68c335a3eda10f15d890256aed809c79bfeded6da723c57588cc3a5292eb811b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe
Size 8.9MB
Sample260816-e3pb5azcla
SHA256 68c335a3eda10f15d890256aed809c79bfeded6da723c57588cc3a5292eb811b
MD5 60bfcedaddafcbacacb1604669b29c02
SHA1 3b7cc8fe1da43d7b3de3a2bf2164245b35d821a3
SHA512 6092b61cbed9155de47e441ab362b40918fba39e7efb575575c42cfc115b7b63b8666e2aa8f60841f39fde18a13a68b45a1bbebe2bb2ad9b12d28f14e704994b
SSDEEP 49152:U+EPiw2YhO0+EPiw2YhO0+EPiw2YhO0+EPiw2YhO0+EPiw2YhO0+EPiw2YhOFiwF:wjjjjjLjjjjjep7D
TLSH
T15696190973ED0898F5B3A63489B68265DAB3B8615B31C6DF52C0C23D5E73AD4AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2896	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
2544	svchost_BCCBBABAABABAACAABBCCCBAAAACCBBCBCABCCCABBAABCACBBBCBBA.exe
4072	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBABBCCCCBCACAAAAAACBBABCCACCBBCCACABBBAACBCBCBBCBBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBABAABABAACAABBCCCBAAAACCBBCBCABCCCABBAABCACBBBCBBA.exe"	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCABACAABBCACCBBACACBABBBAABCCBBBABBBCACCBCACBCBCBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe"	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2304	sc.exe
4092	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4520	cmd.exe
2064	cmd.exe
1460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBABAABABAACAABBCCCBAAAACCBBCBCABCCCABBAABCACBBBCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4212	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe
4212	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe
4212	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe
4212	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe
2896	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
2896	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
2896	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
2896	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
2544	svchost_BCCBBABAABABAACAABBCCCBAAAACCBBCBCABCCCABBAABCACBBBCBBA.exe
2544	svchost_BCCBBABAABABAACAABBCCCBAAAACCBBCBCABCCCABBAABCACBBBCBBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe
Token: SeDebugPrivilege	2896	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
Token: SeDebugPrivilege	2544	svchost_BCCBBABAABABAACAABBCCCBAAAACCBBCBCABCCCABBAABCACBBBCBBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4904	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4520	4212	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe	101
PID 4520 wrote to memory of 2724	4520	cmd.exe	103
PID 2896 wrote to memory of 4756	2896	svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe	104
PID 4756 wrote to memory of 4540	4756	notepad.exe	105
PID 4212 wrote to memory of 2064	4212	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe	109
PID 2064 wrote to memory of 2304	2064	cmd.exe	111
PID 4212 wrote to memory of 1460	4212	2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe	112
PID 1460 wrote to memory of 4092	1460	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_60bfcedaddafcbacacb1604669b29c02_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCAABAABBABBCABAABACCBCCBBBAACBACBBACAAACCBCABCBABCCBACAACABABBACACBBABACCACCBBCAAABBCCBABACCACCBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCAABAABBABBCABAABACCBCCBBBAACBACBBACAAACCBCABCBABCCBACAACABABBACACBBABACCACCBBCAAABBCCBABACCACCBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBCCCBBBACBBCCBAABCCBCBABBCBACCBBACBCCAABCCCBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe" start= auto displayName= "UserDataSvc_BCBBCCCBBBACBBCCBAABCCBCBABBCBACCBBACBCCAABCCCBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBCCCBBBACBBCCBAABCCBCBABBCBACCBBACBCCAABCCCBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe" start= auto displayName= "UserDataSvc_BCBBCCCBBBACBBCCBAABCCBCBABBCBACCBBACBCCAABCCCBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBCCCBBBACBBCCBAABCCBCBABBCBACCBBACBCCAABCCCBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBCCCBBBACBBCCBAABCCBCBABBCBACCBBACBCCAABCCCBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABAABABAACAABBCCCBAAAACCBBCBCABCCCABBAABCACBBBCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABAABABAACAABBCCCBAAAACCBBCBCABCCCABBAABCACBBBCBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
1⤵
- Executes dropped EXE
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d7ee1f459d8952f0da4019e08659f49e5b4dbaaf983aa7fea166a3269759a505
MD5 f84a90c22cb609158849bd6f99efc381
SHA1 b234cc5d28568a9388fdc910e9eb50b8144caa08
SHA512 d2eb6ddc9cd21f835ee05f110c5be7b6c569582309812fa80c3032099bd2c81c3bbe4a2dab4ac99a2e58f5d86e4937b47cff8fab9b75c234abd9d0af5c19ca9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31502e6dd0ac120fb650a62203ae7c0e50353ce8809e668d85439ee454a6a43b
MD5 6ea5361b2651f695947e28af246de0c7
SHA1 c4242a4c90ffcf8ea74cede926ad9b23cd6a509c
SHA512 5b4f33c17f097418e51008acfca29512da2493c27b4c28c5a86a959352be9fb1006ff6e97c0a0b344e21f1d01febc47753fe88349ef5f9abc9c5083affd1ce51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d66dd9a3bd646bbbe19c039a065915d3aa14dc9621d36009adc7ee8b7d5c8a68
MD5 2e43b68c3ff5262b517933745b496168
SHA1 26003c2688fc5ceb6225f72abed7bbead92457c0
SHA512 61493fcdbb117f00736073c391515a28a98a3ae5dba195a94f2a4fbcdba64d4725c7401dca42fa04cf8a8d0c9a5fbeda2d2761d8dc54d908449a74d63ad38fc0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96556f03128d0724578ac43060f8759701bea65b1aa32a1f1aa85f742b90f04f
MD5 922cf8385a5170136863260176c75927
SHA1 8f3e37b15159aa1de5a6dac8ab033208706baa68
SHA512 4f41f345b90382afcbd499e27402adcd3c124c171d50b81a1e514cdd1c412f6563d8b520f5bda83d5b62205dfd52cb5f97b14ae43a71a36713463bfe5e5c7f5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6f9c05f6d5c13ac866def255f3675e93ce163220a6ce991bbdd82efeec38f58
MD5 86b22a61a89a9d5bbca91b7768b6d391
SHA1 5ee82b5d5374d6ff220de44af9848fe8cc954966
SHA512 8cd9febd417716844aa834f5b383c2aa25244852398f8c01e3cc7245853dd944804fa2a981a9a3ecb038a766c21fbf31eb17d237aa510c71af4dc4772c4b6793
MD5 SHA1 SHA512

Submit Download

GrantRegister.exe

Path C:\Users\Admin\Downloads\GrantRegister.exe
Size 3.0MB
SHA256 4490f5fcc10cfb185ccc24d36a5ae5e162f4ccd57dc7d777518e9cd7164ed526
MD5 86a84d1b1f466240b955d5a63fba0118
SHA1 5bdf40f6f0e26fb7c48a9c6ff86ca631fbd894a8
SHA512 c01bb816b6ace8131e5ef4b7352d6f7a9e21d8004f510c71957394f655c74f7be05e7b2ab43d5aacb8533cbf41f8f38540c0996d45ccaf3e3b43e4ba48587e6c
SSDEEP 49152:U+EPiw2YhO0+EPiw2YhO0+EPiw2YhO0+EPiw2YhO0+EPiw2a:wjjjz
TLSH
T14FE5180977FD0898F5B3A23489B68265DAB3B8615B31C6DF5290C23D5E33AD4AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrantRegister.exe

Path C:\Users\Admin\Downloads\GrantRegister.exe
Size 54.1MB
SHA256 33a24eea40446698f3e5f14db5239602e33ceeb1032967b991688a0da88bf6c2
MD5 9a31aac53a9b173e20a89e2fb476e854
SHA1 c414c10c8104e82484116b5d070d334d1c7e8a68
SHA512 71c54460b08b64a1003de618f03adcdb341ad59cefafeb497009c39a3f549b47fbffdb00a738f748b41866d304d07efe3bf498417a2574e703494422a686f137
SSDEEP 98304:wjjjjjLjjjjjep7MjjjjjLjjjjjep7MjjjjjLjjjjjep7MjjjjjLjjjjjep7MjjO:frrrrrCQP
TLSH
T15CC7290973ED0898F5B3A63489B68265DAB3B8615B31C6DF52C0C23D5E73AD4AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a781f0fb1bbd39696f3bab725c956841e18405ec1219652a37e9bd1e28e672bb
MD5 4a756d001353e5164fb6d9fd2f047855
SHA1 2ca0f2f59aa065855a27965bcb3e5e041fb08611
SHA512 ab7cf1aacfd436274a010896903ba2f5c854f7ca5008fd51498c8d940cb9423d4bcdfa3ba96f6a64a882df55522bd1320933e60e2fbdea44b8e1fbe21ca57737
MD5 SHA1 SHA512

Submit Download

svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCBAABBBAAAABBABBCCCBCAAABACBBBBABCBBCABBCABBBBCAB.exe
Size 8.9MB
SHA256 68c335a3eda10f15d890256aed809c79bfeded6da723c57588cc3a5292eb811b
MD5 60bfcedaddafcbacacb1604669b29c02
SHA1 3b7cc8fe1da43d7b3de3a2bf2164245b35d821a3
SHA512 6092b61cbed9155de47e441ab362b40918fba39e7efb575575c42cfc115b7b63b8666e2aa8f60841f39fde18a13a68b45a1bbebe2bb2ad9b12d28f14e704994b
SSDEEP 49152:U+EPiw2YhO0+EPiw2YhO0+EPiw2YhO0+EPiw2YhO0+EPiw2YhO0+EPiw2YhOFiwF:wjjjjjLjjjjjep7D
TLSH
T15696190973ED0898F5B3A63489B68265DAB3B8615B31C6DF52C0C23D5E73AD4AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 076645acf5f328731bd18ff9defc6f0715a08737325ac4ed3996e885f92e066c
MD5 fcfeaee58ebe6232810b5290bee42a75
SHA1 e2e8921dbbd4057639b92d036b7cd76579ccdaf8
SHA512 140364c4c3ca3425b90a7badc92aae4855bd07d2eb2ee474838d90e354eb01d2eb0b763a2d9f8e66cf7401849c0876161299c2fbceda0f2f5034b57fd4bbd6fe
TLSH
T1E2014520DCA5D857EB3368DB932ECEE30CF67787789CAA042305410CE785D218D550E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2544-93-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2896-51-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/2896-75-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/2896-116-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/4212-76-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4212-0-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4212-12-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4212-52-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4212-25-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4756-78-0x0000000005490000-0x0000000005491000-memory.dmp

Download