e061cf1d97675f71f4428a2f1499f494138a5df2d1f2c6cca8e17f5be7479200

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.6MB
Sample260831-et5yhsvbpc
SHA256 e061cf1d97675f71f4428a2f1499f494138a5df2d1f2c6cca8e17f5be7479200
MD5 cd01cc6fe5cf5d963492af77e4c5e0a9
SHA1 1f8f6871b9c7bf8c8b56a0fcdd8df271fe6403f8
SHA512 01e0269e7eb4ab014f2beab03cbc748e3cb095d4983f53d5b61dce78aebec076a4e51896a807175fe37c94da732f35cb0dbcefc1e3d409e2989d33403b8e7aaa
SSDEEP 49152:U+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+EOOU/zXNUfEeXAxhF2rl/Io:xOU/jIEeQfoR/IuOFVjUu5m
TLSH
T135068D01F9C68072E57311704CEBC37E8670BA6586328DEBF78D861F5F31A919936B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4648	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
3088	svchost_ACCBABABCBCACCAACABAACAABCBCAAACBBCAAABABCAACBCBBBCBCCB.exe
4552	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABBBACBABCABCCABAAAABBACACACACBCBCBCCACCBACBCBCCBCCABCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe"	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCABABACCABCCCBBCCCABBBBCBAACBBABACABACACCCCAAACBACBCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBABABCBCACCAACABAACAABCBCAAACBBCAAABABCAACBCBBBCBCCB.exe"	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
944	sc.exe
976	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4124	cmd.exe
2212	cmd.exe
2672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBABABCBCACCAACABAACAABCBCAAACBBCAAABABCAACBCBBBCBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4136	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4136	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4136	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4136	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4648	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
4648	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
4648	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
4648	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
3088	svchost_ACCBABABCBCACCAACABAACAABCBCAAACBBCAAABABCAACBCBBBCBCCB.exe
3088	svchost_ACCBABABCBCACCAACABAACAABCBCAAACBBCAAABABCAACBCBBBCBCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4648	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
Token: SeDebugPrivilege	3088	svchost_ACCBABABCBCACCAACABAACAABCBCAAACBBCAAABABCAACBCBBBCBCCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4032	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4124	4136	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	105
PID 4124 wrote to memory of 2736	4124	cmd.exe	107
PID 4648 wrote to memory of 3184	4648	svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe	108
PID 3184 wrote to memory of 3804	3184	notepad.exe	109
PID 4136 wrote to memory of 2212	4136	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	113
PID 2212 wrote to memory of 944	2212	cmd.exe	115
PID 4136 wrote to memory of 2672	4136	2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	116
PID 2672 wrote to memory of 976	2672	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_cd01cc6fe5cf5d963492af77e4c5e0a9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBABABCAABBCCCBACABBCCBBCAABAABAACAACBCCABCBBBBACBACABCBACABACABBACACABBBCABBABACBAAAABBCCBCCBACCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBABABCAABBCCCBACABBCCBBCAABAABAACAACBCCABCBBBBACBACABCBACABACABBACACABBBCABBABACBAAAABBCCBCCBACCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBCBBACBACABACBBBBABBBABABAAAAABBABCBACACCBCACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe" start= auto displayName= "UserDataSvc_BCBBBCBBACBACABACBBBBABBBABABAAAAABBABCBACACCBCACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBBCBBACBACABACBBBBABBBABABAAAAABBABCBACACCBCACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe" start= auto displayName= "UserDataSvc_BCBBBCBBACBACABACBBBBABBBABABAAAAABBABCBACACCBCACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBCBBACBACABACBBBBABBBABABAAAAABBABCBACACCBCACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBBCBBACBACABACBBBBABBBABABAAAAABBABCBACACCBCACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABABCBCACCAACABAACAABCBCAAACBBCAAABABCAACBCBBBCBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABABCBCACCAACABAACAABCBCAAACBBCAAABABCAACBCBBBCBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
1⤵
- Executes dropped EXE
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c918fd2e1f7c9c45d34d7d8955a99c127f91976d1c3dc2e2e6e0efaf8f43faae
MD5 79b639b01e21ede170f2d99dcbbfe825
SHA1 41dbb3349e57824d225be11f41cb8d8c297a73e5
SHA512 137d87d84ef10218aa0131459b45585f760ee5505d58bcf690e5df7021e617eb0509c3e40b62bb793f047b9fdacf69ef6ee1671bd10d500ea5e05c81f4ff8003
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 452b469bc9270650ea846b609a507e04be282d0f0822e0fc2fd3631a2510b9a7
MD5 27324e5d586eeb36372606326ad376bc
SHA1 884ec262bb3394c89c0eaae7de1496c1bb4b7c3c
SHA512 48fcd83de3b61786ad4811211d4611e25848de72261ac9f4580c74078837f236116df9a7ff641eeabbf248f4484bf79ea874bd522380e329410e5d39f5f6c703
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d6e096c3183e5228b1d49e1b106e3a31c381b0e9a0c7dd3b5c24a1a60fdebe01
MD5 cd4d39d012671d151f97b252f9e651a7
SHA1 56c36e438b782a2cd5af06f251f9d8128fcd2a4f
SHA512 cc0e8f71b0cd054bb5f7c141736afa39419d0a5aba366923301ce56b02c21494b0138fa81e3fc0e7162187d016a399d838880ea410143a92a8bb0595d2925323
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 da65983dbc1fc6f735dc4d875ae78872a58e6c55a80257bbb52a08d86de1b33b
MD5 b99dc195c19e38a822c64a99f56bb48b
SHA1 ddc9a4acbbc91496b17aa84c478b2646e5f936a0
SHA512 ada7e297422a141c852fd78d328831d79c89589f2486c2cc18048aaa1df99a63041d50b1cd3051aa1256ac6e02c5d0d771a5bbfb127db593b02e2355f8af4a83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 339bbf9ec5b3868fc07b83e3f440f767a50e59b0d75189776469d713f282f580
MD5 f4fd85c229c8c6d4c24566bcfd515874
SHA1 be02cd6ab4d4aae0c35775ca5951f40b0019ff0b
SHA512 ed2b3bfe57ab37c43b36341f1d25cb64b7f700e53d2c4c2f368d2417b4cce0ccc54e31c5fdb083d61cf6cd6908be165df9873b895546c6fe1a7d31e7f01d8f78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 59eec58a2fc9107e5215acd4253acd5a6d25b40f95aa59db98fd142e8032eae2
MD5 7345719214e972c4c70c95c8d10b4951
SHA1 bffcfeab2ba0d2a1d77e951e42d297f348acd3bd
SHA512 bab77d624939345265b52e3d8a3120e5fcdd54d1857b36849ce29d536a75afea990d2f4c73e5235902384ce9abd4e318e636c8758957ed6b572a2865430a6554
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7f1fb024c236c380d7f62007f66611a77cff85016cf3016a13902b492e95fabb
MD5 fd1aab68a117e2e96dda4118e7b648bf
SHA1 024a515ce7235db8bffd7ac4baf226b717ca3a83
SHA512 51417622a4a7ebb1784e167ae209968c68b1d00ea1e396ccda69355f03b790d7a44c72616ce6d2f29c8a4a82be92ec459463246e140edf68a4b2142a43ab88e9
MD5 SHA1 SHA512

Submit Download

svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCAAABCBBACCBCABCBAABABBCBBAAAABBCCCCCBBCCBACACCA.exe
Size 3.6MB
SHA256 e061cf1d97675f71f4428a2f1499f494138a5df2d1f2c6cca8e17f5be7479200
MD5 cd01cc6fe5cf5d963492af77e4c5e0a9
SHA1 1f8f6871b9c7bf8c8b56a0fcdd8df271fe6403f8
SHA512 01e0269e7eb4ab014f2beab03cbc748e3cb095d4983f53d5b61dce78aebec076a4e51896a807175fe37c94da732f35cb0dbcefc1e3d409e2989d33403b8e7aaa
SSDEEP 49152:U+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+EOOU/zXNUfEeXAxhF2rl/Io:xOU/jIEeQfoR/IuOFVjUu5m
TLSH
T135068D01F9C68072E57311704CEBC37E8670BA6586328DEBF78D861F5F31A919936B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 20e4bfdb5cb1b33de6c1e6843a1b530c3f0cc9491ec8590b487444e00bf6767c
MD5 e00dcf9a0e079e90ad1d0e1f636a7322
SHA1 941ad4c27ec4e7b400fca696c425e2b67ae07dbe
SHA512 ec121204dd64b6c3bc6cffaa9da3e1016409fe4990a9836633e602d4a729a867df58e01f972494c1e87da944955c8e01409b57e4f1804abfe0a6664bf0765893
TLSH
T1C7113DA1F8E5D893F53238DB9211DAD70DF436CFACAC6A04236A420C2794C32CF514E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3088-82-0x0000000000A00000-0x0000000000A21000-memory.dmp

Download

memory/3184-60-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download

memory/4136-0-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/4136-8-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/4648-37-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download