cf3a3cbac3212ae614b8494c346510eb2a2c8a0a1a94c8dceca6fd9b3cd1ede1

Analysis

max time kernel
151s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe
Size 58.9MB
Sample260808-v7ge3sv1fx
SHA256 cf3a3cbac3212ae614b8494c346510eb2a2c8a0a1a94c8dceca6fd9b3cd1ede1
MD5 887c31c311736deb9ba206864ac85731
SHA1 e3cd2e805ac86303cc4ec09627a35e45d94da6c6
SHA512 5d30889cc6332f2cfa117a91a4b70011149e290a9d08755ccebe0734520c687a9a7cd24b547f55416360023dc62bb5d753650eef0cd36b2d7b930bf47c6adf11
SSDEEP 1572864:i3333333T3333333i3333333T3333333+:i3333333T3333333i3333333T333333O
TLSH
T16BD7E146FC8650B0DD7A64704CEBE23B4836BE3BC0258A99F9CA7B067B37E61540F456
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2500	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
1660	svchost_AABBCABCBBABCBBABAACBBBBBCABCBCABABBBCAAAAAAAABCCCBCAAC.exe
2812	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBCABAABCACACCCAAACACACBCBBABBBAABAACBBBBBCBAACBBCAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe"	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCCBBBACCACABAACCCABBCAACABCCCCCBCCABBCBABAAABABCACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCABCBBABCBBABAACBBBBBCABCBCABABBBCAAAAAAAABCCCBCAAC.exe"	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2268	sc.exe
4044	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1972	cmd.exe
5672	cmd.exe
3760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCABCBBABCBBABAACBBBBBCABCBCABABBBCAAAAAAAABCCCBCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2332	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe
2332	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe
2332	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe
2332	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe
2500	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
2500	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
2500	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
2500	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
1660	svchost_AABBCABCBBABCBBABAACBBBBBCABCBCABABBBCAAAAAAAABCCCBCAAC.exe
1660	svchost_AABBCABCBBABCBBABAACBBBBBCABCBCABABBBCAAAAAAAABCCCBCAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe
Token: SeDebugPrivilege	2500	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
Token: SeDebugPrivilege	1660	svchost_AABBCABCBBABCBBABAACBBBBBCABCBCABABBBCAAAAAAAABCCCBCAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1972	2332	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe	95
PID 1972 wrote to memory of 5208	1972	cmd.exe	97
PID 2500 wrote to memory of 4344	2500	svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe	99
PID 2332 wrote to memory of 5672	2332	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe	103
PID 5672 wrote to memory of 2268	5672	cmd.exe	105
PID 2332 wrote to memory of 3760	2332	2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe	106
PID 3760 wrote to memory of 4044	3760	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_887c31c311736deb9ba206864ac85731_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACBACCBAABBCBACBCBAABACAAAABBABCBBAABCCACCCABCCCCCBBAAACCCABABACACCBACCCCCCCBAAACCBBACBCACCCBABAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACBACCBAABBCBACBCBAABACAAAABBABCBBAABCCACCCABCCCCCBBAAACCCABABACACCBACCCCCCCBAAACCBBACBCACCCBABAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACCCBBBABBBBAABABBACACBCACAAABACBABAAAABCCBBACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe" start= auto displayName= "UserDataSvc_AACACCCBBBABBBBAABABBACACBCACAAABACBABAAAABCCBBACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACACCCBBBABBBBAABABBACACBCACAAABACBABAAAABCCBBACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe" start= auto displayName= "UserDataSvc_AACACCCBBBABBBBAABABBACACBCACAAABACBABAAAABCCBBACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACCCBBBABBBBAABABBACACBCACAAABACBABAAAABCCBBACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACACCCBBBABBBBAABABBACACBCACAAABACBABAAAABCCBBACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCABCBBABCBBABAACBBBBBCABCBCABABBBCAAAAAAAABCCCBCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCABCBBABCBBABAACBBBBBCABCBCABABBBCAAAAAAAABCCCBCAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCAACCACAABAAABABCCAABBCCAACCBCCABCCABBACBAABCCCBA.exe
1⤵
- Executes dropped EXE
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af313a780cfbe3c0efd3e9914ad7bf6950953b8febc7b6f6ed2d66833225224a
MD5 c97eda92f17cf9ebfa09fe2b22696442
SHA1 0582cf1029840ebf3b493fbd7741fe3366370e40
SHA512 3780e897c39c4e6fe44468471575bee80cc2e1ceabe7aa55d7f4a0fac2e1047d163ff45c3fe0924f581a3b1c317f79dd8b815a11d8faa9a5a6c3fd2998d61a0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 de43e76ca3cbdad0c43ddef1e5b12be712dd7cdd614f550e6327e6e4a251978c
MD5 0b90be5e7f464346008e18f685f20c91
SHA1 b6669a64b85d08a3147bd8bebe36ff35bf688306
SHA512 a860181c1b3408c45fec37681c412c479d45f36b3e1494f5bef0c4414699e53b06e7f7d5457c59b8a432f1b00b3cd6c3b323d81100ee6aa91adda13668127d23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a98c42809c6c076bf48535634c9f7bdc0bb0b813aaff18393cb1122c9292c192
MD5 5b3c3cbf1ffb24d48b16313e098fa45f
SHA1 d1ee2823b3d93eeebf4d1d242c2a949e3ba80399
SHA512 f05fc3ad68d986fc2feee409647bfe3222a4fdb0459c33e34c29b99508ca53599fce512db31f39334b13f140aaa103f0b3c48505c66f86cefdfa67ee3b762297
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8bc936812af72bbdc9ade891bc59a8eaab4c1ea0955f0cd96f28e58f7be8f865
MD5 352d01b147170c02e5f6ff46a696f284
SHA1 c2ef3084656dec77f384a2812500e71026bd79a1
SHA512 4935b0a975319708114f1d3165e4d1680fb5b73a32a6b724307208b9bd458808550ccf5caf472a50cffb7387e3e774e3ce988ef4bb0511eb3c7ed6c437f4778b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0b8a6c7bfa234f09c7768e79c74dd5403c3c0355e9df35f864a520197ae9acd9
MD5 40deeb0e119691943ca3990f6ac6c569
SHA1 34f47b57e1bce4d6edb723ac5be0044320eb6f9c
SHA512 15f7b9c4112a617a71645db2fae9193ea06b3bc4e664c9d38a141bf0c3b264c9b25877a205d9fdc8a1bda7de6d90aca37712c37aa298f2b00b661f9715c784c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db4d440d5cd0340deb2a83c00a6854c1a85aeef1ea7acad355d9c88504de93a5
MD5 d8c5b786df9d3c6d59bb7cf92dc2f3e5
SHA1 97db2943cc4bcf34e3aa23c73975b87d9a049540
SHA512 b254641f28c941b1ae1e91aae8515fbe80e90d6fd6f43959f8c4fc7a4c6f971e9e63dbac747f5592914aebebd1067ee2692974981cd0dbc936d693dc2137cc70
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79fc5979639ddf78edcae0b41f4eed76cf1834126e37d2c8b629b6ed1ddb425f
MD5 f7d96f6566af280e5f24f5c18ca25870
SHA1 28728af8ce33ca918b0dd8ded1fb91ca30dab8c6
SHA512 f48d4adccc00e24bfc4772b8d33ed82e6351cd5a7d757ff8fd944e2ee54f2ac573164714d792b89cd2997bbdd290d6e8647d2a4e450f6ef51b2f5841f24cc474
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a3ea77f556b269a2fc3d261e05da8e3048b95fb4bbc2ea43c161c84122440bbf
MD5 ac3cb64e23607f0476b3dba461c17cf8
SHA1 b9208ad2f244a5c6a06fcfd7323ec11f028f1ce7
SHA512 bab3317b33c0fa011709fbcf03960ac794bc2039d6bd1660a8733a8e99d7bc60e5e6bc4898368f6345ad49d39c2c2ae4a43775399f557bed4c539b672992c679
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 71bab1107aa1a7b0803ca1fbf4120106e0b8ebe3500e582b19b5c33baa11c90a
MD5 22fd267ecb485ffc623be6e854971ea1
SHA1 40344cc5dc124e5cab08b6ce95e5b8a467ce0bfa
SHA512 9dcd12d140691a2e4462bc3a405b0575e4495d4ad3cfbfcf3fac94c9e2c9db46b02b42e3e344cb81b694c7048198fe7f9b56156b73c6191bfdf61fb3c6302e86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 714939ce746481ca5695ea7552009e9614fe0f0eb356c3d7458489df4689315b
MD5 88f9e68e3c4594afbfa6a8e09ba390ee
SHA1 98b78e7f4391e90da0b1d8ac6f9c63804fd00434
SHA512 39c75cb103daed0e3c3dbc533ca7bcf3a7549f05cdba54a30ddd84653368bd68bc50c0e2a4ff00ced1e5616ddaa2af1f95b1fbd803075202960a5eede997c9e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d1e3bb135ccecaa91c561aeeef4ed663ebf0aedc9391b5d62febade3766280ed
MD5 5aa02b92c1385d9e632e9aafb0ded2a5
SHA1 491b4a0be3759c3878a6ba13b12734c10798af26
SHA512 1000ff937f12f1761fbc69c9d6aedfa2ed16405a075a3fc845db8718817c3b3cadcb44f1d0741e4c72604ab827cc395777bf8e3510a568f21ba687b095cdfb3a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 680b31a6e127d85385d352e4930f7dc4e1cca8999b570ec5b3d7ae612ffcc240
MD5 c1c646d6eff042f0db9a3c7d3f787bca
SHA1 39a95d0e3a314de0d0361e24bf172fe56046fbb1
SHA512 ec3b1239f36b7eff6db458733384217eac12a4dac9ce334ef2ab43052d1bdec740a8ff9f35f91ababa699ea1e1a4ca5d9f078d0fbbf09dc99cde23c96290724b
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c9792496a5e9063bf8b870756c945aaf809fe0b744698e7c1d995742304d82ef
MD5 a623ed30a283c9f975ad71bca7e82213
SHA1 275ed2287e8473acb6303980049c09d495f0536d
SHA512 68e4531e54e1e53a0f89fc0aa157e751ae042dbdb95b4e8c798ce6dbf7e38a01ac5ec0f5ce28e80fab0133b162c6acfe371944b6c6469bdfe29bc054d57d4c5b
TLSH
T109112C71F4A9D463FC33789F4725E8D31CD836A7AC58AA3A6349412DABC5C30DD298D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1660-107-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/2332-63-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/2332-89-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/2332-0-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/2332-30-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/2332-16-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/2500-54-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/2500-90-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/2500-79-0x0000000000750000-0x0000000000771000-memory.dmp

Download