ddc9fb1e275e35ebe6e7f1098463b7d9a4fde19b10ce5834049edf8038165374

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe
Size 6.5MB
Sample260901-2prlnack6y
SHA256 ddc9fb1e275e35ebe6e7f1098463b7d9a4fde19b10ce5834049edf8038165374
MD5 fcf66093847406b04020c94694fc5d79
SHA1 e8e8eacaddbab13051b04e06064fda4218251702
SHA512 f26c07fe30bdbf9529801e193b8bfd807e55737ffc631ebffb5353e4a35f4f7b10531cb5744c99ac62ce560fd2f261228af0e749ac2a4c74d4781362cbcddde1
SSDEEP 49152:U+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+EfE:9
TLSH
T17F664B09FD8644B1E97B41B04CDBD2BE9530BE218B128EEBF649E72FA933BD05434615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1284	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
4652	svchost_CBBABABBAAACACBAAACABAAABACBBCBABACCACCCABCCACACCAABBAC.exe
3800	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAACACBABCBCCBCABBCACBCBCCBABAABCABCBACBABBAABAACACCCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe"	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCBBBACCABCCCBBBCBCBACBBBBACCCBCAAAAACCACCAAACACCCCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBABABBAAACACBAAACABAAABACBBCBABACCACCCABCCACACCAABBAC.exe"	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4944	sc.exe
1344	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3556	cmd.exe
3216	cmd.exe
4060	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBABABBAAACACBAAACABAAABACBBCBABACCACCCABCCACACCAABBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4348	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe
4348	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe
4348	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe
4348	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe
1284	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
1284	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
1284	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
1284	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
4652	svchost_CBBABABBAAACACBAAACABAAABACBBCBABACCACCCABCCACACCAABBAC.exe
4652	svchost_CBBABABBAAACACBAAACABAAABACBBCBABACCACCCABCCACACCAABBAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1284	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
Token: SeDebugPrivilege	4652	svchost_CBBABABBAAACACBAAACABAAABACBBCBABACCACCCABCCACACCAABBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4528	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3216	4348	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe	89
PID 3216 wrote to memory of 4268	3216	cmd.exe	91
PID 1284 wrote to memory of 3584	1284	svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe	92
PID 3584 wrote to memory of 4296	3584	notepad.exe	93
PID 4348 wrote to memory of 4060	4348	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe	97
PID 4060 wrote to memory of 4944	4060	cmd.exe	99
PID 4348 wrote to memory of 3556	4348	2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe	100
PID 3556 wrote to memory of 1344	3556	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_fcf66093847406b04020c94694fc5d79_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBABCCCCBBCAACAACCAACAABCCBBCCACBCCBBAACBBCABCCCABBBBAAAACBCBAACAABCBBAAAAABCABBACBBACAABCBAABABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBABCCCCBBCAACAACCAACAABCCBBCCACBCCBBAACBBCABCCCABBBBAAAACBCBAACAABCBBAAAAABCABBACBBACAABCBAABABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCAACCCABCACBAABABAACAACAACCCCCCACACBBCBCACACACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe" start= auto displayName= "UserDataSvc_BCCAACCCABCACBAABABAACAACAACCCCCCACACBBCBCACACACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCAACCCABCACBAABABAACAACAACCCCCCACACBBCBCACACACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe" start= auto displayName= "UserDataSvc_BCCAACCCABCACBAABABAACAACAACCCCCCACACBBCBCACACACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCAACCCABCACBAABABAACAACAACCCCCCACACBBCBCACACACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCAACCCABCACBAABABAACAACAACCCCCCACACBBCBCACACACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABABBAAACACBAAACABAAABACBBCBABACCACCCABCCACACCAABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABABBAAACACBAAACABAAABACBBCBABACCACCCABCCACACCAABBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
1⤵
- Executes dropped EXE
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3901591d560ba99e8abaf535fad71b3ba3640e56992dc5680760366fa3d8955e
MD5 aef7cbab1e3925e8fe1776fa195632f2
SHA1 f3fa5ba48fd03e0fc24de87ec26f77ab073de021
SHA512 2aa10904cb8594eb53bee08ee3f39d11241f89ca426dc33b10c77396abf243b0a603ef10aa8764956e50b05a57dc4b1822f9e6e9b6c735df2b4dd887ce247573
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a002f8c5aed6b912d3a9b745830bc79c8c1b097c498fdbcd6b9651bf81db12e0
MD5 d7795aca6d3620c2a1b3970d0f0466ed
SHA1 2681c3c2d9d7e3b0997a42d821f8774d1d44f10a
SHA512 f99d221453f93d2faa362e9cded10ef67890865613fae6d1473eb59880d963a283c48d50da11fff12e5efba75deb084acef0b1caf20f94e96606197dfff6a032
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b953210dbdacd2cfeccc5121e8de599f43d54b690dbb8c59205f663e2e246907
MD5 d85a716f31df6993109609f490b21dd2
SHA1 d4a4e2e25a6c0896363b87aebad88d0bf7a6f0b8
SHA512 8da1544f1410f3a565eb5deaffc6f62de09131fd5bea78a3fa174a0093a2ec9f2a1a34ccf5356495975474af86bcfea6ede379ee0e8aecd32814f406f3aa86f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bb95d68c1158339d55d10a8e423d39387f486f820a538735857b62b357958ce
MD5 276637eb29cc67bf582964beb14e45a5
SHA1 5f5a4ae9c24943fa7342592a1981c1e6bc60ffc4
SHA512 5415c1bfc3cdd02c84704d6d64a7dcf76d38e4cc1501e7e34bce4daf2c34ebdcb9b4ba1c9c2d223952d4ef956b2133a73d0746b269c83946051aa0a68aa1824e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff7993b63d17248692f75137a1d5eb6f42863dd9a311b90bab6be0f9d61a4c1f
MD5 6c19eb3cd2208f5cec9d99171011ecad
SHA1 1c73ddb1273d57bd06c1f7bc8c1fd85798313dc1
SHA512 4656df4127de4dfff045e12aa7083fbe6b30e72405f99a54fd91ad2a3eca791cdba50bb15da72e7f13779e47501fb36ff5a16e150eac5e46346286669642a726
MD5 SHA1 SHA512

Submit Download

MoveAssert.exe

Path C:\Users\Admin\Downloads\MoveAssert.exe
Size 4.2MB
SHA256 5935389c341c0b3ed933dd4888042fd32be2a70d067743df029b40ac9a6edddf
MD5 5b5cbac39d99f569bec5483debff7485
SHA1 dbff4eb7f5b9f5535930a842112c83107e4a094d
SHA512 35cdd062edeff613c82f84ff554e57893daa07f82bbe9de8868878ce754755d4d06340750a0d1f6f9cd4cb33e8abd923ab9706362a9bd624040dd31ff73b57f7
SSDEEP 49152:U+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Efy:r
TLSH
T1FF264B09FD8644B1E97B41B04CDBD2BE9530BE218B128EEBF649E72FA933BD05434615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveAssert.exe

Path C:\Users\Admin\Downloads\MoveAssert.exe
Size 52.6MB
SHA256 83ce18317af3055be46e344c413139e8807bbeae514edd3baea36cde8d66ce50
MD5 f29f60736a4940bcb01cd12b9a2adf1c
SHA1 7893a06d386b9008eef0404cb78cbf81ed2b5ee8
SHA512 92879bd5ef2769ca02b42a2b39ce7d0a9b8b0d95e70908c391d921b8cec3a396567224e712341ebb24fe5c00aca6547187aa1864536f467682e0b722400dc069
SSDEEP 49152:U+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+EfW:agNBks5Es
TLSH
T127C74B09FD8644B1E97B41B04CDBD2BE9530BE218B128EEBF649E72FA933BD05434615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1c507bac555fdeea4bf476503a28a1d6917a79a827c5bb559787ffc244a46d01
MD5 dce13145dc6f1286684bc87a7eb4a05f
SHA1 367cc839018802e47ac15454ae6cfb8d6057908c
SHA512 a1ebcb3cf746d57ff6c952c5890d1ac976bf042083e48c52d9c2545d18618e075a2f4feb467692e565e2d0c0418f15c2efd02a412147be277ac3c4306e882d3c
MD5 SHA1 SHA512

Submit Download

svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBACCCAACBBCBACABACABBBCACBCAABABAACBBCCAAAACBCCCAAC.exe
Size 6.5MB
SHA256 ddc9fb1e275e35ebe6e7f1098463b7d9a4fde19b10ce5834049edf8038165374
MD5 fcf66093847406b04020c94694fc5d79
SHA1 e8e8eacaddbab13051b04e06064fda4218251702
SHA512 f26c07fe30bdbf9529801e193b8bfd807e55737ffc631ebffb5353e4a35f4f7b10531cb5744c99ac62ce560fd2f261228af0e749ac2a4c74d4781362cbcddde1
SSDEEP 49152:U+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+EfE:9
TLSH
T17F664B09FD8644B1E97B41B04CDBD2BE9530BE218B128EEBF649E72FA933BD05434615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 bcab312678376fe7b6ebb99be7e706ed755c6176beb13ff37e45160ee64add31
MD5 8e008882e9b9b01dae2bc76aa4481686
SHA1 55e07250d600b4d30e4591ae5a601d49609c0850
SHA512 3a81367d9b5cc42d6d4f04b511ca3ade4059f94c6635233b081293461cd9a4a946632f4462fb14a51e0379606830b09392897bdb8b1b3e2aca56931f56566111
TLSH
T186112B61E0F5DC23F13128CBD1197F874DE13B9B6C58AB48174E83087799879CE194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1284-116-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/1284-51-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/1284-36-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/1284-75-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/3584-77-0x00000000050B0000-0x00000000050B1000-memory.dmp

Download

memory/3800-117-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/4348-24-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4348-74-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4348-100-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4348-0-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4348-11-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4348-50-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4652-101-0x0000000000640000-0x0000000000661000-memory.dmp

Download