2e066ef34578d3a416cc80f88f640aa9ffe165b89f39e7500f7075c445086e83

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_c1b894d00ea2a69145ca86cd350a3ac7_coinminer_driverpack_elex_wannacry.exe
Size 3.2MB
Sample261102-lnmnbastgx
SHA256 2e066ef34578d3a416cc80f88f640aa9ffe165b89f39e7500f7075c445086e83
MD5 c1b894d00ea2a69145ca86cd350a3ac7
SHA1 92cd7274c3018d579786fcb14ce1b9abf74fb7ab
SHA512 4cca1752115096ed02eeedb18344de9eb5a8628370bd1b38e68d89905d859237556983272f4dca090f93b0fa412f11a17b9f741280af0bbfa1cfaa8cd63441b4
SSDEEP 98304:W5aFJwSjbuwJurWW6GfhNaPExgLBcdBq8M/tX:W5aFJwSjjPtWo2gabqt/tX
TLSH
T1CFF5330035A78271E5D363312E04ABA7E5B0AD354B7E97CB8BA13E354F761E1BA381D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5752	powershell.exe
4172	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6012	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4464	Setup.exe
2856	7z.exe

Loads dropped DLL 9 IoCs

pid	Process
4464	Setup.exe
4464	Setup.exe
4464	Setup.exe
4464	Setup.exe
4464	Setup.exe
4464	Setup.exe
4464	Setup.exe
4464	Setup.exe
2856	7z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6008	cmd.exe
3528	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_c1b894d00ea2a69145ca86cd350a3ac7_coinminer_driverpack_elex_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5752	powershell.exe
5752	powershell.exe
4172	powershell.exe
4172	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeIncreaseQuotaPrivilege	5752	powershell.exe
Token: SeSecurityPrivilege	5752	powershell.exe
Token: SeTakeOwnershipPrivilege	5752	powershell.exe
Token: SeLoadDriverPrivilege	5752	powershell.exe
Token: SeSystemProfilePrivilege	5752	powershell.exe
Token: SeSystemtimePrivilege	5752	powershell.exe
Token: SeProfSingleProcessPrivilege	5752	powershell.exe
Token: SeIncBasePriorityPrivilege	5752	powershell.exe
Token: SeCreatePagefilePrivilege	5752	powershell.exe
Token: SeBackupPrivilege	5752	powershell.exe
Token: SeRestorePrivilege	5752	powershell.exe
Token: SeShutdownPrivilege	5752	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeSystemEnvironmentPrivilege	5752	powershell.exe
Token: SeRemoteShutdownPrivilege	5752	powershell.exe
Token: SeUndockPrivilege	5752	powershell.exe
Token: SeManageVolumePrivilege	5752	powershell.exe
Token: 33	5752	powershell.exe
Token: 34	5752	powershell.exe
Token: 35	5752	powershell.exe
Token: 36	5752	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeIncreaseQuotaPrivilege	4172	powershell.exe
Token: SeSecurityPrivilege	4172	powershell.exe
Token: SeTakeOwnershipPrivilege	4172	powershell.exe
Token: SeLoadDriverPrivilege	4172	powershell.exe
Token: SeSystemProfilePrivilege	4172	powershell.exe
Token: SeSystemtimePrivilege	4172	powershell.exe
Token: SeProfSingleProcessPrivilege	4172	powershell.exe
Token: SeIncBasePriorityPrivilege	4172	powershell.exe
Token: SeCreatePagefilePrivilege	4172	powershell.exe
Token: SeBackupPrivilege	4172	powershell.exe
Token: SeRestorePrivilege	4172	powershell.exe
Token: SeShutdownPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeSystemEnvironmentPrivilege	4172	powershell.exe
Token: SeRemoteShutdownPrivilege	4172	powershell.exe
Token: SeUndockPrivilege	4172	powershell.exe
Token: SeManageVolumePrivilege	4172	powershell.exe
Token: 33	4172	powershell.exe
Token: 34	4172	powershell.exe
Token: 35	4172	powershell.exe
Token: 36	4172	powershell.exe
Token: SeRestorePrivilege	2856	7z.exe
Token: 35	2856	7z.exe
Token: SeSecurityPrivilege	2856	7z.exe
Token: SeSecurityPrivilege	2856	7z.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 4464	108	2026-11-01_c1b894d00ea2a69145ca86cd350a3ac7_coinminer_driverpack_elex_wannacry.exe	89
PID 4464 wrote to memory of 6008	4464	Setup.exe	90
PID 6008 wrote to memory of 5752	6008	cmd.exe	92
PID 4464 wrote to memory of 3528	4464	Setup.exe	94
PID 4464 wrote to memory of 5372	4464	Setup.exe	95
PID 3528 wrote to memory of 4172	3528	cmd.exe	97
PID 3528 wrote to memory of 2856	3528	cmd.exe	99
PID 3528 wrote to memory of 6012	3528	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-11-01_c1b894d00ea2a69145ca86cd350a3ac7_coinminer_driverpack_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c1b894d00ea2a69145ca86cd350a3ac7_coinminer_driverpack_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:108
- C:\ProgramData\Launcher\Setup.exe
  "C:\ProgramData\Launcher\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Launcher\extract2.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionProcess 'powershell.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Launcher\extract3.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4172
  - - C:\ProgramData\Launcher\7z.exe
      7z x Launcher.7z -pool=77
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2856
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall set opmode disable
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:6012
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\ProgramData\Launcher\7z.dll
Size 1.8MB
SHA256 69fd4df057985c40e510e2fac182881c7f85e90aa13ec703f763a8fdb2ce61f8
MD5 58c9628787bce8db529dd668e1825630
SHA1 f59f722a9a0064fdc2c762100383d7babb0a57b6
SHA512 da68b7bc3281bb0f7dc1ed7dcd234dddbbb1f5992bb156f6a844f8c8bea42fecee93f953d6f4a1c7d324b456e2fe56246601f334b13badc3c21e307958117327
SSDEEP 24576:h8yTPwShrEtNwWdhpmBi/33fR8x4cWNFhzNXuzrMnM:hzTPwZ/wUhwucOrbn
TLSH
T14E954C1BF6748270D0B6C075C5E2AB9AEE7134869B30A6C712859B3D2F17EF5863D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\ProgramData\Launcher\7z.exe
Size 562KB
SHA256 83967f1b02b43c4efeda302795722c809e0e81b8307de73558d10484d5676a7d
MD5 0355ea40d9046173bb1435b41bfc118e
SHA1 abb27eaed3b878a16ebe5463301b9d70f4580b76
SHA512 cbc0d427f14bd6ba67caf6e6e279a381f96bcda72fc26df4c3f8083f63ca8b9d3b0ff4d38971b346f1f1f3e5eb1e5c2d95b42c933f9fad98746d8b25b62190f5
SSDEEP 12288:t5xAeJRYzx/uXbpb7ykox5r6f5y82XpdC8t:uIYF/EJy2zIPt
TLSH
T1C3C4F726F6748335D073C0B9C5D2A69AE97130865B308ACB4286C77C3F676E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.7z

Path C:\ProgramData\Launcher\Launcher.7z
Size 1.7MB
SHA256 aae3ee9f6082676d2d9035d7b6beba659d7444554d0b96ae00113409ce1b49ad
MD5 a75a4fda04f109dd5da1827f48250811
SHA1 4d78908c312dba68341d707fe4903661952cbe0d
SHA512 554d2201424ee1f9366fced16f96fa4f8c16c7aeda32a925f8d68d7457817a55d7637b0f8393eda845b543ddb40825682ae20e9a390e9b29a3e0c7f43fa56a6b
SSDEEP 49152:PyDBvle0bu+D81GXAS/iHmy+Qzg7ZYSmsDAk8:KNdbbu+agxM/Sm2Ak8
TLSH
T19F8533883123D722878AE24B6F34CB9BEC70FD54977FE3578AD64E748A8D16875100B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\ProgramData\Launcher\Setup.exe
Size 34KB
SHA256 8e347ef52c18a9f479a5d82729de5b4889e1e4ad74b7dab6ac17183882c5b4bf
MD5 1d7c6066058c4b69c5a144c74f839f52
SHA1 f46fd60cc3a1980d685adc53ade5baa3484e615b
SHA512 b830bbe16c175d953ccab63ca38f7b527b358508f436107b488ebf1d41fab7f27bf91d0160baa2519259d71c4bddee9ee5e098ae8307cea951e6c211dff75c3e
SSDEEP 384:IiannYJLOKiXyWkn3BX05x4GGY+hoUGxaQAwZ0oK78hUZZZgYa8IFDAcM8:IpnKO3X4n3BX0v4cFqkhUZZZ3DIr
TLSH
T1EDF2C541AA1C05F1E961DB39192FDF02C765BC3A9990E16762EE3EDA99F1050133BB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extract2.bat

Path C:\ProgramData\Launcher\extract2.bat
Size 84B
SHA256 4d30e07de90e884457243e8e4a20ae5b960890212792581944d1510efcb98e61
MD5 f188dec7ed26b4d829969675090e1e3c
SHA1 308d36faefbb1cffe217345340c93a6647157849
SHA512 826206d55e48e4a0caa1661491e7db106f8032b2a8e96d075d8d2674478da99697554f9f9147a50f45ac1292388ba98971bebefdf9dc9bc478d2bb3b85e36daa
TLSH
T1F9A01222011840DD8BE90458F011054A248B8020401F009331289C08190053CD3B9C0C
MD5 SHA1 SHA512 TLSH

Submit Download

extract3.bat

Path C:\ProgramData\Launcher\extract3.bat
Size 152B
SHA256 0075dee650a31a4e9911743f33e01b79db7e392105725499cda28928ccc6d6b4
MD5 8bedeb85d87b182f0b55a06b20fdb8a4
SHA1 7f581191766e62ad467417ccce7113497c1e30ad
SHA512 66b137cfebe9f75f3a264b96b9ee17727d02a04c88d739edea6a5128f8da4fa350754ff334e3cfb02927dbb3cef841032af5e793b01ec891681edc903abf07d5
TLSH
T1ADC08C15009A0046FDB0AF644228031CD20B827A602E80B63839CA05254EC6CE674D04
MD5 SHA1 SHA512 TLSH

Submit Download

rtl70.bpl

Path C:\ProgramData\Launcher\rtl70.bpl
Size 766KB
SHA256 a2c9f2055886327d03724c2aef95566c9a731f83b568ff88c48ccc0dc74218f0
MD5 123015c8c70d81aff1e6d3b316ddf00e
SHA1 a401df86057c3d8cf11fb1dde177fcb549433145
SHA512 550e8d1ae8f1994765cf2310519b45ec87331ad72b5004f3feb1a0291070044acde37841e3f44195a021256ad16d294665edc9d44604bca2edcd4ef604d4ad5d
SSDEEP 12288:RnJoCnL9vbHcONNBbiaeV/PzUW6SIg3N8Ts0urVyU08v/fHTE/JW+A9IpDNOej3q:RnJzdH9tYG8vHkW+A9ITOej3+Jr2z
TLSH
T185F48C21F24889FBD6B3273D451DBE37C5B97E209620CEDA69F84D49D9605803F283DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl70.bpl

Path C:\ProgramData\Launcher\vcl70.bpl
Size 1.3MB
SHA256 976e20f397d19ba3b5b3347a3299c061ca325b7b915a46baf6e57cce5779a9cf
MD5 563e6aeeb20c98bc1f8917ec3f04a0ac
SHA1 82678ab71e3eacd679a0137d1b46eb3bab87c050
SHA512 bf7ebe2a5746c6347d880eeb9b4c225a7641f206c6f9e6cac6b2da4b95110ff05af652c1c71d5cebafc0e8e09100e861b6b6962941e9bce1b2873510300fca15
SSDEEP 12288:eYURhofl6VUvxusfIuJ25+G1gMBpSFxZTemnMc3YB4gisIKXKjjgOby17fG:oof30jJBpSfZyWIGBsKHgObC
TLSH
T1E7557C51F2280CB6D4A757BC2A7F7F21D965AB106260A78E3AF48C5C5EE2D803F5134B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 9669d0c10f6195759fd2ae3ef6c76130dca01b519e26d5d0b2cdb93541014657
MD5 d175df40079a396d46906ff9cc3175f8
SHA1 945d3160268204ad924ac499380115f06fa7c6f1
SHA512 ba7835ddb79a49436b56fa0ac3152f3e9e79adc6508ab13312c6fa165b75d00b89a291bd519df2b81918582a763ea14d1e5298622768db1189d1ac654af306bc
SSDEEP 384:/1eBaoT1iBGrGW14bJvVSYCCZi/THJrukPd5IAXr48+ZWbmtzKwwvYbhNaPslRtj:dexZ6GiWil9SzCZitxnIAXrX+pVvbhNj
TLSH
T187A2B578213F6DC7D8C216B410D10AB7FBE4E489DAB65194BF1BDE2F4C90EBA4A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jnkmmjsf.sht.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jnkmmjsf.sht.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4172-84-0x00000000077F0000-0x0000000007893000-memory.dmp

Download

memory/4172-81-0x0000000070EE0000-0x0000000070F2C000-memory.dmp

Download

memory/4172-80-0x0000000006A10000-0x0000000006A5C000-memory.dmp

Download

memory/4172-76-0x0000000006000000-0x000000000635B000-memory.dmp

Download

memory/4464-61-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4464-74-0x0000000002460000-0x00000000025B8000-memory.dmp

Download

memory/4464-31-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/4464-73-0x0000000040000000-0x00000000400C7000-memory.dmp

Download

memory/4464-72-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4464-30-0x0000000002460000-0x00000000025B8000-memory.dmp

Download

memory/4464-63-0x0000000002460000-0x00000000025B8000-memory.dmp

Download

memory/4464-62-0x0000000040000000-0x00000000400C7000-memory.dmp

Download

memory/4464-64-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/5752-43-0x0000000006310000-0x0000000006376000-memory.dmp

Download

memory/5752-59-0x0000000007E90000-0x0000000007F26000-memory.dmp

Download

memory/5752-58-0x0000000007C90000-0x0000000007C9A000-memory.dmp

Download

memory/5752-57-0x0000000007C20000-0x0000000007C3A000-memory.dmp

Download

memory/5752-56-0x0000000008260000-0x00000000088DC000-memory.dmp

Download

memory/5752-55-0x0000000007AC0000-0x0000000007B63000-memory.dmp

Download

memory/5752-54-0x0000000006EA0000-0x0000000006EC0000-memory.dmp

Download

memory/5752-51-0x000000006F5F0000-0x000000006F63C000-memory.dmp

Download

memory/5752-50-0x0000000007A70000-0x0000000007AA6000-memory.dmp

Download

memory/5752-49-0x00000000068F0000-0x000000000693C000-memory.dmp

Download

memory/5752-48-0x00000000068B0000-0x00000000068CE000-memory.dmp

Download

memory/5752-47-0x0000000006540000-0x000000000689B000-memory.dmp

Download

memory/5752-44-0x0000000006380000-0x00000000063E6000-memory.dmp

Download

memory/5752-42-0x0000000005AF0000-0x0000000005B12000-memory.dmp

Download

memory/5752-41-0x0000000005C50000-0x000000000629A000-memory.dmp

Download

memory/5752-40-0x00000000034D0000-0x0000000003506000-memory.dmp

Download