZ7xl3ozMlTzQ/7YGsV:+r7rT1MbQ9yDAD7KjjqkusjmqMhz
TLSH
T16A072929AAA480E5E96A973899678131E5717D100A3253BFCDB0F22EDE3F5B14D3C731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1564	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
4100	svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe
4912	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCAABBCCBABBAAABBBCBCCCACAACACABAABBBAAABABCBABBCCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe"	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAACABCBCCBCACABACBCCCABCCBACCCBBAABABCBBACAACABCBCAACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe"	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4928	sc.exe
2500	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3964	cmd.exe
2444	cmd.exe
1532	cmd.exe
4588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4004	schtasks.exe
2512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2744	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe
2744	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe
2744	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe
2744	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe
1564	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
1564	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
1564	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
1564	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
4100	svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe
4100	svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1564	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
Token: SeDebugPrivilege	4100	svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4280	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 3964	2744	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe	100
PID 3964 wrote to memory of 4004	3964	cmd.exe	102
PID 1564 wrote to memory of 4372	1564	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe	104
PID 4372 wrote to memory of 2724	4372	notepad.exe	105
PID 2744 wrote to memory of 2444	2744	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe	109
PID 2444 wrote to memory of 2500	2444	cmd.exe	111
PID 2744 wrote to memory of 1532	2744	2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe	112
PID 1532 wrote to memory of 4928	1532	cmd.exe	114
PID 1564 wrote to memory of 4588	1564	svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe	116
PID 4588 wrote to memory of 2512	4588	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0e945008a7ce069fe6054ed520f45093_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBCCCCBAAAAAAABCCCCBBAACCBCACAAACAAAACABACCBBCCBBCCACACCBAABAABAABCACBCBBACBBAACACCACBBCACAACCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBCCCCBAAAAAAABCCCCBBAACCBCACAAACAAAACABACCBBCCBBCCACACCBAABAABAABCACBCBBACBBAACACCACBBCACAACCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBABBACCCABBACCBABBBABACCBACBAABAACBBBACCBAACAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe" start= auto displayName= "UserDataSvc_BCBABBACCCABBACCBABBBABACCBACBAABAACBBBACCBAACAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBABBACCCABBACCBABBBABACCBACBAABAACBBBACCBAACAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe" start= auto displayName= "UserDataSvc_BCBABBACCCABBACCBABBBABACCBACBAABAACBBBACCBAACAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBABBACCCABBACCBABBBABACCBACBAABAACBBBACCBAACAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBABBACCCABBACCBABBBABACCBACBAABAACBBBACCBAACAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCACCBBBBCCBCABCBCCBBACBCCBABABAACABBBABACBACABCCBACACBAAAAABBCBBBCCAAABBACACCBBBBCCACBBBCABBABBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCACCBBBBCCBCABCBCCBBACBCCBABABAACABBBABACBACABCCBACACBAAAAABBCBBBCCAAABBACACCBBBBCCACBBBCABBABBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCAAAACBBACABCCCAABBBBBBAABACACCABBCACABABAACAACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
1⤵
- Executes dropped EXE
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b728c92deb5f96b1493f545c3156e340f7472a32bfc173f3fbf898a1b78c82e6
MD5 2bbb3914101c56e957516e85a628bd90
SHA1 f6d39180f3bd083c778db7c4afff705f2136c1fd
SHA512 14ee1c6316ee73db21bf479eb8e8374560a1e37c0e6c629d53500d09b1ab8cd857679d0f7c8e52c21a79ade9d84b47b93178e940f83fc538062c68df6c0d5b06
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b19a5d47a2c8cd9f6b0f9fa4302ed3516ec8d911f4dac9e92433370447e7e6f
MD5 6511b49619cbd06b5268515225c09b5c
SHA1 27cd4c6c8f28cfd5b07f9d969b3fd561f2f4044b
SHA512 c5baa5b229d63a1da40f7365d47795fa225a0cc6b985c2a3f829ff9b0989c963bd82e062b4d94cda1d48e0d5541d826aa5a343529f5cbe8b402e1e55ce54327f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a462cd28e650b86ae6cf821160817dc2091a2bcb897f6e87ec8a3b69b1c656ff
MD5 8bcddea5400d2d792a54ae4e45dffb2b
SHA1 3839430c5fe802477c31fdd64b99c284df96c517
SHA512 fba537e73a8e87828c2c949054cd0954cff9b83fd869ba3f40ea7e2194b8b56d7bbfa7003e15113fe78437e9893e4e9f467b40290ae9bd1b5d7e2cda1167ef78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7eb4df2eaea3e4b9a3cf3305f0045ed2670ba3edcef74d8f6cc4306d952d82b
MD5 ca2baad98eefdc3b2c495b40388dacfb
SHA1 4d55d4244b6ab576774923438495d7628c4b3d13
SHA512 177f07aeecad713b5dbe2ca450b92685d1cef5a7d7245f7ba547d19ea179f908beda4487abfb248b8d742b0e8402bc76d84ba7cb678075e5f450dfafe104b733
MD5 SHA1 SHA512

Submit Download

svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBBBAACABCBBBBCCABACCABAABABBBBBBBBBACACBCCCCCCBB.exe
Size 17.3MB
SHA256 3497ae715b905eb1ebf1dc99d2d0aecf61e4a99521eb7cb18ec7732a8b3f46de
MD5 0e945008a7ce069fe6054ed520f45093
SHA1 d099d88886a19455cd421c170f2ba794434f9970
SHA512 a12454f301c0eeb3f03a263a6800e19339a56ca5aa455115c130b576507067a52e4bc1bfcf3ffacc01f48ba704bb751663567ac34e383c6898d8e0ef08e5c7b8
SSDEEP 49152:U+ES+ElIDx8obnyMWmddjZ7xlF+ES+ElIDx8obnyMWmddjZ7xl3ozMlTzQ/7YGsV:+r7rT1MbQ9yDAD7KjjqkusjmqMhz
TLSH
T16A072929AAA480E5E96A973899678131E5717D100A3253BFCDB0F22EDE3F5B14D3C731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 acfef6f35b3010b2e9505add0df47ed6c5cf312d52acffb467586cf9b521faa7
MD5 061b14ed86a15994f02599acb949bc65
SHA1 db215e881052342c082079f6e35984aae75130e5
SHA512 e5d6dfa5decf7d5e803b2a46417974bdc8e5c7c92a7cb95f1ab1243c22bb1cc013624fbf32b4a7254291cb804a74767506092b3406a51615ece5bb1d93bc9d9c
TLSH
T18201D67094A5E883FA33299FDB198BC64CF83A97AC9C5E04134442187B94C26CE250E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 813fcfda955016347fcce2d6a950aef4b4d4ff0b7a257461d967245b8bb37ddc
MD5 e52a93054a743486c4f6946df77f4eab
SHA1 5e3cdb3bbc2ca956db0c7885c16bf133ab1a6fdd
SHA512 83f568aafe24f0e693708faf657338689c1d03a42cbb43e42c40fdb4683c45d8fb98d7cd4698732a8c9470d1c34e6927a3db11139cf89270d661e570acc8a043
TLSH
T17F11C671A4A5E897FA3369CBDF19DBD24CF83B97AC9C5E00124982087BD5C32CD194E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1564-33-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2744-6-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/4100-77-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/4100-96-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/4372-58-0x0000000005960000-0x0000000005961000-memory.dmp

Download

memory/4912-79-0x0000000000780000-0x00000000007A1000-memory.dmp

Download