a650a0058a8fe8016ef344ed5940e6143571128787aef24a5212f649237c0e26

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe
Size 18.6MB
Sample260910-jrxatazfma
SHA256 a650a0058a8fe8016ef344ed5940e6143571128787aef24a5212f649237c0e26
MD5 035c1d7b04d2cb417e391c7cfa4baa2f
SHA1 d984e84428da6bff9525a0767ff9fc34a6a1bdfb
SHA512 c1438bc6b4672817ed52c895a622bae3a6ef31d7fd682cbc450547e4f274a6f43d102db0615ec5d92cf653867748a142e924174fabdb74c82ff8b47cc680d143
SSDEEP 49152:U+E2+ES+EO+ES+E2+ES+Ead+ES+EO+ES+E2+ES+EO+ES+E2+ES+EaZg+E2+ES+EG:nzzzzzzzzF4Tu
TLSH
T167172B05F94300F1D82711B049DBD2BF8660BA25C6138EEBE64D8EDFFBB2B915824675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c594-18.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
564	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
3344	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
5036	svchost_AABABCCCCABCBCABCCBBCBCCCAACCBCACBBBAABCACACBCBBABCACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACACCAABAACAACACACCAAAAAABBCAABBBCCCCCCABBACBABBABABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe"	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCAAAABCAACACBACBAAAAAAAAAABCBCAAACBCCCCAAACCBBACBBAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABABCCCCABCBCABCCBBCBCCCAACCBCACBBBAABCACACBCBBABCACBC.exe"	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3936	sc.exe
3996	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2932	cmd.exe
5788	cmd.exe
964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABABCCCCABCBCABCCBBCBCCCAACCBCACBBBAABCACACBCBBABCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4856	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe
4856	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe
4856	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe
4856	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe
564	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
564	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
564	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
564	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
5036	svchost_AABABCCCCABCBCABCCBBCBCCCAACCBCACBBBAABCACACBCBBABCACBC.exe
5036	svchost_AABABCCCCABCBCABCCBBCBCCCAACCBCACBBBAABCACACBCBBABCACBC.exe
3344	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
3344	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe
Token: SeDebugPrivilege	564	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
Token: SeDebugPrivilege	5036	svchost_AABABCCCCABCBCABCCBBCBCCCAACCBCACBBBAABCACACBCBBABCACBC.exe
Token: SeDebugPrivilege	3344	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 5788	4856	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe	91
PID 5788 wrote to memory of 5104	5788	cmd.exe	93
PID 564 wrote to memory of 1532	564	svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe	94
PID 4856 wrote to memory of 964	4856	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe	95
PID 964 wrote to memory of 3936	964	cmd.exe	97
PID 4856 wrote to memory of 2932	4856	2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe	98
PID 2932 wrote to memory of 3996	2932	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_035c1d7b04d2cb417e391c7cfa4baa2f_elex_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCBCACABBBCABCBCACAABCCBCCBABCABBAAABAACBCCBCACABCCACCCBBBCBCBBBACBBABCABCABCCCCCCACBCBBBCAAACCCABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCBCACABBBCABCBCACAABCCBCCBABCABBAAABAACBCCBCACABCCACCCBBBCBCBBBACBBABCABCABCCCCCCACBCBBBCAAACCCABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBAACBABAACCBBCAACCAAAACBAACCCABCABBACCCACBCBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe" start= auto displayName= "UserDataSvc_CBCBAACBABAACCBBCAACCAAAACBAACCCABCABBACCCACBCBBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBAACBABAACCBBCAACCAAAACBAACCCABCABBACCCACBCBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe" start= auto displayName= "UserDataSvc_CBCBAACBABAACCBBCAACCAAAACBAACCCABCABBACCCACBCBBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBAACBABAACCBBCAACCAAAACBAACCCABCABBACCCACBCBBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBAACBABAACCBBCAACCAAAACBAACCCABCABBACCCACBCBBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCCCCABCBCABCCBBCBCCCAACCBCACBBBAABCACACBCBBABCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCCCCABCBCABCCBBCBCCCAACCBCACBBBAABCACACBCBBABCACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 70093fdc10f84a7de96dbc7c434d87c96d6f1e3bcce76ff0eee0c9f6a0d7202d
MD5 86387cba094ec1a4688e56f89409f905
SHA1 1362b1abd0b947e2cb3fd4267fa8b0afceee25c9
SHA512 9a8d287e91cc90e82eeb750660e01a736efa2c2ee48f88cad1ee1f2a44d64491957590cc9c9ffc79cd759c7725ee8336558e5ae1f253d748ff091b5b57c3b322
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\DeviceMetadataCache\dmrccache\qap`g`v~dtlq
Size 10B
SHA256 f9a41e8da0bbb819171db0f12b38544ac74d931c8c25e0a3488efe9893d94d0e
MD5 8ccb61cc188ea21dd08bb70926447603
SHA1 55edd90174f67e56e039e47f2d414a65c3d23ee0
SHA512 29b831ac75713fc02d78064d81e0c58ab1d457d3f833683db519d4e9b157ce7954043238fe07bc9e4c6cd110790f1280105df13ce0e5e07ccb0f9263b95fe894
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bfd588c61dcd6833e0b0e926b68a3747d7919d41ed783070ab463bed1d10dd7d
MD5 f05e4798e317cdaa3ef173906918d1d0
SHA1 beb6def69f85ef498efbbdb46fd0de881353df5f
SHA512 0130e3f837d52bfc19bb01303199cab87428628531dce382600b9e01be38a2bb3c4fb7d9a96dfdc6d76ab90d3fa93ab269f1170cc0a365d44d550e1431835fde
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aff5c64a5daeffbe296bf51ead272f88936ca5c67b78ea12264b309a492de052
MD5 6d069391bcc234e152551aed9be61a3c
SHA1 8a5821a31214f75f9609b471e9f59eb261f58b31
SHA512 7a6d4f1fefea5ed98b7d486d483587da5706e5ba4cdbdc037737ae18398802cae43bada6557e2b0683c5f8ae9d1c79ea171826fa7dfe85ca680c2d52484e15c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 553e36ace71d0c84da91d17ab125b70b41ecbd03d07b4632f80948d986796bfe
MD5 0093efd98fe86f586feadaaf76431a36
SHA1 c948483a086d1a3984454987d359c72759b35388
SHA512 5f8832730b9337d4bccc4236dd09d58ef76c648495a64953e58bc71fa3d119f63101a47c723cdd0de50ba79d2842dae86aa07736f9ac5ca5be1bc04adfe59c97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a54dd4aa9952e25f6b48a69eb9a4bf56c3337301a303eba7653417c255981acf
MD5 2f2ffdf5898e8ef645f2d6b7063f5e0e
SHA1 68fdf6a79d87bc1d6bac4847e473bc890c970837
SHA512 75f9d370fa08121c88c92c4c0618395fc945c52683f0017b78aa81c73efd980f487bda2351dfbc6bd45ec533f3e9ef58cb1afa986001c3cc46d8295ffcf09557
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9932cdfe0458451ab9a0d336cbe10d464767ef9507d387797ea2664e512e8ba8
MD5 018ddfeb74da19f6e5f0d3987c96ab8f
SHA1 d2ecf283471acf3ac84bb5aa4ef39a1655eca566
SHA512 e37e37b91b4bb3635e530f11ce1b2c0a04a5d32d970e01d1b69ad8ec7f7986eee440efbddec57c232026e4e1e93984cbf2da486ccf48b1b55b46089dea7bab72
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ea29b446094b809f70a25a4d0085bde94320d335dfcc6e7ad964bca607cc0ed3
MD5 dff6e8e8ba065feab971871c328935a5
SHA1 35ed84995471ce4bdeb7df80860ab0e230d0eb2a
SHA512 c4d37ba692def089642bd26c919e1967fdc55f3a9ef3f175f163f87fabc94238a3aa0f902a8f08b88c84bde6d790b3df3437c1a7a80d107840bc6164fcae19b5
MD5 SHA1 SHA512

Submit Download

svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBBCBBAABCBBABCBBBCAAAACAABBCCCCABABBCBABABCAACCBA.exe
Size 18.6MB
SHA256 a650a0058a8fe8016ef344ed5940e6143571128787aef24a5212f649237c0e26
MD5 035c1d7b04d2cb417e391c7cfa4baa2f
SHA1 d984e84428da6bff9525a0767ff9fc34a6a1bdfb
SHA512 c1438bc6b4672817ed52c895a622bae3a6ef31d7fd682cbc450547e4f274a6f43d102db0615ec5d92cf653867748a142e924174fabdb74c82ff8b47cc680d143
SSDEEP 49152:U+E2+ES+EO+ES+E2+ES+Ead+ES+EO+ES+E2+ES+EO+ES+E2+ES+EaZg+E2+ES+EG:nzzzzzzzzF4Tu
TLSH
T167172B05F94300F1D82711B049DBD2BF8660BA25C6138EEBE64D8EDFFBB2B915824675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 bb6868289c8fc7e720a95a64fdef5e6c0ed6080dd277448d4ab8eb69fb1256d6
MD5 4f5df3e35ef0c982791fd20afb1bb38b
SHA1 4bd7b382aaaf02ca05730e3bcf7f66c0642e4ce5
SHA512 537e281a77aac27a9b39a177b1360e82d6ce9ded09404d9098af38516c897876e645262490fb928568e629068c4aadc0b7586cdc398098b4cefb5b3f82dc99dc
TLSH
T1E211E362F0A5D863F4316DCB5225CFE728E437DBAA9CAB14224E4118EB55C3ADE150D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 12606adff7069d78a0ef5e61d4744b18edf775bd7cad295084ea1863c228b3bd
MD5 5daa4593a21f37d7890f7348d604d2af
SHA1 117dbdfa32459291df50c4a4472bc29b549fa2f4
SHA512 e5d31aa39e5279df1cc48d5850fd5a66d51fe8eacb382b126f9cae3ee59eecba0f06260b7fdbf9fc1f9f68308ee731082584bc93560e4e040038a8f7c4953f7f
TLSH
T115212462F0A5D863F4316CCB5225CFE718E837DBB99CAB14234E4118EB59C3ACE150D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-35-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/564-22-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/3344-65-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4856-6-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/5036-81-0x00000000003F0000-0x0000000000411000-memory.dmp

Download