Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2023 02:25
Behavioral task
behavioral1
Sample
CheatHubLauncher.exe
Resource
win7-20230220-en
General
-
Target
CheatHubLauncher.exe
-
Size
12.8MB
-
MD5
0fb32f1fc38ca023300ba5a7b339bbb9
-
SHA1
4cb9f12f4c6ad6fab6926c50116de275f8f75366
-
SHA256
e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
-
SHA512
91db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
SSDEEP
24576:jhf4MROxnFj3JrkxrrcI0AilFEvxHP2ooOtmUh+P:jSMi19qrrcI0AilFEvxHPrmUh+
Malware Config
Extracted
orcus
6.tcp.eu.ngrok.io:15409
4f410509b9144dd9acb87977aa081e27
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
C:\Windows\security\logs\svchost.exe
-
reconnect_delay
10000
-
registry_keyname
svchost
-
taskscheduler_taskname
svchost
-
watchdog_path
AppData\svchost.exe
Signatures
-
Orcus main payload 4 IoCs
Processes:
resource yara_rule C:\Windows\security\logs\svchost.exe family_orcus C:\Windows\security\logs\svchost.exe family_orcus C:\Windows\security\logs\svchost.exe family_orcus C:\Windows\security\logs\svchost.exe family_orcus -
Orcurs Rat Executable 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4224-133-0x0000000000070000-0x0000000000178000-memory.dmp orcus C:\Windows\security\logs\svchost.exe orcus C:\Windows\security\logs\svchost.exe orcus C:\Windows\security\logs\svchost.exe orcus C:\Windows\security\logs\svchost.exe orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
svchost.exeCheatHubLauncher.exesvchost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation CheatHubLauncher.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 4 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exepid process 1340 svchost.exe 4448 svchost.exe 1648 svchost.exe 2016 svchost.exe -
Loads dropped DLL 13 IoCs
Processes:
svchost.exepid process 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe 1340 svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 3 IoCs
Processes:
CheatHubLauncher.exedescription ioc process File created C:\Windows\security\logs\svchost.exe CheatHubLauncher.exe File opened for modification C:\Windows\security\logs\svchost.exe CheatHubLauncher.exe File created C:\Windows\security\logs\svchost.exe.config CheatHubLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exesvchost.exepid process 1340 svchost.exe 1340 svchost.exe 2016 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 2016 svchost.exe 1340 svchost.exe 1340 svchost.exe 2016 svchost.exe 2016 svchost.exe 1340 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 1340 svchost.exe 2016 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe 1340 svchost.exe 2016 svchost.exe 2016 svchost.exe 1340 svchost.exe 2016 svchost.exe 1340 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 1340 svchost.exe Token: SeDebugPrivilege 1648 svchost.exe Token: SeDebugPrivilege 2016 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
CheatHubLauncher.exesvchost.exesvchost.exedescription pid process target process PID 4224 wrote to memory of 1340 4224 CheatHubLauncher.exe svchost.exe PID 4224 wrote to memory of 1340 4224 CheatHubLauncher.exe svchost.exe PID 4224 wrote to memory of 1340 4224 CheatHubLauncher.exe svchost.exe PID 1340 wrote to memory of 1648 1340 svchost.exe svchost.exe PID 1340 wrote to memory of 1648 1340 svchost.exe svchost.exe PID 1340 wrote to memory of 1648 1340 svchost.exe svchost.exe PID 1648 wrote to memory of 2016 1648 svchost.exe svchost.exe PID 1648 wrote to memory of 2016 1648 svchost.exe svchost.exe PID 1648 wrote to memory of 2016 1648 svchost.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatHubLauncher.exe"C:\Users\Admin\AppData\Local\Temp\CheatHubLauncher.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\security\logs\svchost.exe"C:\Windows\security\logs\svchost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\Windows\security\logs\svchost.exe" 1340 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\Windows\security\logs\svchost.exe" 1340 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\security\logs\svchost.exeC:\Windows\security\logs\svchost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\CSCore.dllFilesize
516KB
MD5dde3ec6e17bc518b10c99efbd09ab72e
SHA1a2306e60b74b8a01a0dbc1199a7fffca288f2033
SHA25660a5077b443273238e6629ce5fc3ff7ee3592ea2e377b8fc28bfe6e76bda64b8
SHA51209a528c18291980ca7c5ddca67625035bbb21b9d95ab0854670d28c59c4e7adc6d13a356fa1d2c9ad75d16b334ae9818e06ddb10408a3e776e4ef0d7b295f877
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\CSCore.dllFilesize
516KB
MD5dde3ec6e17bc518b10c99efbd09ab72e
SHA1a2306e60b74b8a01a0dbc1199a7fffca288f2033
SHA25660a5077b443273238e6629ce5fc3ff7ee3592ea2e377b8fc28bfe6e76bda64b8
SHA51209a528c18291980ca7c5ddca67625035bbb21b9d95ab0854670d28c59c4e7adc6d13a356fa1d2c9ad75d16b334ae9818e06ddb10408a3e776e4ef0d7b295f877
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.DXGI.dllFilesize
125KB
MD52b44c70c49b70d797fbb748158b5d9bb
SHA193e00e6527e461c45c7868d14cf05c007e478081
SHA2563762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
SHA512faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.DXGI.dllFilesize
125KB
MD52b44c70c49b70d797fbb748158b5d9bb
SHA193e00e6527e461c45c7868d14cf05c007e478081
SHA2563762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
SHA512faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.Direct3D11.dllFilesize
271KB
MD598eb5ba5871acdeaebf3a3b0f64be449
SHA1c965284f60ef789b00b10b3df60ee682b4497de3
SHA256d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
SHA512a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.Direct3D11.dllFilesize
271KB
MD598eb5ba5871acdeaebf3a3b0f64be449
SHA1c965284f60ef789b00b10b3df60ee682b4497de3
SHA256d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
SHA512a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.Direct3D9.dllFilesize
338KB
MD5934da0e49208d0881c44fe19d5033840
SHA1a19c5a822e82e41752a08d3bd9110db19a8a5016
SHA25602da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
SHA512de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.Direct3D9.dllFilesize
338KB
MD5934da0e49208d0881c44fe19d5033840
SHA1a19c5a822e82e41752a08d3bd9110db19a8a5016
SHA25602da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
SHA512de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.dllFilesize
247KB
MD5ffb4b61cc11bec6d48226027c2c26704
SHA1fa8b9e344accbdc4dffa9b5d821d23f0716da29e
SHA256061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
SHA51248aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.dllFilesize
247KB
MD5ffb4b61cc11bec6d48226027c2c26704
SHA1fa8b9e344accbdc4dffa9b5d821d23f0716da29e
SHA256061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
SHA51248aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\TurboJpegWrapper.dllFilesize
1.3MB
MD5ac6acc235ebef6374bed71b37e322874
SHA1a267baad59cd7352167636836bad4b971fcd6b6b
SHA256047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96
SHA51272ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\TurboJpegWrapper.dllFilesize
1.3MB
MD5ac6acc235ebef6374bed71b37e322874
SHA1a267baad59cd7352167636836bad4b971fcd6b6b
SHA256047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96
SHA51272ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081
-
C:\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\x86\turbojpeg.dllFilesize
646KB
MD582898ed19da89d7d44e280a3ced95e9b
SHA1eec0af5733c642eac8c5e08479f462d1ec1ed4db
SHA2565f4b9f8360764d75c9faaecd94f6d200c54611b33064cd216e363d973dae7c29
SHA512ee7b884ce7d7366ee28fb17721b6c89bd4eba8fb373cdbb483e26a4ed7a74ab5db847513c54704d753d77a7e18b1fb9fee90ed6bbc0540bff702273fda36b682
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\svchost.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
C:\Windows\security\logs\svchost.exeFilesize
12.8MB
MD50fb32f1fc38ca023300ba5a7b339bbb9
SHA14cb9f12f4c6ad6fab6926c50116de275f8f75366
SHA256e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
SHA51291db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
C:\Windows\security\logs\svchost.exeFilesize
12.8MB
MD50fb32f1fc38ca023300ba5a7b339bbb9
SHA14cb9f12f4c6ad6fab6926c50116de275f8f75366
SHA256e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
SHA51291db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
C:\Windows\security\logs\svchost.exeFilesize
12.8MB
MD50fb32f1fc38ca023300ba5a7b339bbb9
SHA14cb9f12f4c6ad6fab6926c50116de275f8f75366
SHA256e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
SHA51291db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
C:\Windows\security\logs\svchost.exeFilesize
12.8MB
MD50fb32f1fc38ca023300ba5a7b339bbb9
SHA14cb9f12f4c6ad6fab6926c50116de275f8f75366
SHA256e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
SHA51291db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
C:\Windows\security\logs\svchost.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
memory/1340-181-0x0000000007380000-0x00000000073C4000-memory.dmpFilesize
272KB
-
memory/1340-173-0x0000000007160000-0x0000000007172000-memory.dmpFilesize
72KB
-
memory/1340-168-0x0000000007770000-0x00000000077D6000-memory.dmpFilesize
408KB
-
memory/1340-230-0x0000000009630000-0x0000000009B5C000-memory.dmpFilesize
5.2MB
-
memory/1340-188-0x0000000007420000-0x000000000746A000-memory.dmpFilesize
296KB
-
memory/1340-153-0x0000000007320000-0x000000000732A000-memory.dmpFilesize
40KB
-
memory/1340-195-0x0000000007FC0000-0x000000000801A000-memory.dmpFilesize
360KB
-
memory/1340-176-0x0000000008130000-0x00000000082F2000-memory.dmpFilesize
1.8MB
-
memory/1340-175-0x0000000007E50000-0x0000000007F5A000-memory.dmpFilesize
1.0MB
-
memory/1340-174-0x00000000077E0000-0x000000000781C000-memory.dmpFilesize
240KB
-
memory/1340-202-0x00000000073D0000-0x00000000073F6000-memory.dmpFilesize
152KB
-
memory/1340-229-0x0000000008B40000-0x0000000008BEA000-memory.dmpFilesize
680KB
-
memory/1340-209-0x0000000008CA0000-0x0000000008DF4000-memory.dmpFilesize
1.3MB
-
memory/1340-172-0x0000000008320000-0x0000000008938000-memory.dmpFilesize
6.1MB
-
memory/1340-226-0x0000000006E90000-0x0000000006F16000-memory.dmpFilesize
536KB
-
memory/1340-216-0x00000000660C0000-0x000000006614F000-memory.dmpFilesize
572KB
-
memory/1648-167-0x0000000000F10000-0x0000000000F18000-memory.dmpFilesize
32KB
-
memory/4224-134-0x00000000049E0000-0x00000000049F0000-memory.dmpFilesize
64KB
-
memory/4224-135-0x0000000005080000-0x0000000005624000-memory.dmpFilesize
5.6MB
-
memory/4224-136-0x0000000004B70000-0x0000000004C02000-memory.dmpFilesize
584KB
-
memory/4224-133-0x0000000000070000-0x0000000000178000-memory.dmpFilesize
1.0MB