87a8461f665adf050cf22831e7caf6715a07333a26a76270038d946feffaf6fc

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe
Size 16.3MB
Sample260818-d7mtesdn9x
SHA256 87a8461f665adf050cf22831e7caf6715a07333a26a76270038d946feffaf6fc
MD5 1b6000c2697dd63cf8b90ffffcf537e8
SHA1 407ae4ad5511f3fd73a9e54ada15fb3b8b37a3e2
SHA512 854f5734b5a958edaf963d4c79b1a156e1432e8d225faf99f01500f347dcbfbf694e01937409e2740519287aada0f2c2b00371cd032f02de45a8f2046333aa9d
SSDEEP 98304:/Y0W1PszJY0W1PszJY0W1PszJY0W1PszJY0W1PszJY0W1PszJY0W1PszJY0W1Psd:Qxsmxsmxsmxsmxsmxsmxsmxsd
TLSH
T17F077E02FA8740B2E527117148AB93BB4E71BA114F318A9FE34C966F9F33BD06635356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4560	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
1120	svchost_CBACBABCCBACBCBBCBCAAABABBBABBACABACACABBBCCAABABCBACCC.exe
3364	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBBCBCCBBCAABAABAABBCCCCABCBBCCCBCBBABCBACBAABCCBCAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe"	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCAAAACBCACCAAABBBAACBCCBBABABCBACCBABCCCCCABBBCCCAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACBABCCBACBCBBCBCAAABABBBABBACABACACABBBCCAABABCBACCC.exe"	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3484	sc.exe
4608	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4944	cmd.exe
1396	cmd.exe
4092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBABCCBACBCBBCBCAAABABBBABBACABACACABBBCCAABABCBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3236	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe
3236	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe
3236	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe
3236	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe
4560	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
4560	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
4560	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
4560	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
1120	svchost_CBACBABCCBACBCBBCBCAAABABBBABBACABACACABBBCCAABABCBACCC.exe
1120	svchost_CBACBABCCBACBCBBCBCAAABABBBABBACABACACABBBCCAABABCBACCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4560	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
Token: SeDebugPrivilege	1120	svchost_CBACBABCCBACBCBBCBCAAABABBBABBACABACACABBBCCAABABCBACCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4092	3236	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe	95
PID 4092 wrote to memory of 5652	4092	cmd.exe	97
PID 4560 wrote to memory of 2464	4560	svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe	99
PID 3236 wrote to memory of 4944	3236	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe	102
PID 4944 wrote to memory of 4608	4944	cmd.exe	104
PID 3236 wrote to memory of 1396	3236	2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe	105
PID 1396 wrote to memory of 3484	1396	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_1b6000c2697dd63cf8b90ffffcf537e8_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACCBBACAAACCBAACBBCAACABCACBCBBCBBCCAAABCAABCCBCAABBCACACCCAACBBBCCABCBCCCACCCBBBCCCABBACACBACBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACCBBACAAACCBAACBBCAACABCACBCBBCBBCCAAABCAABCCBCAABBCACACCCAACBBBCCABCBCCCACCCBBBCCCABBACACBACBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABBAACACBCBCCBABCCAACACBCCCAABACCACBCBCACBBBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe" start= auto displayName= "UserDataSvc_AAABBAACACBCBCCBABCCAACACBCCCAABACCACBCBCACBBBCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABBAACACBCBCCBABCCAACACBCCCAABACCACBCBCACBBBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe" start= auto displayName= "UserDataSvc_AAABBAACACBCBCCBABCCAACACBCCCAABACCACBCBCACBBBCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABBAACACBCBCCBABCCAACACBCCCAABACCACBCBCACBBBCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABBAACACBCBCCBABCCAACACBCCCAABACCACBCBCACBBBCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABCCBACBCBBCBCAAABABBBABBACABACACABBBCCAABABCBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABCCBACBCBBCBCAAABABBBABBACABACACABBBCCAABABCBACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
1⤵
- Executes dropped EXE
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallPublish.exe

Path C:\Users\Admin\Desktop\InstallPublish.exe
Size 1.9MB
SHA256 9633494d8c23cc40a2404650c52b5948fa0d403581314a361b26bcef532cf8fa
MD5 1382193bde359bd3d6299e351af26c55
SHA1 22ddfdb3774f19d5f6740eb5329d3cae77352846
SHA512 03ad40672f6424b84d141c230705a6320c58e288aa450afbc3dc437fe4c9bd998e4a32a0e96c8fa54883a95c57bf35bb681288305cc8f5f68a625abe1f161710
SSDEEP 49152:U+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglnW1PszNsQ3:/Y0W1Pszz
TLSH
T16C957D45FA4384B2D92B1171089BD3BF4A70BA114F129ADBF78C872F6E33BD06635259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1bec0fd1f01652a5be4e2e8d5a208c91f4cbc759dfb131dc31e85b633db81ca
MD5 c7cc5bb32dd48ea7ab20a0d09197f2ac
SHA1 5fc89b64d3781f03ee9b866aedd55b90480f7028
SHA512 feb6f2cf0cacaa409643f40efacc4ae577788dacd1867ced0c7f75437e598587ce4964fcd78c87e5db1882532cb366e10d654365fbc5257f63631c0690226391
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e483ee3bf7d036db7bc770bdd4fd1a424bfeaba020bf9c742d1308e0bab6fb9b
MD5 27405c57d49ff39e30e27f305ed5ff30
SHA1 b05dd39fd277caaa353a9b315074fc28786c1f70
SHA512 b1c9b1a5ac8527a4284c56d4492b03b85a02cb564f166e9ae9ebaa671cb4622e5507fe798003b10caf2d7316269157b6d2913e4b590d7612044133594fd54a0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5dffacc144c230526a57c1cc744f7c921df5cd052ca97e0c0ced933bcbecdaa2
MD5 45d42b04d1da2c5ada7d57365248de7c
SHA1 97e56f355ec062c58d3332cd8c3a23d68e3ec01d
SHA512 2ff5ad5b62a5a90c29c8a0aa4b012024cbd32c91bb41a4701bf52c9d897d32cb62bfb7794dfee8779b9c8f4039b443ac29074ab1149f1cdb58d1a9a5f6734e4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7080bd0edab9014f0fc2a48f63efa0651b750640ea8e129c648e7d8b58eb9776
MD5 9beb8417bf12d07a350247b9c1724676
SHA1 63503a1974556c37009163b6618d8c3117b3edf5
SHA512 d995630f244f2fc484c8de309d8373be84c8ca378f8c70984de5a0ff9c92aeca6e3e3097b9afd728caae85e655d660c04242f380b5f12175eebdaf3771c532ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 81874e5420c05a413ee311d06514cd64fc9fc3e46027ade5a6ec704871dddec6
MD5 eb2cde693b56c757cb291c1c2f366f0e
SHA1 316297356e6333857a0c670c1001adfb0f568d5e
SHA512 f2078592098f80ace46fd6452c1758e57892cbdc606fcffb6af1604d12c0634fbc60d43829e267da151415cef9ae80e3760fa1e00cb55329c9c1e85db7b57efd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47fd48cfad69d31bb853d1ff820631f4a07bb20f8ebdf4dc6c2f1cdd304fc5b7
MD5 bf0643fd9b78f261603a1cf39efb2212
SHA1 a28e990a6a440b862a2561b29af9b77b33295f35
SHA512 bd9104b885189a4202dfa26766df42b1567b4da175b331488835b80c66d43d6987faad9631f3f4e86902bc06795fcc75aa633a2804da95fea3493520309dcec1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d10c99a9c326848d575f3282f4d478ea2e674b101304af2ec673224b4aad72de
MD5 bdeb9f32feeca93679f64f69a597a09a
SHA1 f3fe080643ecf5ad479d585db2a64a4b172571f7
SHA512 8414baf111e7ec99cf17687472cb12e1a38e8de5f6a09ef06280aa909e5b7790c425de3047585b9f53451df2ef371408fb1769b7ac0c8e5c6ca8e012598e11ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e207808863c901ed1f617ee3a3a7a2dbf178066f041abd5cc3426b23ce78bd9b
MD5 f5de3079a1f06c7b787024759bcc0d21
SHA1 85749f5cd33068d0b0f26ffac4a53065ae973949
SHA512 c7085f335d241209ad827583853910175608741d0885b3a3f113e46d89e6bd84d0239c83f86b5d1b024c614fbbe5e6e6025e14e654eea423b783bcae67ab1ecd
MD5 SHA1 SHA512

Submit Download

svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABBCCCABCBCACACBACCAAABABBACBACCBBCCAAABABCBBACCBC.exe
Size 16.3MB
SHA256 87a8461f665adf050cf22831e7caf6715a07333a26a76270038d946feffaf6fc
MD5 1b6000c2697dd63cf8b90ffffcf537e8
SHA1 407ae4ad5511f3fd73a9e54ada15fb3b8b37a3e2
SHA512 854f5734b5a958edaf963d4c79b1a156e1432e8d225faf99f01500f347dcbfbf694e01937409e2740519287aada0f2c2b00371cd032f02de45a8f2046333aa9d
SSDEEP 98304:/Y0W1PszJY0W1PszJY0W1PszJY0W1PszJY0W1PszJY0W1PszJY0W1PszJY0W1Psd:Qxsmxsmxsmxsmxsmxsmxsmxsd
TLSH
T17F077E02FA8740B2E527117148AB93BB4E71BA114F318A9FE34C966F9F33BD06635356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6c364a3cd860e0d02d08a017de24af6b3acad8e821ce008d8958052d2174fe44
MD5 07b6156af3ada56a62704d87abe4194c
SHA1 a7def389dfa08871c06ed8dc3a0d6f7afe2b17bd
SHA512 b3114f1e0bd1d1a46831c42737cb9efceb26f0681428c9cced361088cb01ca8a4aa87d16d4c0623c6ac559b0fed4c049e3e3c6338c4874c1d0f99ee1377925cc
TLSH
T19F112721F4F6DCA3FC3164CB5219CBC21C9832AF189C6A98131AC61CBF95C39CD294D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1120-93-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/3236-0-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3236-70-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3236-48-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3236-12-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3236-23-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3236-108-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4560-66-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4560-71-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4560-49-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4560-45-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download