8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
Size 12KB
Sample260910-pm5paashpc
SHA256 8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef
MD5 58360eb1e4a6564a371004455f5fb6cd
SHA1 f7b40e83c240d6abdb05c281e1739cb2c6348afc
SHA512 8f166861ea2dd485b54623840ecbc004d6ae2c20cb73b05e53e5965bac1ede54fe58672bb64118ee4731a00258d8cf805d0d6f36706624efe03647fce53cc508
SSDEEP 192:wpHsyZ3dPpvGd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJt2:wpHpZtPpGd1JNsvYlGwAXJk
TLSH
T12E4271E56725922A8872611DCECEA04DF60355331EBB1B15BEBC87312F3A064F27A74D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4368	PowerShell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1540	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
12	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4368 set thread context of 1540	4368	PowerShell.exe	94

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4368	PowerShell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1540	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4368	PowerShell.exe
4368	PowerShell.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
4368	PowerShell.exe
4368	PowerShell.exe
4368	PowerShell.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
4368	PowerShell.exe
4368	PowerShell.exe
4368	PowerShell.exe
4368	PowerShell.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
4368	PowerShell.exe
4368	PowerShell.exe
4368	PowerShell.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
4368	PowerShell.exe
4368	PowerShell.exe
4368	PowerShell.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
4368	PowerShell.exe
4368	PowerShell.exe
4368	PowerShell.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
4368	PowerShell.exe
4368	PowerShell.exe
4368	PowerShell.exe
1540	svchost.exe
1540	svchost.exe
1540	svchost.exe
4368	PowerShell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1540	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	PowerShell.exe
Token: SeDebugPrivilege	1540	svchost.exe
Token: SeDebugPrivilege	1540	svchost.exe
Token: SeDebugPrivilege	1540	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1540	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1148	4368	PowerShell.exe	90
PID 1148 wrote to memory of 5484	1148	csc.exe	91
PID 4368 wrote to memory of 2292	4368	PowerShell.exe	92
PID 2292 wrote to memory of 1372	2292	csc.exe	93
PID 4368 wrote to memory of 1540	4368	PowerShell.exe	94
PID 1540 wrote to memory of 5652	1540	svchost.exe	96
PID 1540 wrote to memory of 5652	1540	svchost.exe	96
PID 1540 wrote to memory of 1672	1540	svchost.exe	100
PID 1540 wrote to memory of 1672	1540	svchost.exe	100
PID 1540 wrote to memory of 964	1540	svchost.exe	103
PID 1540 wrote to memory of 964	1540	svchost.exe	103
PID 1540 wrote to memory of 1380	1540	svchost.exe	106
PID 1540 wrote to memory of 1380	1540	svchost.exe	106

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ec0nzofy\ec0nzofy.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5961.tmp" "c:\Users\Admin\AppData\Local\Temp\ec0nzofy\CSC5BF755A2415F493F94BC88684DF38939.TMP"
    3⤵
    PID:5484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vqoj5e0o\vqoj5e0o.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6047.tmp" "c:\Users\Admin\AppData\Local\Temp\vqoj5e0o\CSCABD5CB603E4440A4B98662C23508265.TMP"
    3⤵
    PID:1372
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5961.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5961.tmp
Size 1KB
SHA256 7af0790852941d72dc474bff78f335072283872b9e0152c48fdc08e0f32d3af3
MD5 f0d4987fd803b9e8fcb0f4d8298c33fe
SHA1 9019349399c72109629f7b0424a386a1ac9415bd
SHA512 9ca53cf3056acea0c7ca23a29c15f321566a2ec7ea756e862c9b714f2e38b051d39fe5373c9db7582a8c19be814da4999fb6784eb8621f2039f66ae812988fb6
TLSH
T15721CC0993E9470AF0774731A9F6072FA674FD64EFA1A35A844003291C01504EEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES6047.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6047.tmp
Size 1KB
SHA256 6fc2cf573adb0a7afc0a3643d7ff10ed3ab0a99968b18cbfe6638fe6f0a4768d
MD5 01eaf4cab6bd62e6ed95ce5f901b5c53
SHA1 0c4e832973538aca13483cacc83fc67a162d181c
SHA512 fa8f59888fdc8e8e7150acc18bef7d8dc88ac0a06aa7ea204f8d677ff58297544eefadffd6ac1a9ada25c43be694bdd991ff40fb99531b16c023ceadc8edf1cd
TLSH
T103216A0593F8470FF0774732B9F6232B92B4FDA8DFA163AA8440122D2841104EFE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

ec0nzofy.dll

Path C:\Users\Admin\AppData\Local\Temp\ec0nzofy\ec0nzofy.dll
Size 3KB
SHA256 220d3206149a9ced4facf195a46178dcb7ee0153395e300be1557e88f48edd8f
MD5 694cf2c1fd53da9e3c6a71daa3a4790e
SHA1 08dd2b24a77cd056eaea66298337bb6dfd97ae46
SHA512 b402b7481bcaa68643e43b2dec78358aad43a80d9e6df6634963c2dffd414242eebe33f1912ddf98982c0b666285309c935d23998179f0276aad7bc7af34c6ab
TLSH
T1F351990A97E8462BE4770734AEF3472637B8F8109B73636D58904329BC656545D21BF1
MD5 SHA1 SHA512 TLSH

Submit Download

vqoj5e0o.dll

Path C:\Users\Admin\AppData\Local\Temp\vqoj5e0o\vqoj5e0o.dll
Size 7KB
SHA256 56b3c6e86a25069f16acae9bb80d48a5712210258569b49e95fa6dff74569664
MD5 e262454e1d8e1b1340ea35d6a5e40954
SHA1 7b534075c8023adef5afe040503b23bc084b0b65
SHA512 ee17189bb695b24ba13ebbf207d4a0e1119732f63fc4b7beac430ed2735bb3a770acbaea88c8efe2b612601377cbc38983b1ec1929b6a1ecf405e0c67f3d2e10
SSDEEP 96:9guYgZxIVIkaxN3rISmCURYCaMNdTFXeLaQ1K:9guYgEda/3yWCrvoaj
TLSH
T1D2F1195ECBDCC275E95E0B39A4F3060167B484448F339A5B19EC91073E67B991B633E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC5BF755A2415F493F94BC88684DF38939.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ec0nzofy\CSC5BF755A2415F493F94BC88684DF38939.TMP
Size 652B
SHA256 aedd42469f7ff3d6ef49d90e6a550d8eec0975e3be016d0436e5982d93f6a348
MD5 7eb8d8891e67d765c7027b97e78e28cd
SHA1 b5f81408bb1f54b3edef7a019e11c200370be873
SHA512 5a9b47a6defd845495a9ed8cac7e07df7542504c516095696103723422d0873426dd4abba5776adeb95a0752aaec4851a1d43af693072952bb6d1b268cd99003
TLSH
T18EF05E0963F8020EF0F74B30BDF64363A5A8BC64DE32A3ED5480032928649109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ec0nzofy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ec0nzofy\ec0nzofy.0.cs
Size 295B
SHA256 e79f623eda1fb8bfb3ceb441dadf01a25b45f37f19f39ff256c77d52f8b454e8
MD5 4e3d809d9542dd5a09b58080bdc7fd32
SHA1 dccce4d18ce5b086d3c6a5935736cb2acba0df08
SHA512 8bb09adc1e7a0f9620704dd757bbdf21e114639012660612955e657f42fe431e499618f6b9fbbc30d67cb5415900cbb865412be033797a216fe88f916480fc6e
TLSH
T18BE0CD1C6AF29AB0806348154C47D5FD761B51363179160576F50320EF4B0094139559
MD5 SHA1 SHA512 TLSH

Submit Download

ec0nzofy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ec0nzofy\ec0nzofy.cmdline
Size 369B
SHA256 5fc7750623292f4b0227e3ddcbd18d110caaf6b7b5b782430d974aebb42741d0
MD5 c14c77c540ade512bc2ffa37d4717079
SHA1 4cfe41d663b629514e38dd82b7c97f82eb94ce9d
SHA512 477ed665912c473ba462efbffb338947620c16127d5a665ee653b0206be0c4bc0dcb63c46ea81a62c3affd3139964d277b40cec8f06d1522c010423bee67ee5f
TLSH
T1F0E0262E5F56C67E25ED120B326ACDFCC37247A729917F84B250845DE02F0057BE2795
MD5 SHA1 SHA512 TLSH

Submit Download

CSCABD5CB603E4440A4B98662C23508265.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vqoj5e0o\CSCABD5CB603E4440A4B98662C23508265.TMP
Size 652B
SHA256 d2f931587018cbfb1f9ca2fd5fdc218a5935660d157fb96802a35bcbf4524440
MD5 e087fb60fee3e5b133ec44a811f18b31
SHA1 92d3ba8137db0371c8d99062f3b66c1e5319ae46
SHA512 e8cf4787785eea6cc2ee5d040a47d97ede327ed996dbe726a44802c61fa3ebb4bd0cff163273900ed3dcb45a1a9bd2732303d94dbd126a2da6efef36985fe482
TLSH
T112F05E0A63F8420EF0F34B30BDF6436391B8BC64DE72A3ED5440031D28645149972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vqoj5e0o.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vqoj5e0o\vqoj5e0o.0.cs
Size 10KB
SHA256 e098b4d074052a8cfb3a15706dfc9827e9b0200e0163b68fa4760d60ff032ab8
MD5 def95e06ed7e895f86ad3f65c3d9459a
SHA1 73c4ad4388d69cfd24b32b8f82aac11a23a5f122
SHA512 c3c89a45ce0d1534a790e3d61d70c8482bbc669739b979ab924ce97c1d7f6653e0c2f819e2894bae1489ce66583d6142a90d53376c83367146b3faa8f2952be7
SSDEEP 192:4Gd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJ2:4Gd1JNsvYlGwAXJ2
TLSH
T15E2240E56725922A8C76211D9ECEA05DF60352331FBA16167ABC87312F3A068F27770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoj5e0o.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vqoj5e0o\vqoj5e0o.cmdline
Size 369B
SHA256 6f4dde35647487b6be0d4bd9c0d11d6e0d1df3c48a93121c802c9e1fdf400fe2
MD5 e514ecc1fa21121b3a1d43c1b42d54d1
SHA1 a8d5a513fac9c67f81823a5f15141ada4f9ada87
SHA512 d9f6ac230d8d7d63b3a026941be06ed9581af1e01551157c9a45e02edd08e98959b2b33b6e34567b19667c7f2f1672763073df67b75e517e04af48bc421d6f98
TLSH
T1A7E0682B4346C27E4DDD105721BEE4FC827306432A403F885051848ED017000A7D1782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1540-646-0x00000295F6DB0000-0x00000295F6DC0000-memory.dmp

Download

memory/1540-658-0x00000295F6FA0000-0x00000295F6FB5000-memory.dmp

Download

memory/1540-655-0x00000295F9AD0000-0x00000295F9D8A000-memory.dmp

Download

memory/1540-643-0x00000295F6D80000-0x00000295F6DA1000-memory.dmp

Download

memory/1540-674-0x00000295FC3E0000-0x00000295FC56A000-memory.dmp

Download

memory/1540-672-0x00007FF65FE60000-0x00007FF65FEA8000-memory.dmp

Download

memory/1540-675-0x00000295FC570000-0x00000295FC756000-memory.dmp

Download

memory/1540-657-0x00000295F9D90000-0x00000295F9E2E000-memory.dmp

Download

memory/1540-656-0x00000295F6F00000-0x00000295F6FA0000-memory.dmp

Download

memory/1540-642-0x00000295F6D80000-0x00000295F6DA1000-memory.dmp

Download

memory/1540-676-0x00000295FC760000-0x00000295FC7F2000-memory.dmp

Download

memory/1540-653-0x00000295F6DB0000-0x00000295F6DC0000-memory.dmp

Download

memory/1540-677-0x00000295FC850000-0x00000295FC8A0000-memory.dmp

Download

memory/1540-683-0x00000295FC8C0000-0x00000295FC93A000-memory.dmp

Download

memory/1540-41-0x00000295F6D80000-0x00000295F6E41000-memory.dmp

Download

memory/1540-638-0x00000295F6D80000-0x00000295F6DA1000-memory.dmp

Download

memory/1540-645-0x00000295F6D80000-0x00000295F6DA1000-memory.dmp

Download

memory/1540-644-0x00000295F6D80000-0x00000295F6DA1000-memory.dmp

Download

memory/4368-39-0x000001FBFC5C0000-0x000001FBFC5C8000-memory.dmp

Download

memory/4368-0-0x00007FFA8500F000-0x00007FFA85010000-memory.dmp

Download

memory/4368-26-0x000001FBE4010000-0x000001FBE4018000-memory.dmp

Download

memory/4368-13-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-654-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-12-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-11-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-10-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-9-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-659-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-8-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-7-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-6-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-5-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-4-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp

Download

memory/4368-3-0x000001FBFC4F0000-0x000001FBFC512000-memory.dmp

Download