b1ef073a51f7132c61a2a32c4d4dd946dd54bb1bc95ff515ab92dd055100d1a9

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe
Size 625KB
Sample260815-cbc4nswhkf
SHA256 b1ef073a51f7132c61a2a32c4d4dd946dd54bb1bc95ff515ab92dd055100d1a9
MD5 10e39bf390947ebf24a37e8ab9681bd2
SHA1 c3ea0e537adf861aef6d74bc69093185418664ac
SHA512 89798435116c268e980d4e51bfac59a904f28d1b713eca887c17fe5ea2183eebb4dd87167b6a2e214a1171f93269128d3d321bd5c139e7d449ac20ca8083bd39
SSDEEP 12288:mgUFgEsnojAugUFgEsnojA4zLenAstkJ1kwWOmv2:m9+EM0p9+EM0venbtkJxdmv2
TLSH
T198D41811EBD88773E0B36270C9B682B59A327D599931CA4F7258BA0E3F376509CF4721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 6 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001bc5a-19.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ce-27.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001bc5a-43.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001bc5a-58.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001bc5a-70.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001bc5a-79.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4416	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
4884	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
4668	svchost_ACACABCACAACBBAAABBCBAAACBCCABBCACCBCAAABBAABABBBAABAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACAACBCCBCBCCBACBACAABACCACBBBAACABCCCBBCBCACBABBBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe"	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBAABABAAACCCCABABBAACCCBCCBABCABBBBCBACCBBACBBBAACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACABCACAACBBAAABBCBAAACBCCABBCACCBCAAABBAABABBBAABAAA.exe"	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4612	sc.exe
5732	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2396	cmd.exe
1420	cmd.exe
2392	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACABCACAACBBAAABBCBAAACBCCABBCACCBCAAABBAABABBBAABAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1804	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe
1804	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe
1804	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe
1804	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe
4416	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
4416	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
4416	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
4416	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4416	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1420	1804	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe	92
PID 1420 wrote to memory of 4704	1420	cmd.exe	94
PID 4416 wrote to memory of 2748	4416	svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe	95
PID 1804 wrote to memory of 2392	1804	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe	96
PID 2392 wrote to memory of 4612	2392	cmd.exe	98
PID 1804 wrote to memory of 2396	1804	2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe	99
PID 2396 wrote to memory of 5732	2396	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_10e39bf390947ebf24a37e8ab9681bd2_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCAABBBAABACACABBBBCAABACACBBCAACAABBCAABCCBCABCBACBABBBBCACACABABAACABCABCBCACCBCCBAABCBBBCAABCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCAABBBAABACACABBBBCAABACACBBCAACAABBCAABCCBCABCBACBABBBBCACACABABAACABCABCBCACCBCCBAABCBBBCAABCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABABCACACABBBACBCCBCAABABCCCAACCAACBCCAABCABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe" start= auto displayName= "UserDataSvc_CCAABABCACACABBBACBCCBCAABABCCCAACCAACBCCAABCABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABABCACACABBBACBCCBCAABABCCCAACCAACBCCAABCABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe" start= auto displayName= "UserDataSvc_CCAABABCACACABBBACBCCBCAABABCCCAACCAACBCCAABCABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABABCACACABBBACBCCBCAABABCCCAACCAACBCCAABCABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABABCACACABBBACBCCBCAABABCCCAACCAACBCCAABCABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
1⤵
- Executes dropped EXE
PID:4884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCACAACBBAAABBCBAAACBCCABBCACCBCAAABBAABABBBAABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABCACAACBBAAABBCBAAACBCCABBCACCBCAAABBAABABBBAABAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5871a2b946c97f382214702406602d80704e7d15a56928e9822129343fc5715
MD5 0d5e776e286026f81c88137be634a81a
SHA1 243a0480b99bdf3749d8296b03b5afa2a3500058
SHA512 78394e92aefd760f90f79b2cbf899d3c21ceb4d01a355ffd92d54e33a8b65223832d3a7a2d5e6bcd49cba148e4432a1f176fb9d95f957b2d41ca37ef2c30cacf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dedf3b22dadfdc0f52b1b68a5918d4c372ebf479fc9b0778d208f0ac0c098846
MD5 9b0852c53f2eb2f846b3fe3efb74393a
SHA1 51c2353090f9fd684ba58388d3e28381d2371eff
SHA512 5483872d106a450ab498a567f637faac647cb3fb542c898d6dccf26da7cbc573dbca931a461c556f46eae79c19cebf52b824086596eaf534edf3821cc07af84c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c66bb5a6455c016da3f6c043f53982d16897deba236d2fb1b56ac2fd04e8231
MD5 6bc68a17e7feb79e459f2889abde5cf5
SHA1 ec4fce49e8742163826806fc07eab5793ac993a0
SHA512 0773582a9892fbb969829da89a6aa73a8580012aff43f4624f06cd702fd0d6cb7c45ad8ec3baa322ad4863cfd80d56135833ffd0d382ff337521672d5873d77e
MD5 SHA1 SHA512

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 2.4MB
SHA256 f299a3514e554b3bed62e06917bcfe9cb9ae8b4dd507e8f2b1b50e4aae96e6c0
MD5 acfe6a15fb35d1d8520b7190965cda81
SHA1 de1440eb4d3620116ae0f813ddb80b9677a0203d
SHA512 f21e9e3375bc821b4af939502d8e672545f41ba0bc60d9e3d6b3efa9382910ca14b35189d0fb7c77cbfb98432785a69a5f9ff1f863b441538c91a6df99cb7d28
SSDEEP 49152:U+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYdmPHNKvlNecHeBo9:22cyo9
TLSH
T12BC55B11EBD88773E0B36270C9B682B59A327D599931CA4F7258BA0E3F376509CF4721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 4.3MB
SHA256 d687e3f4df590cf51f5f1d96ee3b1dcec077da77f0f0708b515e40ae8bd367b4
MD5 71f4724291b477e0a2b6b347c9373c1c
SHA1 967faddb2d39cf3defba85c56bb91f428b2f7885
SHA512 fa9a2b49b6de8edaa70422f68dfef27ac6a9c9466111ede60efc296a2c1c45126c71067989784df1e29890414be2b509d9e944fff24ac427f46682c6a5982c0e
SSDEEP 49152:U+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYa:P2cyoL
TLSH
T107263A11EBD88773E0B36270C9B682B59A327D599931CA4F7258BA0E3F376509CF4721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 4.9MB
SHA256 5bf60eb2c758cde371f9be595c2e9548617e13cbf6275da03a92dd069cab786f
MD5 d09e8aad323fe1975171a7820b000eae
SHA1 21f08473f4e1e32d3d4bf083422961a4e344173a
SHA512 f8a8d3a485f6b58bf5834de0751941ae1e2d3a15c96bf650bfa6b62a0086d12597fe0a1e28c96dfd7da2a9212dd32daa3157e55480f32a2acbcc2c212c6f9031
SSDEEP 49152:U+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYs:W2cyo4
TLSH
T1BF363911EBD88773E0B36270C9B682B59A327D599931CA4F7258BA0E3F376509CF4721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 5.5MB
SHA256 ff27941bce82bcd892ee052b2ca1005c7d9ec3f753eea3a483f25e77a55051e0
MD5 250fa0bb13d8571b0cc211c532b10ecb
SHA1 fe562a86984e529733084028491858d5e18c8ed1
SHA512 ff6fc7345ad98742211c7864d13078e4b1a91edbf40caedd90938e6cc603c0435860dc3b5649d7419658080e7873510897dbe07c2e586d38fcb473ecc63fdc60
SSDEEP 49152:U+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYj:f2cyoG
TLSH
T135463911EBD88773E0B36270C9B682B59A327D599931CA4F7258BA0E3F376509CF4721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 6.1MB
SHA256 85ca567a0008df5d34ebba104c5399cda4758176730ec5ea23b473f26844eaae
MD5 38b1cf937f973f303f536610e94173e6
SHA1 e404ee7a65c8bc0eb54f7320bdc330a68e123b04
SHA512 8e1ba424a980c9dfaf50318281750970db5be9a092cf420629a964726b734036dc942f41983f9c04d92624d552b782a48627c71ff72dd138220b525ea78ca8e9
SSDEEP 49152:U+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYdm1+EN+ExenbYO:m2cyoy
TLSH
T123563911EBD88773E0B36270C9B682B59A327D599931CA4F7258BA0E3F376509CF4721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 58716fcb0b3901016c0f3f88e98d7af5c0037ba75ef846be54929e1f919daf14
MD5 cca56b97d584706bf99bf6299ff0823c
SHA1 937615d5af68600c59cfae67d0ab60cc1da88911
SHA512 bbc8b0816091b2d13ec0b6f9aeacdb6323dc4eaf0117e0eb0891fa14ad5d3bd1362199bdd2dd12f7155b0242a6ed81d2d395e1ae88c2a4821157aae82ca5d8d2
MD5 SHA1 SHA512

Submit Download

svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBACBCBABAABCAAAACBBBCBCBAABBCBCCCBBCBBCCCACCACBACBA.exe
Size 625KB
SHA256 b1ef073a51f7132c61a2a32c4d4dd946dd54bb1bc95ff515ab92dd055100d1a9
MD5 10e39bf390947ebf24a37e8ab9681bd2
SHA1 c3ea0e537adf861aef6d74bc69093185418664ac
SHA512 89798435116c268e980d4e51bfac59a904f28d1b713eca887c17fe5ea2183eebb4dd87167b6a2e214a1171f93269128d3d321bd5c139e7d449ac20ca8083bd39
SSDEEP 12288:mgUFgEsnojAugUFgEsnojA4zLenAstkJ1kwWOmv2:m9+EM0p9+EM0venbtkJxdmv2
TLSH
T198D41811EBD88773E0B36270C9B682B59A327D599931CA4F7258BA0E3F376509CF4721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1804-35-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/1804-61-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/1804-0-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/1804-22-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/1804-11-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4416-52-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/4416-34-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/4416-73-0x0000000000210000-0x0000000000231000-memory.dmp

Download