mofksys | b056abb3d6d8eda914270ead2e94e085ab842a0f792b4924b9fe8679c5ff3063

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
Size 8.3MB
Sample260826-hdzcksca72
SHA256 b056abb3d6d8eda914270ead2e94e085ab842a0f792b4924b9fe8679c5ff3063
MD5 d9f3a3c903b728b51cc43044b653326f
SHA1 6eda9443f875e27e308cd7cd4ff6b233a940e681
SHA512 a953052f75855952b393023733ee6b04cdd4a7238343309ed8d3b54ede355917ed7eb3cd93836d4e5b87d76038b6ce820088de4002826c43a181050105ab0f14
SSDEEP 196608:WmsYvBD91pTdjhGHbHtDrcjdcqWz0kCJGotn0/OULy47TakAwn2bJvv4JxAFQ02:WmsYvN91pTY
TLSH
T199962902B380E437D1190AB0493AD7B97735FE251B228A0B6EE42E1F3E757907D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery mofksys persistence worm

Malware Config

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys

Detects Mofksys worm 12 IoCs

resource	yara_rule
behavioral2/memory/1000-0-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x001b00000001c511-13.dat	family_mofksys
behavioral2/files/0x000e00000001c552-19.dat	family_mofksys
behavioral2/files/0x000e00000001c554-32.dat	family_mofksys
behavioral2/files/0x000e00000001c556-41.dat	family_mofksys
behavioral2/memory/3376-49-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/4668-52-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/1000-54-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x000e00000001c559-55.dat	family_mofksys
behavioral2/memory/3732-53-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/1092-56-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/960-57-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
1136	2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
3732	icsys.icn.exe
1092	explorer.exe
4668	spoolsv.exe
960	svchost.exe
3376	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3732	icsys.icn.exe
3732	icsys.icn.exe
1092	explorer.exe
1092	explorer.exe
1092	explorer.exe
1092	explorer.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
960	svchost.exe
960	svchost.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
960	svchost.exe
1092	explorer.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
960	svchost.exe
1092	explorer.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
960	svchost.exe
1092	explorer.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
1092	explorer.exe
960	svchost.exe
1092	explorer.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
960	svchost.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
960	svchost.exe
1092	explorer.exe
1092	explorer.exe
960	svchost.exe
960	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1092	explorer.exe
960	svchost.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1000	2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
1000	2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
3732	icsys.icn.exe
3732	icsys.icn.exe
1092	explorer.exe
1092	explorer.exe
4668	spoolsv.exe
4668	spoolsv.exe
960	svchost.exe
960	svchost.exe
3376	spoolsv.exe
3376	spoolsv.exe
1092	explorer.exe
1092	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1136	1000	2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe	89
PID 1000 wrote to memory of 3732	1000	2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe	90
PID 3732 wrote to memory of 1092	3732	icsys.icn.exe	91
PID 1092 wrote to memory of 4668	1092	explorer.exe	92
PID 4668 wrote to memory of 960	4668	spoolsv.exe	93
PID 960 wrote to memory of 3376	960	svchost.exe	94
PID 960 wrote to memory of 5020	960	svchost.exe	95
PID 960 wrote to memory of 3580	960	svchost.exe	100
PID 960 wrote to memory of 5420	960	svchost.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000
- \??\c:\users\admin\appdata\local\temp\2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
  c:\users\admin\appdata\local\temp\2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3732
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4668
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:960
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3376
      - C:\Windows\SysWOW64\at.exe
        
        at 07:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
      - C:\Windows\SysWOW64\at.exe
        
        at 07:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
      - C:\Windows\SysWOW64\at.exe
        
        at 07:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-25_d9f3a3c903b728b51cc43044b653326f_darkgate_elex_gcleaner_glassworm_wannacry.exe
Size 8.1MB
SHA256 6c91bfd1dd3d2c37c7fc34a097fd636bf70bfadd438357738f73c14b2448e707
MD5 b0b2d505acbeddc39caeba9fca5c9dec
SHA1 a9253e6b9e06fd00bdc13bd836d79a2982b1b4bc
SHA512 eb3700d8c5d5b9b37a0773a64294c99f448750f14202a2db0a4cf469033c347b3560700fc5936f82d580fb332fa08d29fc6ee0f5416b678268e6c145b007da17
SSDEEP 196608:ysYvBD91pTdjhGHbHtDrcjdcqWz0kCJGotn0/OULy47TakAwn2bJvv4JxAFQ0:ysYvN91pT
TLSH
T18A861802B380E437C1190AB4493AD7B97775FE251B22860B6EE42E1F3E757907D2AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 207KB
SHA256 41dc93121ce4e43477b0c92c4ec2580a5a8a2dfd6bf39d425fd97cde67a0e067
MD5 b100b2b4dfcdd1cbf75e6705c2e70622
SHA1 bff9e7ba1ffa245aa5e452c6312a80808d7237a9
SHA512 6acf3fa8155fd3e0c1eeae1b16d706fd39d5199d8107d1ff1a685ab85b207922debd5d3cfdb89b59b98504a490cafa899ad08cc9b83bbffa057a4b826a4ed29b
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL:wvEN2U+T6i5LirrllHy4HUcMQY6U
TLSH
T11C242B2BBA41701FE8A699F01832A1E27E252E361BD19C4F2791AF563471523F1F532F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 206KB
SHA256 f880e25d39b830e70ff9382091b5dc506033f00d032683d2abb0f97ce27ea18b
MD5 f9ee4ab6c361c240a99bd638d396137c
SHA1 056acafe173d399d47ce2e11ed18c9eb58f4d0f3
SHA512 7c2a3b120238292da7378aac172077a066b685dc596924b27fab4fb959c4f98b15fe7dd6cffb6e51b5c91b905a8f5d4228fb77199bd963435fcd0c780145c686
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unm:wvEN2U+T6i5LirrllHy4HUcMQY6Z
TLSH
T14424E72BEA50702ED9679AF05866B1A6B6326E210F919C0F63C1BF4634B1913F1F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 206KB
SHA256 b91eb980577cc9b1a72587a9b8816b1ed24dbf7914d82d8489b2d115ff484be9
MD5 c9f7acb1c525bdabab4bc4507cf7992c
SHA1 fedf42a3813d310aa15a8d8dc62dd4f24060f7d5
SHA512 0bd617dbebfbd9cf6e626a22aa2bb7d9d14dfb5b038e1cf7f0015d22f21f896147ae986d2d48061b90ac23d512ef59fa3cad8e0120c5df0cf696f6e565066627
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unU:wvEN2U+T6i5LirrllHy4HUcMQY6N
TLSH
T18F24093BFA00612EE4A3D6F054A666B6F5662D210FD19C0B2381EF967472A13B5F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path \??\c:\windows\system\spoolsv.exe
Size 206KB
SHA256 d0a1493f6895f21d89cc4203405a1f6d1870709d50b8b09f4cdad298a73f1036
MD5 3a199cf1d7c3c569a8c91a4027ce6028
SHA1 14fb0d9258fc185750a6d10d5ce53894401e7b9e
SHA512 ba30ea21eaaf7ff8a22f4c1d154b9cd6ddaef7e82b035a7f85e2686173d71e5cefcf51c1a3aaa5d8870641a236e5797c5539a2b0b1792c83ad145dc5a686ab79
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unn:wvEN2U+T6i5LirrllHy4HUcMQY64
TLSH
T1C924082BBA41711EF467D9F068A2A5B6B56A2D311F819C4B23C1AF093475A03F5F831F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path \??\c:\windows\system\svchost.exe
Size 206KB
SHA256 c641f919b4f7bc28d9d09d4129205cb3fe8b2ea15f460d50663c1a51b63f3b37
MD5 8f49b122dce27bb640c2acc9526f930e
SHA1 858cae2977b28dd030bebc5b3b96ed24dfeeb2fb
SHA512 18986fe41d68e76dae850f0907dcf7bf2eca6a701b6dd25881eb1606a6532a412c4a401f40384d01dc14e19dbd03c3d1183b03de328ba636937282003ac9b522
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un/:wvEN2U+T6i5LirrllHy4HUcMQY6G
TLSH
T16924D93FE941302AE89386F01865A1A6B7716E751BD1AC0B57D0BB5974B2203F2F171F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/960-57-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1000-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1000-54-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1092-56-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1136-10-0x0000000000400000-0x0000000000C69000-memory.dmp

Download

memory/3376-49-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3732-53-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4668-52-0x0000000000400000-0x000000000042F000-memory.dmp

Download