1df36d3903e0d3ad75903cb34ca91e388ff40e1a26144f5d85ee0eee46528389

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 51.1MB
Sample260810-e8vfbsvzht
SHA256 1df36d3903e0d3ad75903cb34ca91e388ff40e1a26144f5d85ee0eee46528389
MD5 7cb4a2d6ba5051002a79e71686f8e535
SHA1 3dfb179e9b121920815d1474fa0bff2c7c078ad9
SHA512 abf7426b41d8d11af43cb05719dd2d6012fb247157679870680cabaf964e0c89dfcacf908b9a721880ecd271229b2c95e6d24c085489b5462282f5682526e21c
SSDEEP 786432:iSvQHrK5/f4uUCSvQHrK5/f4uUCSvQHrK5/f4uUv:iSvQHW2wSvQHW2wSvQHW2p
TLSH
T147C7AE13B35681E6C42AE2B88A474322D7B97C440334A7DB26D5B7692F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2988	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
1528	svchost_BCCABABBCACACBAABBCCAACBCACAAABBAABABBCABAAAACABACCCBAB.exe
4812	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABABACACBCCBBCCBBAABCBCCBBACACACCBBCBCCABAABBAACABCCACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe"	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAAAACCABCAAABCAACCAACBAAAACCCBCCACACBBCAACCACCCAAABABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABABBCACACBAABBCCAACBCACAAABBAABABBCABAAAACABACCCBAB.exe"	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4364	sc.exe
1964	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1312	cmd.exe
2096	cmd.exe
4720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABABBCACACBAABBCCAACBCACAAABBAABABBCABAAAACABACCCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4072	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4072	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4072	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4072	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2988	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
2988	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
2988	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
2988	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
1528	svchost_BCCABABBCACACBAABBCCAACBCACAAABBAABABBCABAAAACABACCCBAB.exe
1528	svchost_BCCABABBCACACBAABBCCAACBCACAAABBAABABBCABAAAACABACCCBAB.exe
4812	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
4812	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	2988	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
Token: SeDebugPrivilege	1528	svchost_BCCABABBCACACBAABBCCAACBCACAAABBAABABBCABAAAACABACCCBAB.exe
Token: SeDebugPrivilege	4812	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
792	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4720	4072	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	108
PID 4720 wrote to memory of 2540	4720	cmd.exe	110
PID 2988 wrote to memory of 4884	2988	svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe	112
PID 4884 wrote to memory of 3296	4884	notepad.exe	113
PID 4072 wrote to memory of 1312	4072	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	121
PID 1312 wrote to memory of 4364	1312	cmd.exe	123
PID 4072 wrote to memory of 2096	4072	2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	124
PID 2096 wrote to memory of 1964	2096	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7cb4a2d6ba5051002a79e71686f8e535_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBAABABBABACAABCCABCCABCCCCCAACBABABCCBBAABCBAABCABABCBBBBABBACCCCACCBACABBCAABBACBABCABACABCCAACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBAABABBABACAABCCABCCABCCCCCAACBABABCCBBAABCBAABCABABCBBBBABBACCCCACCBACABBCAABBACBABCABACABCCAACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAAAABCAACCAACCCACBACCABAACACCABAACABCCBCBCABACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe" start= auto displayName= "UserDataSvc_BBBAAAABCAACCAACCCACBACCABAACACCABAACABCCBCBCABACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBAAAABCAACCAACCCACBACCABAACACCABAACABCCBCBCABACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe" start= auto displayName= "UserDataSvc_BBBAAAABCAACCAACCCACBACCABAACACCABAACABCCBCBCABACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAAAABCAACCAACCCACBACCABAACACCABAACABCCBCBCABACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBAAAABCAACCAACCCACBACCABAACACCABAACABCCBCBCABACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABABBCACACBAABBCCAACBCACAAABBAABABBCABAAAACABACCCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABABBCACACBAABBCCAACBCACAAABBAABABBCABAAAACABACCCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAACBCAAAACAABCABCACBBBBABCBBBACBCABBBAAACACABAACC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f1756de3bd7f924fbfc2b51aa079b57144b03f4ab2138bdc4b8a8212c607fdd3
MD5 207a02dc6386e592280c61b5e7c4091e
SHA1 b03ec98da9bba530f2acf243e0466132b0d9117e
SHA512 d9d8c7cfb8e5563efbc5a90abec9effdc66c52c557afaae9d8b14516d2b93415fa6019e1bc53c03e72810b4eaf26323f935e8e3fcbaafd9efc3ecdf8996db9cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b3adbcbd69efe54ac98b600201ce7b20ae425ffce63c18b9e3da48d55a83c04a
MD5 3ceb498f9f196a3420448a2dee75b957
SHA1 6da72d1b58af5fdd9201c94ce36b3af2421fca17
SHA512 7198217de5e75606e1ac84c6753158db6c8a8f92aeb6d1ba1c982f5d0ccf137e48860c352e552877b2b786d0bc1e141d00ff7c87e5ff5a95ab3d65a12cfaa501
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fbae1c44bf962edab5b24199e908ecc2dd1ae38abf39f7242c77b830fd7f6c1
MD5 9cc0c96282383b552fd78432d233dadc
SHA1 46b23dff10a4d5f9770b24e7c9a38801d24ff8a3
SHA512 2b61df407ff6c5cc1366787805b3b0148d914fd0076d337bcaf945ffd91e695f02157c13bb5690c9df71172411b74611aa524efa93c9c4576d501e8a53bb0771
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8245fe3f9471ac4ef8cd4b2da4d4a12abca5521dda1e542caaf1200b22a0fa3
MD5 e94b7067b89134883e7889cfa9d28d76
SHA1 942f8054b1e49a5d53a8a97d42e92d14ddc095fd
SHA512 f699ab52c7b3dcb9edd4280a699e4486598e4107efe6f34e60369cf5bb19f3bb174c7422b1269d58bf2d4e1f13e130b003aa7cbfa89d1412353369c6d62a844a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 40f219ab1430f4ad0e273f6987805ff97239f7fe1fea2077d676eee8f18072dc
MD5 f690486b1f0a9cd6c396bef67c54d7e7
SHA1 61c51a12a5654b259002fe8553bcae7ef01a9e4e
SHA512 aef61420c4b248d49ae07b520578b80ebec0c094d771c5b0df2ac09980f4c1c10fa94e336679d08506280db5b1811edf14479873c9391c001ad77b0598c06bce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3665d4800808c53cb5ad39698bb6fe6de858142a76137bee5da153dd694d2af8
MD5 90847d81ed5e8c999878b10e3520938b
SHA1 6f090314c56c04c14fa9dab5a05fb8cf7b05ed89
SHA512 569485388274e5c41a4d5685c6625e73ba896b1ad2d18365c7f08ab79f1eb2b4f61be5a4e4c0e03179f28f10d51efc44220d18fc4dfb1a0e9531999bf5fa6fca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 00eba4de841ebc83c0de128ec0c267c239d8cc51261100393aeccd3fa542224d
MD5 42953532cf9e1801d6b600b161bdfe18
SHA1 49766e9bc46549c3c2c9facad356d03b1686d11d
SHA512 170668ab9e72cb3f114e9ef374b6642ed42528b674f36ae2730d7db748d8a2513079f8f61afc1eea471a3394a7058530ae85ecc4ace90d6efd8f6a7f81395d67
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5b336183da8b25b4cb1523ab1a67bd3031300231858540c246619076caaa1af5
MD5 8af319fdd0917cbf06e74456c35ea9b9
SHA1 8e2061ff2687df06aacbce2e9fbe263a67cdf196
SHA512 3d8140274596a427b0542dad18ce7ef6bb7af65b72a83821dc478b74d76617770b85cae17c4c7fc03c31a8a016d1f9239769f107feefeaf0ac9c8733dcfe7fc3
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 fdf21025bee6fe4fd02b4eb7c0c0afb20243cd5df370bb9dbd3f73d3c7e365dd
MD5 b8dbb0c92217d9e3c92070503fad1e88
SHA1 1c80bdfb3a77f76d14e72b5e3afe742c25e91aed
SHA512 4c56064fb2e5a25e2649520bda584512a8d6665f3fb14f3a905686089446b0731b7a9684af43b982bcd703789f5c20554cedaf39d613e7a97cba4306b4032760
TLSH
T196112B21A8EAD823FA332DCB461B4B730CE837DB799CBA1013058709AFD4D31CD954A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 970B
SHA256 0e83dd3f9843bffb170ed99ccb2b5c45eb8f29958ef06b0f3b5240a148d9229f
MD5 25c6c7aded174410acb430caf60e7955
SHA1 7de6cc458a5c1bed97e83f69a23e9841b7beded7
SHA512 1e29e6952f5e35e62a15a4f0d791855caea188daf99696edef27ee3f2a4f4a35fcfd8a15f2cbffec4817a58da5df4838af45f5624239af309fec822b3ea1468d
TLSH
T1A2113B616CE9C823FA332C9B461A4B730CE837DB789CAA1013058709AFD0D31CE954A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1528-82-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/2988-37-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/4072-0-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4072-8-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4884-60-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download