a00ff776cadafdc8857a9a0bcdfbd48768ea54323f26aa1f93c36d02c4dbdb62

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Size 10.9MB
Sample260810-cfat4shk21
SHA256 a00ff776cadafdc8857a9a0bcdfbd48768ea54323f26aa1f93c36d02c4dbdb62
MD5 bcb086875dc18a880355e34e538502aa
SHA1 b268311f305c50ad0d90b0e6a6aef9b3a0257f57
SHA512 eaf1635965d7abc5a98bbad95af2e44d982918aa9089f3b92a105ecc5bbd23f325efbb89f9442603d363d6ec53df3f81970e33e62146bd6749b641fdfa23406d
SSDEEP 98304:T7pW7pW7pW7p27pW7pW7pW7pv1MbQ9yDAD7KjjqkusjmqMhz:m1tIDewjqkjiqMl
TLSH
T1E1B65C25BBF881F4F5B79A38AE778271EA727D614C32930F46D0C60E5E326519D28732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4020	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
944	svchost_BBBABBCCBAABBBABBABCABCCABAABCBBBACAABBBBCCABBBAACBBCCB.exe
5108	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCCAACCCBBBBABACACBCCACACABABBCCBAABBABCAACBBBAABCABAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe"	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BACACACCCCCBABBAACAACCACABCBCBCBABCCBBACBCCBBAAACCBABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBABBCCBAABBBABBABCABCCABAABCBBBACAABBBBCCABBBAACBBCCB.exe"	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2992	sc.exe
4352	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2604	cmd.exe
4184	cmd.exe
4628	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBABBCCBAABBBABBABCABCCABAABCBBBACAABBBBCCABBBAACBBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4320	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
4320	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
4320	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
4320	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
4020	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
4020	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
4020	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
4020	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
944	svchost_BBBABBCCBAABBBABBABCABCCABAABCBBBACAABBBBCCABBBAACBBCCB.exe
944	svchost_BBBABBCCBAABBBABBABCABCCABAABCBBBACAABBBBCCABBBAACBBCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	4020	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
Token: SeDebugPrivilege	944	svchost_BBBABBCCBAABBBABBABCABCCABAABCBBBACAABBBBCCABBBAACBBCCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 2604	4320	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	97
PID 2604 wrote to memory of 4488	2604	cmd.exe	99
PID 4020 wrote to memory of 2288	4020	svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe	100
PID 2288 wrote to memory of 740	2288	notepad.exe	101
PID 4320 wrote to memory of 4184	4320	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	105
PID 4184 wrote to memory of 2992	4184	cmd.exe	107
PID 4320 wrote to memory of 4628	4320	2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	108
PID 4628 wrote to memory of 4352	4628	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bcb086875dc18a880355e34e538502aa_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCAAAACBACCBCBCABAACBCBBCAACBAAACBCCACAACBBCCBBBABABBCAAACBABBCCAABCCACBBACCBAABAABBAAACBACAAACCACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCAAAACBACCBCBCABAACBCBBCAACBAAACBCCACAACBBCCBBBABABBCAAACBABBCCAABCCACBBACCBAABAABBAAACBACAAACCACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCCCBABACCAACCABBBABACCBBBBBCABABBBBBBBCAABBCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe" start= auto displayName= "UserDataSvc_BCBCCCBABACCAACCABBBABACCBBBBBCABABBBBBBBCAABBCBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCCCBABACCAACCABBBABACCBBBBBCABABBBBBBBCAABBCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe" start= auto displayName= "UserDataSvc_BCBCCCBABACCAACCABBBABACCBBBBBCABABBBBBBBCAABBCBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCCCBABACCAACCABBBABACCBBBBBCABABBBBBBBCAABBCBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCCCBABACCAACCABBBABACCBBBBBCABABBBBBBBCAABBCBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3096

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBCCBAABBBABBABCABCCABAABCBBBACAABBBBCCABBBAACBBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBCCBAABBBABBABCABCCABAABCBBBACAABBBBCCABBBAACBBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
1⤵
- Executes dropped EXE
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 00e53e41b8c28697753806397df75486776fd0d5dcc22207b5ca603fecae9c08
MD5 3345580bab942cbd29d2274af2549d09
SHA1 c61faeb5a2c8734bc211ee38769f8ca74aa75c57
SHA512 d18d559f9cd54c5612a466000d7f824e39cdfe9297ee01cbb65d843ca88bf0dd6c65cfe351c01f562f57dea04d6f82150748ff1a5e1d856625196cf2b2b499f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 429835feb359ffcf6759a824a3850061142fa3a2e618fde6c05f8927a4f8f50d
MD5 921a39c7010ec7498526c8dd15b72928
SHA1 b6b3cfe5e81716b7b19d9895640b7ae8ba27d8ff
SHA512 4874f60f3ba2df2e48d779aaa74801b85631da3e944dc573fe5b95730ab29d465dc06932d3bcf2740e74c7bfbc50f9246a4aea34f610970d34b6582699e74785
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07036a88d22cc37e70f0ca82b41b414418d415c61d68efa872758f02cbfc6a51
MD5 61f3e6fd6b0b8ec92b805b088cd8b7cb
SHA1 8346f9fae3768ae2c5639bb5f2d762699ec427b5
SHA512 55042ad6df2a041b9ab88a3ca48ecf9aa6098d90e392657b0472d32602019f193af73d0dd19449b5c104a83a7949dab6f9d3839b9f4814a82cfdf491455a6880
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 03055d0dbb8046924eef9caf06b1aefc289024642f4ebcf94a367dd88c2fc552
MD5 aed982ae7662fa53ce5973883e2b732e
SHA1 ce934ffb35e4dd1da1b12148d244d4a23d087d34
SHA512 c50e3c71f080e302f46f295276919499c322cbcd817b38de18b03e87f453ecb2d92df9984f61c55fab1b729111638e7722570a5a28d5316d916ba046b263ae2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c84dcf320c3f6318ced0f807df6996401ed30d2cc480ff924600f07d99f3de85
MD5 d3d5892979cbb7c3e5b4583cdd8a07a6
SHA1 0c1e9a1f248c79ddcd189fca13b48ce76756c1c4
SHA512 ddd6e1403661a79a7de542b3447151edf192fb422a24df39fc882caa4ccbffd29468df03449bf5cbd67d09160ad75f325130fa011d7505304fe50d859c2718c7
MD5 SHA1 SHA512

Submit Download

UpdateRequest.exe

Path C:\Users\Admin\Downloads\UpdateRequest.exe
Size 768KB
SHA256 b492b75e2f96caa7cd9d3fa8fa3c064f96c5a497173fe9a50922e1e18bc0da8e
MD5 67eab6b1e7869439ac1c39ac62bd150f
SHA1 2ceb88865edc3ace8abbb65bffecf4703b3def6a
SHA512 265d2f3dba66dedcfff6f4d01d3dba26ad5c52bd46494281e26940a38be954c41f91454d2a3546477f8870114e722757d416dbdc16b57230798bb1000b581769
SSDEEP 12288:mgUFgEsnojAwg49H61RgsNtbAdYgUFgEsnojAwg49H6K:m9+EM0249H67pbr9+EM0249H6K
TLSH
T109F44C02F7E99070F5B317309EBAA2759ABABD72DD35CA1F63C84A0D1970940E534B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 da23f3133d766f33cf0bf1a9c0ba1d620a52bfe8a7f9cb98e7c57250537c8c75
MD5 c7abd0519c35d487ee2287b48d4cd178
SHA1 6c9368bbee4d32cc0e64fa63e1dec5e5facb7755
SHA512 77e624302d6fdfcca33030ac00161061f7f842dfc13ec9fcc2657cd2c5e54020fbafa414879ac90cf020a5de99fa968d163eefc7fe72cc85105abee40418a41f
MD5 SHA1 SHA512

Submit Download

svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCACBCABACCBCCABABBCCCBBBBCBCBABCBBCAACACCAAAABBAAAC.exe
Size 10.9MB
SHA256 a00ff776cadafdc8857a9a0bcdfbd48768ea54323f26aa1f93c36d02c4dbdb62
MD5 bcb086875dc18a880355e34e538502aa
SHA1 b268311f305c50ad0d90b0e6a6aef9b3a0257f57
SHA512 eaf1635965d7abc5a98bbad95af2e44d982918aa9089f3b92a105ecc5bbd23f325efbb89f9442603d363d6ec53df3f81970e33e62146bd6749b641fdfa23406d
SSDEEP 98304:T7pW7pW7pW7p27pW7pW7pW7pv1MbQ9yDAD7KjjqkusjmqMhz:m1tIDewjqkjiqMl
TLSH
T1E1B65C25BBF881F4F5B79A38AE778271EA727D614C32930F46D0C60E5E326519D28732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 795fa954706fc112be1e510e7e3a0cf2a8a2ddebe45b470152a4cb6203faa324
MD5 27767440163bfecf7c7d75595f510fba
SHA1 40b40eb118d95b9b5c621f22d694788ea5afc289
SHA512 755b94e1577aed9e3e549e8dd5062d59003cbab5d41e6141da765769269997903ea8cee6680515cfe7f9a40e0d32a625f4159af988f6093cd5fde4c47e536d32
TLSH
T1B111C455C4B9D893E832A4CA562DDBE308D837D77C5C6E9413498118EFD9C31CD590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/944-93-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/2288-79-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Download

memory/4020-102-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4020-51-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4020-75-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4320-52-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4320-76-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4320-0-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4320-25-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4320-12-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download