Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 14:52
Static task
static1
Behavioral task
behavioral1
Sample
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe
Resource
win10v2004-20240412-en
General
-
Target
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe
-
Size
856KB
-
MD5
72f2460abc3ae41fff469e110f3eaff3
-
SHA1
066ba1993f24e959b03edef4940d1b5ee9f5e18a
-
SHA256
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf
-
SHA512
7627f7b0cfc2ca14e788b840601edc5460b36c8e386d39b2eda2283600e192a9c83b1f5fec93ef7eff0a9e54d80ab523780149fae65116a9af77753e8b01fcc8
-
SSDEEP
12288:7c8K/isRopeArTI4C8ilPYO0bJm1hEpA4kpNOxJNWBfTgtfBjLkvGpMeUPDpVU13:vK/LRopDTI4VOcHxJobgVRJww6k
Malware Config
Extracted
remcos
RemoteHost
jburg.net:3363
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Y4B0AA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/348-2-0x0000000004D90000-0x0000000004E68000-memory.dmp family_zgrat_v1 behavioral2/memory/348-3-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-4-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-6-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-8-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-10-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-12-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-14-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-16-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-18-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-20-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-22-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-24-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-26-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-28-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-30-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-32-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-34-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-36-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-38-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-40-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-42-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-44-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-46-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-48-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-50-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-52-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-54-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-56-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-58-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-60-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-62-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-64-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 behavioral2/memory/348-66-0x0000000004D90000-0x0000000004E62000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pymeprhzzxj = "C:\\Users\\Admin\\AppData\\Roaming\\Pymeprhzzxj.exe" 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exedescription pid process target process PID 348 set thread context of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3212 powershell.exe 3212 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exepowershell.exedescription pid process Token: SeDebugPrivilege 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe Token: SeDebugPrivilege 3212 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exepid process 2364 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exedescription pid process target process PID 348 wrote to memory of 3212 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe powershell.exe PID 348 wrote to memory of 3212 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe powershell.exe PID 348 wrote to memory of 3212 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe powershell.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe PID 348 wrote to memory of 2364 348 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe 689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe"C:\Users\Admin\AppData\Local\Temp\689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANgA4ADkAZQBmADEAZAAyADkAYwAyADYAMwBmADcAOABjADkANgAyADYAZQAwADAANQAwADAAOQA4ADMAZQAyADUAOAA5AGQAMgA4ADAANgA4AGEANwAyAGYAYQBkAGIAYQA5AGEANABiADAANABiADcAZQBhAGYAYgBjAGEAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAANgA4ADkAZQBmADEAZAAyADkAYwAyADYAMwBmADcAOABjADkANgAyADYAZQAwADAANQAwADAAOQA4ADMAZQAyADUAOAA5AGQAMgA4ADAANgA4AGEANwAyAGYAYQBkAGIAYQA5AGEANABiADAANABiADcAZQBhAGYAYgBjAGEAZgAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAUAB5AG0AZQBwAHIAaAB6AHoAeABqAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABQAHkAbQBlAHAAcgBoAHoAegB4AGoALgBlAHgAZQA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exeC:\Users\Admin\AppData\Local\Temp\689ef1d29c263f78c9626e00500983e2589d28068a72fadba9a4b04b7eafbcaf.exe2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD5561556af45e7ccddeb5500e0e8a452da
SHA15b9bddc17f4221ca06e7ead72464b4e210dd34a9
SHA2560c52c2fe21902f4d1bc8ece2ac799a84b950396546ce952ef39af529c75f3d6b
SHA512b9986d583509039125a57f1f137155e2185bd229891f3779bd9e32048595784acc6b974fa5197346403550d49ee371e1cef7eeedb29f7bb3879954b1e3df3f35
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c2c1htmd.0f2.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/348-66-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-8-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-3-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-4-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-6-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-935-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/348-10-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-12-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-14-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-16-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-936-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/348-20-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-22-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-24-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-26-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-28-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-30-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-32-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-34-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-36-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-38-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-40-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-42-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-44-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-46-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-48-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-50-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-52-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-54-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-0-0x0000000000340000-0x000000000041C000-memory.dmpFilesize
880KB
-
memory/348-58-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-60-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-62-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-64-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-56-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-2-0x0000000004D90000-0x0000000004E68000-memory.dmpFilesize
864KB
-
memory/348-18-0x0000000004D90000-0x0000000004E62000-memory.dmpFilesize
840KB
-
memory/348-937-0x0000000004F40000-0x0000000004FAE000-memory.dmpFilesize
440KB
-
memory/348-938-0x0000000004FB0000-0x0000000004FFC000-memory.dmpFilesize
304KB
-
memory/348-940-0x00000000064B0000-0x0000000006A54000-memory.dmpFilesize
5.6MB
-
memory/348-949-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB
-
memory/348-1-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB
-
memory/2364-1003-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2364-952-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3212-942-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/3212-946-0x0000000004F80000-0x00000000055A8000-memory.dmpFilesize
6.2MB
-
memory/3212-970-0x0000000005EC0000-0x0000000005F0C000-memory.dmpFilesize
304KB
-
memory/3212-985-0x0000000006E70000-0x0000000006F13000-memory.dmpFilesize
652KB
-
memory/3212-954-0x00000000055B0000-0x0000000005616000-memory.dmpFilesize
408KB
-
memory/3212-956-0x0000000005620000-0x0000000005686000-memory.dmpFilesize
408KB
-
memory/3212-968-0x00000000057F0000-0x0000000005B44000-memory.dmpFilesize
3.3MB
-
memory/3212-969-0x0000000005E80000-0x0000000005E9E000-memory.dmpFilesize
120KB
-
memory/3212-984-0x0000000006430000-0x000000000644E000-memory.dmpFilesize
120KB
-
memory/3212-971-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/3212-972-0x000000007FC60000-0x000000007FC70000-memory.dmpFilesize
64KB
-
memory/3212-939-0x0000000002890000-0x00000000028C6000-memory.dmpFilesize
216KB
-
memory/3212-998-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB
-
memory/3212-974-0x0000000070360000-0x00000000703AC000-memory.dmpFilesize
304KB
-
memory/3212-950-0x0000000004E90000-0x0000000004EB2000-memory.dmpFilesize
136KB
-
memory/3212-986-0x00000000077E0000-0x0000000007E5A000-memory.dmpFilesize
6.5MB
-
memory/3212-987-0x0000000007190000-0x00000000071AA000-memory.dmpFilesize
104KB
-
memory/3212-988-0x0000000007200000-0x000000000720A000-memory.dmpFilesize
40KB
-
memory/3212-990-0x0000000007410000-0x00000000074A6000-memory.dmpFilesize
600KB
-
memory/3212-991-0x0000000007390000-0x00000000073A1000-memory.dmpFilesize
68KB
-
memory/3212-992-0x00000000073C0000-0x00000000073CE000-memory.dmpFilesize
56KB
-
memory/3212-993-0x00000000073D0000-0x00000000073E4000-memory.dmpFilesize
80KB
-
memory/3212-994-0x00000000074D0000-0x00000000074EA000-memory.dmpFilesize
104KB
-
memory/3212-995-0x00000000074B0000-0x00000000074B8000-memory.dmpFilesize
32KB
-
memory/3212-973-0x0000000006450000-0x0000000006482000-memory.dmpFilesize
200KB
-
memory/3212-941-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB