remcos | f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
Size 946KB
Sample260630-d3lessdx8w
SHA256 f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449
MD5 a24a0edf10825128746824bd2356dbab
SHA1 9b14932b92f429b0160fb24125f8fa5809226a76
SHA512 3c4b36d1430f1a892719511c4d197b7f76176883d88cf669c486542008b1bd9ef2632777d7299d50ec44b6c09856ae8a303b99fd9075bb42607fabf082982549
SSDEEP 24576:VlN/m2PhGkoIt3GLOVczKPwsBGTFTGjDFvvm7fY+YnvI2j:PFm2PhXJGGhBVjJ20+Ynv
TLSH
T17F25226E35B9CA31D2B997F15EF2E27913B12C18E431E3034DC5ADDB3A14B10DA18B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.0.1 Pro

147.124.219.132:2828

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
988	powershell.exe
2884	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3724	CykdvyEtP.exe
1056	CykdvyEtP.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2668-6-0x00000000052F0000-0x00000000052FE000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2668 set thread context of 1352	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	94
PID 3724 set thread context of 1056	3724	CykdvyEtP.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CykdvyEtP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3748	schtasks.exe
1172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
988	powershell.exe
2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
988	powershell.exe
2884	powershell.exe
2884	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
Token: SeIncreaseQuotaPrivilege	988	powershell.exe
Token: SeSecurityPrivilege	988	powershell.exe
Token: SeTakeOwnershipPrivilege	988	powershell.exe
Token: SeLoadDriverPrivilege	988	powershell.exe
Token: SeSystemProfilePrivilege	988	powershell.exe
Token: SeSystemtimePrivilege	988	powershell.exe
Token: SeProfSingleProcessPrivilege	988	powershell.exe
Token: SeIncBasePriorityPrivilege	988	powershell.exe
Token: SeCreatePagefilePrivilege	988	powershell.exe
Token: SeBackupPrivilege	988	powershell.exe
Token: SeRestorePrivilege	988	powershell.exe
Token: SeShutdownPrivilege	988	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeSystemEnvironmentPrivilege	988	powershell.exe
Token: SeRemoteShutdownPrivilege	988	powershell.exe
Token: SeUndockPrivilege	988	powershell.exe
Token: SeManageVolumePrivilege	988	powershell.exe
Token: 33	988	powershell.exe
Token: 34	988	powershell.exe
Token: 35	988	powershell.exe
Token: 36	988	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeIncreaseQuotaPrivilege	2884	powershell.exe
Token: SeSecurityPrivilege	2884	powershell.exe
Token: SeTakeOwnershipPrivilege	2884	powershell.exe
Token: SeLoadDriverPrivilege	2884	powershell.exe
Token: SeSystemProfilePrivilege	2884	powershell.exe
Token: SeSystemtimePrivilege	2884	powershell.exe
Token: SeProfSingleProcessPrivilege	2884	powershell.exe
Token: SeIncBasePriorityPrivilege	2884	powershell.exe
Token: SeCreatePagefilePrivilege	2884	powershell.exe
Token: SeBackupPrivilege	2884	powershell.exe
Token: SeRestorePrivilege	2884	powershell.exe
Token: SeShutdownPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeSystemEnvironmentPrivilege	2884	powershell.exe
Token: SeRemoteShutdownPrivilege	2884	powershell.exe
Token: SeUndockPrivilege	2884	powershell.exe
Token: SeManageVolumePrivilege	2884	powershell.exe
Token: 33	2884	powershell.exe
Token: 34	2884	powershell.exe
Token: 35	2884	powershell.exe
Token: 36	2884	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1352	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 988	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	87
PID 2668 wrote to memory of 3748	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	89
PID 2668 wrote to memory of 3800	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	92
PID 2668 wrote to memory of 3600	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	93
PID 2668 wrote to memory of 1352	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	94
PID 2668 wrote to memory of 1352	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	94
PID 2668 wrote to memory of 1352	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	94
PID 2668 wrote to memory of 1352	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	94
PID 2668 wrote to memory of 1352	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	94
PID 2668 wrote to memory of 1352	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	94
PID 2668 wrote to memory of 1352	2668	f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe	94
PID 3724 wrote to memory of 2884	3724	CykdvyEtP.exe	97
PID 3724 wrote to memory of 1172	3724	CykdvyEtP.exe	99
PID 3724 wrote to memory of 1056	3724	CykdvyEtP.exe	101
PID 3724 wrote to memory of 1056	3724	CykdvyEtP.exe	101
PID 3724 wrote to memory of 1056	3724	CykdvyEtP.exe	101
PID 3724 wrote to memory of 1056	3724	CykdvyEtP.exe	101
PID 3724 wrote to memory of 1056	3724	CykdvyEtP.exe	101
PID 3724 wrote to memory of 1056	3724	CykdvyEtP.exe	101
PID 3724 wrote to memory of 1056	3724	CykdvyEtP.exe	101

C:\Users\Admin\AppData\Local\Temp\f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
"C:\Users\Admin\AppData\Local\Temp\f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CykdvyEtP.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CykdvyEtP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp95BE.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
  "C:\Users\Admin\AppData\Local\Temp\f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe"
  2⤵
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
  "C:\Users\Admin\AppData\Local\Temp\f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe"
  2⤵
  PID:3600
- C:\Users\Admin\AppData\Local\Temp\f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe
  "C:\Users\Admin\AppData\Local\Temp\f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1352

C:\Users\Admin\AppData\Roaming\CykdvyEtP.exe
C:\Users\Admin\AppData\Roaming\CykdvyEtP.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CykdvyEtP.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CykdvyEtP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE100.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1172
- C:\Users\Admin\AppData\Roaming\CykdvyEtP.exe
  "C:\Users\Admin\AppData\Roaming\CykdvyEtP.exe"
  2⤵
  - Executes dropped EXE
  PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 168B
SHA256 f1b838ca462695a45847e5f861637ba1f7cba6b605f3abe7518dc559fd008257
MD5 fa0dde851a80623f52f6e05104117fe1
SHA1 8af64ac542b956ff10da7395cadd50537f909b21
SHA512 5278e49e2e3646f10128af5576e276ee7dfe4b9d48ad4298501b74a1f1a47ae7277099c792668bec18aec56158372bbd71f7371221ef30861d1af5e69e4676b2
TLSH
T1E2C08C2A27D9100A6675DABB94B301222EB0BA66143ACC2C16C0438C08F8A00F851793
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 7fdd2be7397883b85ab3e52151abe2813ad7c40ba4f551b152d0e2c6aaaaed85
MD5 35f16d278abf54470bb75389646a5473
SHA1 654fff9cc50b6960038b049ccb6d4dd0051ab7f2
SHA512 3295b88ba64d4eb6a716024937028065a5ef155cecbac7e6117a400c198d888fb69376b5ed6f7a474663ff8379adaf8b522bbfcb4958a16712dec97b4bc0c223
SSDEEP 384:/1eBaoT1iBG+GW14b2yC6s/+T03JKjrr2PnZIAXr4B+BWIitzKwYvYbhNaPMlRtS:dexZ6GNWii96s/+TT6RIAXrq++V3bhNy
TLSH
T19DA2B478213F6DC7D8D226B410D20AB7FBE4D489DAB611D4BF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_o4b4opbo.gbe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o4b4opbo.gbe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp95BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp95BE.tmp
Size 1KB
SHA256 567e84fa8b071d8c096c5c7238a3b6ee2f3cc517579bec2403d9467528310e40
MD5 88fc242655618861152d5650f9f4a694
SHA1 4d7b0f24447b3051df8224b9bcc5053f4bbd0f41
SHA512 b8e97713d2beaec246b63c45cef3b64760bc14df33f71b8e944635cd18de9d2e1bb6abbc476eb8a43bc67bc0bc4f140e131a19709b12be39d5c9cbd0764b7d17
TLSH
T18131F0A4D8F0F75BF64211298351A6835F758BB745510079F8CC4A787F8AAC22157A3B
MD5 SHA1 SHA512 TLSH

Submit Download

CykdvyEtP.exe

Path C:\Users\Admin\AppData\Roaming\CykdvyEtP.exe
Size 946KB
SHA256 f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449
MD5 a24a0edf10825128746824bd2356dbab
SHA1 9b14932b92f429b0160fb24125f8fa5809226a76
SHA512 3c4b36d1430f1a892719511c4d197b7f76176883d88cf669c486542008b1bd9ef2632777d7299d50ec44b6c09856ae8a303b99fd9075bb42607fabf082982549
SSDEEP 24576:VlN/m2PhGkoIt3GLOVczKPwsBGTFTGjDFvvm7fY+YnvI2j:PFm2PhXJGGhBVjJ20+Ynv
TLSH
T17F25226E35B9CA31D2B997F15EF2E27913B12C18E431E3034DC5ADDB3A14B10DA18B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-34-0x0000000005DF0000-0x0000000005E3C000-memory.dmp

Download

memory/988-17-0x00000000750F0000-0x00000000758AC000-memory.dmp

Download

memory/988-38-0x0000000070220000-0x000000007026C000-memory.dmp

Download

memory/988-37-0x0000000006FC0000-0x0000000006FF6000-memory.dmp

Download

memory/988-48-0x00000000750F0000-0x00000000758AC000-memory.dmp

Download

memory/988-46-0x00000000073B0000-0x0000000007446000-memory.dmp

Download

memory/988-12-0x0000000004920000-0x0000000004956000-memory.dmp

Download

memory/988-13-0x00000000750F0000-0x00000000758AC000-memory.dmp

Download

memory/988-45-0x00000000071B0000-0x00000000071BA000-memory.dmp

Download

memory/988-41-0x0000000006FA0000-0x0000000006FC0000-memory.dmp

Download

memory/988-16-0x00000000750F0000-0x00000000758AC000-memory.dmp

Download

memory/988-33-0x0000000005DD0000-0x0000000005DEE000-memory.dmp

Download

memory/988-18-0x0000000005640000-0x0000000005662000-memory.dmp

Download

memory/988-19-0x00000000056F0000-0x0000000005756000-memory.dmp

Download

memory/988-20-0x0000000005760000-0x00000000057C6000-memory.dmp

Download

memory/988-23-0x00000000058A0000-0x0000000005BFB000-memory.dmp

Download

memory/988-44-0x0000000007140000-0x000000000715A000-memory.dmp

Download

memory/988-43-0x0000000007780000-0x0000000007DFC000-memory.dmp

Download

memory/988-42-0x0000000007000000-0x00000000070A3000-memory.dmp

Download

memory/988-15-0x0000000004FB0000-0x00000000055FA000-memory.dmp

Download

memory/1056-60-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-82-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-75-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-96-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-94-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-89-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-88-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-31-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-26-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-32-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-25-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-24-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-83-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-76-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-30-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-51-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-70-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1352-69-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2668-6-0x00000000052F0000-0x00000000052FE000-memory.dmp

Download

memory/2668-7-0x0000000075102000-0x0000000075103000-memory.dmp

Download

memory/2668-0-0x0000000075102000-0x0000000075103000-memory.dmp

Download

memory/2668-35-0x00000000750F0000-0x00000000758AC000-memory.dmp

Download

memory/2668-4-0x0000000005060000-0x000000000506A000-memory.dmp

Download

memory/2668-8-0x00000000750F0000-0x00000000758AC000-memory.dmp

Download

memory/2668-2-0x00000000056D0000-0x0000000005C8A000-memory.dmp

Download

memory/2668-10-0x0000000009F20000-0x0000000009FBC000-memory.dmp

Download

memory/2668-9-0x0000000007780000-0x0000000007846000-memory.dmp

Download

memory/2668-1-0x0000000000450000-0x0000000000542000-memory.dmp

Download

memory/2668-3-0x0000000005110000-0x00000000051A2000-memory.dmp

Download

memory/2668-5-0x00000000750F0000-0x00000000758AC000-memory.dmp

Download

memory/2884-57-0x0000000005610000-0x000000000596B000-memory.dmp

Download

memory/2884-66-0x0000000006E20000-0x0000000006EC3000-memory.dmp

Download

memory/2884-63-0x0000000070850000-0x000000007089C000-memory.dmp

Download

memory/2884-62-0x0000000006170000-0x00000000061BC000-memory.dmp

Download