b97e6a60ad93019e4644feee950ec2bd5601631ebe83c8e7e9c4d541beb5522e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe
Size 1.4MB
Sample260826-xtf89seh99
SHA256 b97e6a60ad93019e4644feee950ec2bd5601631ebe83c8e7e9c4d541beb5522e
MD5 83e0e3a31c5ea7de51408304556866a2
SHA1 3132171b7a0d9e161956c3e6f061f1205d4dd4ea
SHA512 15b75d33e3d5433bc82f49920e4ae9189d2a56ab94bd1063fb2089493ab5bc97f852787fb235aa6ceb6e281fd0902d1efe13a4d13f20eec363b5a7d5ee339b39
SSDEEP 24576:m9+EM0q9+EM0JExqatgl8bl9+EM0v959+EM0q9+EM0JExqatgl8bl9+EM0v9LAhb:U+ES+EWqatglu+E7T+ES+EWqatglu+EO
TLSH
T1F4650945FA4280B2D41A0171488B92BF4B70B915CA139E9BE3489FEEFFF37D06A25574
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2672	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
2612	svchost_CCCBBCBCAABAABAACABCAAABCBAAACAABAABBCBACAAACBCCCABBCBB.exe
4548	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBBCBBACBCBBCAABCBACCACCCACBACCACCAACBBCCCBBCACCCACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe"	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCABABBACACBBABABCBBACACCBCBABABCABCBCCCCCCABBBBAACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBCBCAABAABAACABCAAABCBAAACAABAABBCBACAAACBCCCABBCBB.exe"	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4552	sc.exe
4780	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6080	cmd.exe
2944	cmd.exe
3972	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBBCBCAABAABAACABCAAABCBAAACAABAABBCBACAAACBCCCABBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
692	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe
692	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe
692	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe
692	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe
2672	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
2672	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
2672	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
2672	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	2672	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 6080	692	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe	95
PID 6080 wrote to memory of 2424	6080	cmd.exe	97
PID 2672 wrote to memory of 1108	2672	svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe	100
PID 692 wrote to memory of 2944	692	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe	102
PID 2944 wrote to memory of 4552	2944	cmd.exe	104
PID 692 wrote to memory of 3972	692	2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe	106
PID 3972 wrote to memory of 4780	3972	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_83e0e3a31c5ea7de51408304556866a2_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBAAABACACCBAAACCACABCCCCAACCABACCCACBAACABCBBAACCCBCCABCBBACBCCCABCCBCAACBBCBACBAAAACCBCABABBCCCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBAAABACACCBAAACCACABCCCCAACCABACCCACBAACABCBBAACCCBCCABCBBACBCCCABCCBCAACBBCBACBAAAACCBCABABBCCCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBABCBBBBBCBABCBCAACABCBCBBABCABCBBBAACAABCBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe" start= auto displayName= "UserDataSvc_BCBCBABCBBBBBCBABCBCAACABCBCBBABCABCBBBAACAABCBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBABCBBBBBCBABCBCAACABCBCBBABCABCBBBAACAABCBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe" start= auto displayName= "UserDataSvc_BCBCBABCBBBBBCBABCBCAACABCBCBBABCABCBBBAACAABCBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBABCBBBBBCBABCBCAACABCBCBBABCABCBBBAACAABCBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBABCBBBBBCBABCBCAACABCBCBBABCABCBBBAACAABCBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCBCAABAABAACABCAAABCBAAACAABAABBCBACAAACBCCCABBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCBCAABAABAACABCAAABCBAAACAABAABBCBACAAACBCCCABBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
1⤵
- Executes dropped EXE
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 4.4MB
SHA256 9cfdf920dc5990f143edf89b0e73764105b08ebe02d9cf461c68f88fd528315d
MD5 875a5ee8c6fdf7e22a94716234609df5
SHA1 9e878d1f7a54e770493d18f41c499ed33441d8a7
SHA512 1ac3a5b1aeae0a873a742973a492f1cf78e64fac2ba1debb34b8b7db808791a1739c4029dcd6bcf4614bd6fab14bacbeae9ca51f0cdb23e89d939515661f8c5c
SSDEEP 49152:U+ES+EWqatglu+E7T+ES+EWqatglu+E7L9+ES+EWqatglu+E7T+ES+EWqatglu+g:yb9fb9fb9D
TLSH
T1AD262A45FA4280B2D41A0171488B92BF4B70B915CA139E9BE3489FEEFFF37D06A25574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 8.6MB
SHA256 4fa0e30a5429ba4327576961fc3054d61e81c3cedd974d471d814b1dadec6f97
MD5 0d8762f583586ff0b2177b1cd9866130
SHA1 f75f18b193c9dbe821744ca21947f868f36755f6
SHA512 b8abe6129a7bd3bf65a7af7bff6b9c930113d7827944b67dc2f03b02a44cdd29a661119b4d921415bf1532985eeb69d7899292cd79da42e23d6d3eb12b9a6242
SSDEEP 49152:U+ES+EWqatglu+E7T+ES+EWqatglu+E7L9+ES+EWqatglu+E7T+ES+EWqatglu+F:yb9fb9fb9fb9fb9fb9c
TLSH
T1FD961945FA4280B2D41A0171488B92BF4B70B915CA139E9BE3489FEEFFF37D06A25574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 832KB
SHA256 85a4cf32e95e3f986fa4b2ec6b75f369dcd3992161d70dd2fc143530a7b159b7
MD5 33ad32a4b6dbafa4e0a9656948a75bca
SHA1 dc8f1393519623417224541efeaa267ef49cf290
SHA512 5f432fac787de40b6be85fe874d375b947dec424ee8ae572949b731fa80f3043274a3ac769916e8441a5e3526880f1fcb23dd7970f405fd0648b476d75e1d8f1
SSDEEP 24576:m9+EM0q9+EM0JExqatgl8bl9+EM0v959+EM0q9+EM0JER:U+ES+EWqatglu+E7T+ES+EI
TLSH
T11A054B45F94380B2D82B017148CBD3BF4A70BE218F129AEBF749936FAA337D06635655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 11.3MB
SHA256 48de3741a6d73ee3422fb2d34975ab5ca8580acbdc272486b500e5afeef7dd01
MD5 6f9def20fd3ac59bd74b858cadc06e63
SHA1 12225cb391b1c2f6651bcde670bf40ed9643105d
SHA512 a230c61a2a53fb8a46c37542d7431973f51ed87cbb5f7c32bacfa69cc52f095b0d88dc94ff98e8cd85322355bc11093c2df39aa4344c5253f6537d81df4e1017
SSDEEP 49152:U+ES+EWqatglu+E7T+ES+EWqatglu+E7L9+ES+EWqatglu+E7T+ES+EWqatglu+U:yb9fb9fb9fb9fb9fb9fb9fb93
TLSH
T150C61945FA4280B2D41A0171488B92BF4B70B915CA139E9BE3489FEEFFF37D06A25574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 12.7MB
SHA256 4cf2b06a7689ccc79a0d139a9f36571372a15adc8c50e8166ce81f65f3a6559a
MD5 4a7f19b1794355a80c74be07e8fc2b6f
SHA1 5e4dc6bb774cd779c455fe41f70a0d9a86250212
SHA512 df825cafdd545eff867b6963f81a1fdfb5efa6dfa4ce11fe310e1c9d68d6ea76aa5941fde155d436701efe5e2a8053cd75690aa321429e08319ad99bf7b28ee3
SSDEEP 49152:U+ES+EWqatglu+E7T+ES+EWqatglu+E7L9+ES+EWqatglu+E7T+ES+EWqatglu+I:yb9fb9fb9fb9fb9fb9fb9fb9fb9z
TLSH
T1F7D61945FA4280B2D41A0171488B92BF4B70B915CA139E9BE3489FEEFFF37D06A25574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac25620b8ef2b36118a7b911f68fae1d413d4d0aecbf53a95ee96e860dd1ef75
MD5 7b4010b56f3dd747acc977d7e5930a34
SHA1 6bd0897558499354455d85d39c9946fa41359a2a
SHA512 13ad1acbcb46f87d88156b05913ca3dfc658c454e7b9eceb92779d82fe6e679518c9c43ad792cf37fdcdde49708e6b026a15b5daf61659e09bbe99246d7d66a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa9cdc9379d9cb056326cf7bd8ecbd042fa774a1048ef55d0e09d8ac726816b0
MD5 14be8cf9e2d9397573e8746718f9a5d2
SHA1 8212b04ac64983a08e14e0cc75a68138aae1af99
SHA512 be1ac4e7e9d6f4e248203dcb20b1c3bb793c39118880e0bb9ab5138b10debaa6106f9d33a07b9a272c9bedbdd15327c035fd029ec9b3f33a1d13ced878f4dd67
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8ea2cc50b631618623c8e1217562935dfea2bd239ea77cc1c57c6dec69f13c72
MD5 85ecee12d63846b5c586fe725c6322df
SHA1 290ea17c667c339eb86f7854e6a9696c60885843
SHA512 0838fbd368572fdfeae0934d0322b6fbe13287917b062e715f939f90929e0bbb222d60be1c0376ff1fed7ae2ce3ebd0926241a92f43550d58d6729fc19d80712
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d372f63dfbfe59c35b63e0830013c6293b9e7e8be83884879fc2d7ec719e0bb5
MD5 0404564d822e64121be0b0e5f5e8f683
SHA1 fb9529df5029686f6c392019e6041d6c996bfb74
SHA512 8b6920be350748d7d9762d0c875b95698c6c02e886acfcb78eaccdc0d751485e2c60d42fb1c1d43606f037fbc571b349de93c85abbb47a7ce5fab520dc6b6a8b
MD5 SHA1 SHA512

Submit Download

svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBACBABCBAAAACBCCABBBACCACCABAABCBBABAACCCBBBBCBCAA.exe
Size 1.4MB
SHA256 b97e6a60ad93019e4644feee950ec2bd5601631ebe83c8e7e9c4d541beb5522e
MD5 83e0e3a31c5ea7de51408304556866a2
SHA1 3132171b7a0d9e161956c3e6f061f1205d4dd4ea
SHA512 15b75d33e3d5433bc82f49920e4ae9189d2a56ab94bd1063fb2089493ab5bc97f852787fb235aa6ceb6e281fd0902d1efe13a4d13f20eec363b5a7d5ee339b39
SSDEEP 24576:m9+EM0q9+EM0JExqatgl8bl9+EM0v959+EM0q9+EM0JExqatgl8bl9+EM0v9LAhb:U+ES+EWqatglu+E7T+ES+EWqatglu+EO
TLSH
T1F4650945FA4280B2D41A0171488B92BF4B70B915CA139E9BE3489FEEFFF37D06A25574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-35-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/692-61-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/692-0-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/692-23-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/692-12-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/2672-49-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/2672-34-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/2672-71-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download