Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2023, 03:32

General

  • Target

    782a64eadadacdc0352fac7c200e4037047d0d1ab4d446e6356a5fa65c58323d.exe

  • Size

    926KB

  • MD5

    5df1243f68a568c1b90a3e1c799c6c81

  • SHA1

    a12e5dc2113e43a6329152c698b4f29e88a7177a

  • SHA256

    782a64eadadacdc0352fac7c200e4037047d0d1ab4d446e6356a5fa65c58323d

  • SHA512

    f578ceb6cdf4331c8ed6803b01d33a663c37e94acaf9ed687be9688a11395b18cf7603a4a726f5a3736a5c3126cf2753c1e5a39fb01b6646f9f3e8ffd61ae510

  • SSDEEP

    24576:0WM4MROxnFE3jrXpJrZlI0AilFEvxHiCx:0WfMiuXpJrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

10.0.2.15:4444

Mutex

9f5db8c63bb047d39e98370a28bee370

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    Temp\java.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 4 IoCs
  • Orcurs Rat Executable 5 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\782a64eadadacdc0352fac7c200e4037047d0d1ab4d446e6356a5fa65c58323d.exe
    "C:\Users\Admin\AppData\Local\Temp\782a64eadadacdc0352fac7c200e4037047d0d1ab4d446e6356a5fa65c58323d.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6jwevuir.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3D29.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3D28.tmp"
        3⤵
          PID:3064
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2056
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Users\Admin\AppData\Local\Temp\java.exe
          "C:\Users\Admin\AppData\Local\Temp\java.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 4004 /protectFile
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1680
          • C:\Users\Admin\AppData\Local\Temp\java.exe
            "C:\Users\Admin\AppData\Local\Temp\java.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 4004 "/protectFile"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2932
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:5052
    • C:\Program Files\Orcus\Orcus.exe
      "C:\Program Files\Orcus\Orcus.exe"
      1⤵
      • Executes dropped EXE
      PID:2012

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      926KB

      MD5

      5df1243f68a568c1b90a3e1c799c6c81

      SHA1

      a12e5dc2113e43a6329152c698b4f29e88a7177a

      SHA256

      782a64eadadacdc0352fac7c200e4037047d0d1ab4d446e6356a5fa65c58323d

      SHA512

      f578ceb6cdf4331c8ed6803b01d33a663c37e94acaf9ed687be9688a11395b18cf7603a4a726f5a3736a5c3126cf2753c1e5a39fb01b6646f9f3e8ffd61ae510

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      926KB

      MD5

      5df1243f68a568c1b90a3e1c799c6c81

      SHA1

      a12e5dc2113e43a6329152c698b4f29e88a7177a

      SHA256

      782a64eadadacdc0352fac7c200e4037047d0d1ab4d446e6356a5fa65c58323d

      SHA512

      f578ceb6cdf4331c8ed6803b01d33a663c37e94acaf9ed687be9688a11395b18cf7603a4a726f5a3736a5c3126cf2753c1e5a39fb01b6646f9f3e8ffd61ae510

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      926KB

      MD5

      5df1243f68a568c1b90a3e1c799c6c81

      SHA1

      a12e5dc2113e43a6329152c698b4f29e88a7177a

      SHA256

      782a64eadadacdc0352fac7c200e4037047d0d1ab4d446e6356a5fa65c58323d

      SHA512

      f578ceb6cdf4331c8ed6803b01d33a663c37e94acaf9ed687be9688a11395b18cf7603a4a726f5a3736a5c3126cf2753c1e5a39fb01b6646f9f3e8ffd61ae510

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      926KB

      MD5

      5df1243f68a568c1b90a3e1c799c6c81

      SHA1

      a12e5dc2113e43a6329152c698b4f29e88a7177a

      SHA256

      782a64eadadacdc0352fac7c200e4037047d0d1ab4d446e6356a5fa65c58323d

      SHA512

      f578ceb6cdf4331c8ed6803b01d33a663c37e94acaf9ed687be9688a11395b18cf7603a4a726f5a3736a5c3126cf2753c1e5a39fb01b6646f9f3e8ffd61ae510

    • C:\Program Files\Orcus\Orcus.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\java.exe.log

      Filesize

      425B

      MD5

      4eaca4566b22b01cd3bc115b9b0b2196

      SHA1

      e743e0792c19f71740416e7b3c061d9f1336bf94

      SHA256

      34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

      SHA512

      bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

    • C:\Users\Admin\AppData\Local\Temp\6jwevuir.dll

      Filesize

      76KB

      MD5

      797c7df4f223bccc204bda80883916ea

      SHA1

      247f43521ba80d8e0bbbcc4773cfb2d0f6d93cb7

      SHA256

      4f0c23f7efad742a8f3e084fb788fdc23d80fb0d67d0a4104d73d2a8b86288d7

      SHA512

      e7bcee0a09ac7943239b00ce7adfc6151e167c840ad4a9254ce989b2506dbd8673bbfb1fdfe00650efc28c263080319b6027fbcedfbee9fd7374024c68a13f12

    • C:\Users\Admin\AppData\Local\Temp\RES3D29.tmp

      Filesize

      1KB

      MD5

      4586f062ce3af3442e9c67a7ce5a3bdf

      SHA1

      e28edf59fd4f3e1381f9c8b3bf826d91f76ce4b6

      SHA256

      ecc59eb739d953b2a5add92e446190edb761a71ab7a472d0d615c280578ada81

      SHA512

      7604afdbc6e2ab31762d648849948feafffda0d4b06705ac9adf89824ee4d9993ab875f63c08e840ebce8e0881c416f3465383ba785eb0c00013252ff2e55cf9

    • C:\Users\Admin\AppData\Local\Temp\java.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Local\Temp\java.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Local\Temp\java.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Local\Temp\java.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Users\Admin\AppData\Local\Temp\java.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • C:\Users\Admin\AppData\Roaming\Orcus\err_9f5db8c63bb047d39e98370a28bee370.dat

      Filesize

      1KB

      MD5

      883c4db2fb3e2c33733c9d3fd0d37fff

      SHA1

      74351c8e76e64d80a8dd1edb4b836d4de1335475

      SHA256

      7851722cbada179347e99453d256dffd424ca58ce67fdc46225bfb81050b39c9

      SHA512

      6c94d8542575f99dc7879e23b87448eac8c6bc29a576ba73f3a1726c0774853bde4ae383eaf335323390a2a588c59e57a16e21a6a39eae5c969b08ae59d5b5b5

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\6jwevuir.0.cs

      Filesize

      208KB

      MD5

      50b2e713d0cf1f3e1034faac3722c5f7

      SHA1

      c107aef426bdf5968eec4b9201ebd8f1463fe971

      SHA256

      f3993f469ca2c01107056cc26f8fef7a293c42079223bdfb40c413288985e472

      SHA512

      eed374819e106f8cbe39a21d4167a27e32e886d2eb13281b024df17311c8df223e2596c792b242f23d49c655dc753a7c432f73b7027b5a2e6e2b2613076b7505

    • \??\c:\Users\Admin\AppData\Local\Temp\6jwevuir.cmdline

      Filesize

      349B

      MD5

      ee31f3d3ce49f5ff6cb75b827ce59c9d

      SHA1

      5016504689927e14396e2f3159190a9f1e99c6d0

      SHA256

      b7b96d0b5c73f601d4c807996d1e668acc5656443e1f52859fd13bba711697f8

      SHA512

      a6ce1345e3ae55fce2ce3c80ce656ab3c85dc44ea353084ef763c83371626df79269ac41a7ba9f5faded7b3a3669d51dc93b674eb1b397b90c51e971175d9875

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC3D28.tmp

      Filesize

      676B

      MD5

      4962d36db72381c618cc78aa5f561ce0

      SHA1

      25781dd010ddb3166a57053b8b7db8e638539fcf

      SHA256

      53c834165be9492418dc6cfbe72a5598acf38b0ef31094c1f01941102a6f810d

      SHA512

      fac4080f0432bdf70bd9b1969ab4ead6e9e1ec2c4b59caf4e59a77ad88bfc0a264b9c0990a986c6bd4b66df9eef993ca9d4012be22e6c471f7776d857014548a

    • memory/1680-103-0x0000000000620000-0x0000000000628000-memory.dmp

      Filesize

      32KB

    • memory/1680-109-0x0000000074EE0000-0x0000000075690000-memory.dmp

      Filesize

      7.7MB

    • memory/1680-104-0x0000000074EE0000-0x0000000075690000-memory.dmp

      Filesize

      7.7MB

    • memory/1940-14-0x0000000002370000-0x0000000002380000-memory.dmp

      Filesize

      64KB

    • memory/2012-112-0x00007FFC2CE60000-0x00007FFC2D921000-memory.dmp

      Filesize

      10.8MB

    • memory/2012-88-0x00007FFC2CE60000-0x00007FFC2D921000-memory.dmp

      Filesize

      10.8MB

    • memory/2056-58-0x00007FFC2CE60000-0x00007FFC2D921000-memory.dmp

      Filesize

      10.8MB

    • memory/2056-50-0x00000000000E0000-0x00000000000EC000-memory.dmp

      Filesize

      48KB

    • memory/2056-51-0x00000000008A0000-0x00000000008B2000-memory.dmp

      Filesize

      72KB

    • memory/2056-52-0x00007FFC2CE60000-0x00007FFC2D921000-memory.dmp

      Filesize

      10.8MB

    • memory/2056-54-0x0000000002370000-0x0000000002380000-memory.dmp

      Filesize

      64KB

    • memory/2056-53-0x00000000022F0000-0x000000000232C000-memory.dmp

      Filesize

      240KB

    • memory/2932-108-0x0000000074EE0000-0x0000000075690000-memory.dmp

      Filesize

      7.7MB

    • memory/2932-117-0x0000000074EE0000-0x0000000075690000-memory.dmp

      Filesize

      7.7MB

    • memory/4004-115-0x000000001AE70000-0x000000001AE80000-memory.dmp

      Filesize

      64KB

    • memory/4004-79-0x00007FFC2CE60000-0x00007FFC2D921000-memory.dmp

      Filesize

      10.8MB

    • memory/4004-114-0x00007FFC2CE60000-0x00007FFC2D921000-memory.dmp

      Filesize

      10.8MB

    • memory/4004-116-0x000000001AE70000-0x000000001AE80000-memory.dmp

      Filesize

      64KB

    • memory/4004-89-0x000000001ADF0000-0x000000001AE00000-memory.dmp

      Filesize

      64KB

    • memory/4004-87-0x000000001AE40000-0x000000001AE58000-memory.dmp

      Filesize

      96KB

    • memory/4004-85-0x000000001B5A0000-0x000000001B5EE000-memory.dmp

      Filesize

      312KB

    • memory/4004-82-0x0000000002300000-0x0000000002312000-memory.dmp

      Filesize

      72KB

    • memory/4004-81-0x000000001AE70000-0x000000001AE80000-memory.dmp

      Filesize

      64KB

    • memory/4004-80-0x0000000000110000-0x00000000001FE000-memory.dmp

      Filesize

      952KB

    • memory/4500-8-0x000000001C8D0000-0x000000001C96C000-memory.dmp

      Filesize

      624KB

    • memory/4500-36-0x000000001E6D0000-0x000000001E6F0000-memory.dmp

      Filesize

      128KB

    • memory/4500-30-0x000000001D450000-0x000000001D46E000-memory.dmp

      Filesize

      120KB

    • memory/4500-29-0x000000001E220000-0x000000001E310000-memory.dmp

      Filesize

      960KB

    • memory/4500-31-0x000000001E320000-0x000000001E369000-memory.dmp

      Filesize

      292KB

    • memory/4500-28-0x000000001DC60000-0x000000001E21A000-memory.dmp

      Filesize

      5.7MB

    • memory/4500-32-0x0000000001690000-0x00000000016A0000-memory.dmp

      Filesize

      64KB

    • memory/4500-27-0x000000001D2F0000-0x000000001D352000-memory.dmp

      Filesize

      392KB

    • memory/4500-33-0x000000001E400000-0x000000001E470000-memory.dmp

      Filesize

      448KB

    • memory/4500-26-0x0000000001720000-0x0000000001728000-memory.dmp

      Filesize

      32KB

    • memory/4500-25-0x00000000015F0000-0x00000000015F8000-memory.dmp

      Filesize

      32KB

    • memory/4500-24-0x0000000001670000-0x0000000001682000-memory.dmp

      Filesize

      72KB

    • memory/4500-22-0x000000001BD30000-0x000000001BD46000-memory.dmp

      Filesize

      88KB

    • memory/4500-78-0x00007FFC2FFC0000-0x00007FFC30961000-memory.dmp

      Filesize

      9.6MB

    • memory/4500-7-0x000000001C400000-0x000000001C8CE000-memory.dmp

      Filesize

      4.8MB

    • memory/4500-6-0x00007FFC2FFC0000-0x00007FFC30961000-memory.dmp

      Filesize

      9.6MB

    • memory/4500-5-0x000000001BCF0000-0x000000001BCFE000-memory.dmp

      Filesize

      56KB

    • memory/4500-2-0x000000001BC50000-0x000000001BCAC000-memory.dmp

      Filesize

      368KB

    • memory/4500-0-0x00007FFC2FFC0000-0x00007FFC30961000-memory.dmp

      Filesize

      9.6MB

    • memory/4500-34-0x0000000001690000-0x00000000016A0000-memory.dmp

      Filesize

      64KB

    • memory/4500-1-0x0000000001690000-0x00000000016A0000-memory.dmp

      Filesize

      64KB

    • memory/5052-113-0x0000000001220000-0x0000000001230000-memory.dmp

      Filesize

      64KB

    • memory/5052-61-0x0000000001220000-0x0000000001230000-memory.dmp

      Filesize

      64KB

    • memory/5052-60-0x00007FFC2CE60000-0x00007FFC2D921000-memory.dmp

      Filesize

      10.8MB

    • memory/5052-110-0x00007FFC2CE60000-0x00007FFC2D921000-memory.dmp

      Filesize

      10.8MB

    • memory/5052-62-0x000000001A160000-0x000000001A26A000-memory.dmp

      Filesize

      1.0MB