c347895d0745fe44189d78ce2e8a95c999cfe8de7b03f0e8b8121119c785891c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 9.3MB
Sample260930-be46wsvgme
SHA256 c347895d0745fe44189d78ce2e8a95c999cfe8de7b03f0e8b8121119c785891c
MD5 531734214c6a687f8347f5c9d8c7eca3
SHA1 23b9bd4b4ec3ffa9b37b8ea6f9e463cedda54d3d
SHA512 2466371ca768255fac88fce0aea9f7f8f68cf1a70096430793820f9bb7a32d8d493cd306c028d306536e2669528de266eb115d4c8d9a6e0c03d4678febdd8e95
SSDEEP 98304:JrprprprprprpryOU/jIEeQfoR/IuOFVjUu5m:tNNNNNNyFIF0wuQ
TLSH
T17BA67C05F98244B1D97701714CDBD2BE8670BA218B228EEBF78D871F6B33B919939711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2948	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
1472	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
2364	svchost_BCBABCACCABBCCBABABABACBBBAACABBABCCAAACABCCCBCACBBBBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCACCBACABCBBBAACBBCACABACACABCBCBCABABBABAABCAAACBCCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe"	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCACCBAABCCCCAAAACBCBCBCCAAAACBBBCBABBACBCCBABCBCBCBCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABCACCABBCCBABABABACBBBAACABBABCCAAACABCCCBCACBBBBAA.exe"	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1424	sc.exe
2128	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4864	cmd.exe
956	cmd.exe
4964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBABCACCABBCCBABABABACBBBAACABBABCCAAACABCCCBCACBBBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4008	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4008	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4008	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4008	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
2948	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
2948	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
2948	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
2948	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
2364	svchost_BCBABCACCABBCCBABABABACBBBAACABBABCCAAACABCCCBCACBBBBAA.exe
2364	svchost_BCBABCACCABBCCBABABABACBBBAACABBABCCAAACABCCCBCACBBBBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeDebugPrivilege	2948	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
Token: SeDebugPrivilege	2364	svchost_BCBABCACCABBCCBABABABACBBBAACABBABCCAAACABCCCBCACBBBBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3504	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 4864	4008	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	108
PID 4864 wrote to memory of 1616	4864	cmd.exe	110
PID 4008 wrote to memory of 956	4008	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	114
PID 4008 wrote to memory of 4964	4008	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	117
PID 4964 wrote to memory of 2128	4964	cmd.exe	119
PID 2948 wrote to memory of 2144	2948	svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe	121
PID 2144 wrote to memory of 2584	2144	notepad.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACAACCACBABBABAACCCCCCACBCCCBBAAACCACACAAACACCCBBCCBCBBACBACBBBBCCBCBAAABCACABACABBCCABCACCCCCBBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACAACCACBABBABAACCCCCCACBCCCBBAAACCACACAAACACCCBBCCBCBBACBACBBBBCCBCBAAABCACABACABBCCABCACCCCCBBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCACBCACBACAABCACAAACACCBBCAABACABBBABCCACCCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe" start= auto displayName= "UserDataSvc_CBACCACBCACBACAABCACAAACACCBBCAABACABBBABCCACCCABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:956
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCACBCACBACAABCACAAACACCBBCAABACABBBABCCACCCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe" start= auto displayName= "UserDataSvc_CBACCACBCACBACAABCACAAACACCBBCAABACABBBABCCACCCABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCACBCACBACAABCACAAACACCBBCAABACABBBABCCACCCABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCACBCACBACAABCACAAACACCBBCAABACABBBABCCACCCABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACCABBCCBABABABACBBBAACABBABCCAAACABCCCBCACBBBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCACCABBCCBABABABACBBBAACABBABCCAAACABCCCBCACBBBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UseOptimize.exe

Path C:\Users\Admin\Desktop\UseOptimize.exe
Size 56.3MB
SHA256 de7cde3dc5be05d816290dc85daa6dcb69da4be6fe0675f87cb6844174487f4f
MD5 bc427f6050488e399afdec322f359fae
SHA1 55574e02fc3d7f49530fcd273eeca2c81aa0cef3
SHA512 b7e9e3dca17a2e17958336260faa037c8589a5385f2221d8b6e2e8c27494b4fa2e55b2ab1064e0feedb01f18db053a566ba25b1627b444e592e35475d0288ac2
SSDEEP 196608:tNNNNNNyFIF0wuENNNNNNyFIF0wuENNNNNNyFIF0wuENNNNNNyFIF0wuENNNNNNw:277777bz
TLSH
T150D77C05F98244B1D97701714CDBD2BE8670BA218B228EEBF78D871F6B33B919939711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f58ec848ba0fc898291ae84a9a2b406ccd75806a7a392898095c16e926ef3c1
MD5 f9e9c30f10e6474da9b370535799d956
SHA1 86dd8b0be75281a7bda1c99934dce46c2ec30ae5
SHA512 5415bc6ff00e4245e444086abc99a12cca1af3b61b0af7049474ef9e7763a5a8e4b79ca2840b2fc552cd9ea9840ff2d0c239b20cef1c156bccfeb451b3446506
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41dea77d8473a09848d486abc0baaac75431d44f3d560cc36749b33d064f17df
MD5 434b847113df370d446d560cc8c2c085
SHA1 a3eb3793d5f942de5f0b0ae2353ac84e0ce822a4
SHA512 09751a84194085f94aa3723b574fae61632c37cf03c0b3079b113c4e602f848cf5558e3649b452f434a2369e3e8f560bb7af850e842e6961a38da8cb488a0235
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7a58c6b16fd5788a1e2f9e1e491bbae112409ba011b0b7786a49df8efd0774c
MD5 eb3d37a24552cdeb11419575ded21a35
SHA1 978d60d2ca0eb7bf1bbeed74af26b6554f4ed70c
SHA512 121a8e7f62f87b5c5ff26286ff2606fe6ecc024dc1e0c46fe25ec9963cc81c75d6bba709a7a2d28392c7405702ca404cdcd3a976baa26fc465a8903bd60b1c3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 093d9635bdfb374ca090b0611f954aa13d1cb79e6db3a091bac0fa5419515839
MD5 9d09f7a5b7918e4e08a5c804453e6014
SHA1 5aa8da8316713a9cdc5fa30a9ea02c6dd001193c
SHA512 6b3ef878090aa5fa6dcc6b1fafc45a9f8b8984f7f88df990c78bb4a4d6e6ad9e347ab224283b47cf8eecdc6217c114696ae4433c95cfda2ad7f2130127180472
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0fab026821fc78205efd7bbbcc5b94697c63b001bcbd26eff321e2e612f8c28f
MD5 3c1524384076315809dc15a25abc6f2c
SHA1 0dc65eb01ccb4ff0962b9f8491e247418ac889ab
SHA512 bcb951f4f5b3235c9a67f7fc2e6fcba308e11c95cd1defa04d9f5544c6691207f51de3a5ed40266234b5b7a1511c8fc07188b69861ce7dedc9de0b88230d0198
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 29ebe9abbb6eb4723433d686b558bb83076fa6bb41e234a622175e80b984d6f7
MD5 16b2b0c47d981be4f4fa4572161514ea
SHA1 3a090568b1fa38afdcdc9765d0f4f31409f34e1c
SHA512 ec76117a11844ed595f12ca94bdb4fafd9d08c86dda57c5162c355257b7d7d49c8a76825349bd888ae8d2cbc935ecf0958f6803f29ee02fe53cb33dd9d9fbe1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 169715eed006fcf96b2962901fceecb6da1e697a013e4c02bc02a3faa2753dc2
MD5 138d4e214850731904d1540ea48da4f3
SHA1 dc2ca6109b5fabb5af3f57b16f0cd7d1ad2cb508
SHA512 b791b3e084e0f0c53c8e748ea7d2d9f34984b974147fe9f0e680d8bae169a3693a36f09e8ecc2d2d9d37774527e5936c62918c067cda45de6e1a06bc97b67ba5
MD5 SHA1 SHA512

Submit Download

svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACACAAACACACBAACBABABCBCACBCBABBCCCBBCACAABCCCABACA.exe
Size 9.3MB
SHA256 c347895d0745fe44189d78ce2e8a95c999cfe8de7b03f0e8b8121119c785891c
MD5 531734214c6a687f8347f5c9d8c7eca3
SHA1 23b9bd4b4ec3ffa9b37b8ea6f9e463cedda54d3d
SHA512 2466371ca768255fac88fce0aea9f7f8f68cf1a70096430793820f9bb7a32d8d493cd306c028d306536e2669528de266eb115d4c8d9a6e0c03d4678febdd8e95
SSDEEP 98304:JrprprprprprpryOU/jIEeQfoR/IuOFVjUu5m:tNNNNNNyFIF0wuQ
TLSH
T17BA67C05F98244B1D97701714CDBD2BE8670BA218B228EEBF78D871F6B33B919939711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 0ff48c6ffe63de15469265af597c0c5fbdeeb8ac785161071c260fbcdfdee2ab
MD5 c97dbd95142f24736111d6c01c985923
SHA1 a70e9aed307b8bc209061dae64180f5cdac5a3c0
SHA512 45eed484c83bd6284f6d7c91d67fde1a1ab32668847f5183195f51b2cee64d2ba8bd271b527acc2d32b3e973d54954e0f3fd125e83de3acffdeaa524b57a37c0
TLSH
T19411C874A165D893E03128C3A52ADBDB5CE4379BB89CAF14235E4119E71CD36CE094D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1472-95-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2144-87-0x0000000005290000-0x0000000005291000-memory.dmp

Download

memory/2364-103-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/2948-53-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2948-76-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2948-35-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2948-118-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4008-62-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/4008-90-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/4008-10-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/4008-36-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/4008-23-0x00000000003F0000-0x0000000000411000-memory.dmp

Download