Analysis

  • max time kernel
    353s
  • max time network
    376s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-02-2024 15:18

General

  • Target

    file.exe

  • Size

    914KB

  • MD5

    12ad4c2b63d32b4579f03992e362f8ef

  • SHA1

    c38692667cdfd7f2b8bc67f3d7165f72fba74552

  • SHA256

    d699d584b651c6da780801cb6c2fb074464ce36e46b287658913d8bb67d2329b

  • SHA512

    c03c47ce05435eeed509021cd844a0530480b9cef30a60d0b7c1c4914b7b425edf86ef78be0e2929d198c5561e69445605d02a10a73a66ba11183f079f500ca0

  • SSDEEP

    24576:+am4MROxnFD3wrXYf1rrcI0AilFEvxHPmE7ooj:+OMiJJrrcI0AilFEvxHP

Malware Config

Extracted

Family

orcus

C2

4.tcp.eu.ngrok.io:15428

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    System3222

  • taskscheduler_taskname

    System3222

  • watchdog_path

    AppData\Sys322.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 37 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Drops file in System32 directory 14 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe" --install
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:2836
    • C:\Program Files (x86)\Orcus\Orcus.exe
      "C:\Program Files (x86)\Orcus\Orcus.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:372
      • C:\Users\Admin\AppData\Roaming\Sys322.exe
        "C:\Users\Admin\AppData\Roaming\Sys322.exe" /launchSelfAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 372 /protectFile
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3272
        • C:\Users\Admin\AppData\Roaming\Sys322.exe
          "C:\Users\Admin\AppData\Roaming\Sys322.exe" /watchProcess "C:\Program Files (x86)\Orcus\Orcus.exe" 372 "/protectFile"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4800
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{386365d9-0e24-4dd9-86b1-ec6db5d8375a}.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1388
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKCR/.exe
          4⤵
            PID:1980
          • C:\Windows\SysWOW64\reg.exe
            reg delete HKCR/.dll
            4⤵
              PID:5116
            • C:\Windows\SysWOW64\reg.exe
              reg delete HKCR/*
              4⤵
                PID:960
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{b64d9d2d-7a9e-41c8-b1f6-90d0ea20240e}.bat""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:404
              • C:\Windows\SysWOW64\reg.exe
                reg delete HKCR/.exe
                4⤵
                  PID:1728
                • C:\Windows\SysWOW64\reg.exe
                  reg delete HKCR/.dll
                  4⤵
                    PID:976
                  • C:\Windows\SysWOW64\reg.exe
                    reg delete HKCR/*
                    4⤵
                      PID:3172
              • C:\Windows\SysWOW64\WindowsInput.exe
                "C:\Windows\SysWOW64\WindowsInput.exe"
                1⤵
                • Executes dropped EXE
                PID:1596
              • C:\Program Files (x86)\Orcus\Orcus.exe
                "C:\Program Files (x86)\Orcus\Orcus.exe"
                1⤵
                • Executes dropped EXE
                PID:100
              • C:\Windows\system32\mspaint.exe
                "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UndoAdd.jpeg" /ForceBootstrapPaint3D
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:2692
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
                1⤵
                • Drops file in System32 directory
                PID:3952
              • C:\Windows\system32\OpenWith.exe
                C:\Windows\system32\OpenWith.exe -Embedding
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:2988
              • C:\Program Files (x86)\Orcus\Orcus.exe
                "C:\Program Files (x86)\Orcus\Orcus.exe"
                1⤵
                • Executes dropped EXE
                PID:3400

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Orcus\Orcus.exe

                Filesize

                914KB

                MD5

                12ad4c2b63d32b4579f03992e362f8ef

                SHA1

                c38692667cdfd7f2b8bc67f3d7165f72fba74552

                SHA256

                d699d584b651c6da780801cb6c2fb074464ce36e46b287658913d8bb67d2329b

                SHA512

                c03c47ce05435eeed509021cd844a0530480b9cef30a60d0b7c1c4914b7b425edf86ef78be0e2929d198c5561e69445605d02a10a73a66ba11183f079f500ca0

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Orcus.exe.log

                Filesize

                1KB

                MD5

                0672db2ef13237d5cb85075ff4915942

                SHA1

                ad8b4d3eb5e40791c47d48b22e273486f25f663f

                SHA256

                0a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519

                SHA512

                84ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b

              • C:\Users\Admin\AppData\Local\Temp\{386365d9-0e24-4dd9-86b1-ec6db5d8375a}.bat

                Filesize

                174B

                MD5

                0788759f44355b956cae8668aa85bf99

                SHA1

                b6d6596cacdab8a732df173911e231460788ddc9

                SHA256

                22c41c5bf7d98874fc676bd6a14718093f180a9d20f4c70b8601a4144f1ab26c

                SHA512

                06e461beba4a4140a54b8ed14bace096630d30647ec437cf0e58009706a8785b03fff51cf1da857001d482c08ec5d80fc85331ca6bd029a2228040b34fa3e3bf

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\AForge.Video.DirectShow.dll

                Filesize

                60KB

                MD5

                17ed442e8485ac3f7dc5b3c089654a61

                SHA1

                d3a17c1fdd6d54951141053f88bf8238dea0b937

                SHA256

                666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b

                SHA512

                9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\AForge.Video.dll

                Filesize

                20KB

                MD5

                0bd34aa29c7ea4181900797395a6da78

                SHA1

                ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8

                SHA256

                bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d

                SHA512

                a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\CSCore.dll

                Filesize

                516KB

                MD5

                dde3ec6e17bc518b10c99efbd09ab72e

                SHA1

                a2306e60b74b8a01a0dbc1199a7fffca288f2033

                SHA256

                60a5077b443273238e6629ce5fc3ff7ee3592ea2e377b8fc28bfe6e76bda64b8

                SHA512

                09a528c18291980ca7c5ddca67625035bbb21b9d95ab0854670d28c59c4e7adc6d13a356fa1d2c9ad75d16b334ae9818e06ddb10408a3e776e4ef0d7b295f877

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\DirectoryInfoEx.dll

                Filesize

                224KB

                MD5

                314955d214bb02847e7f8607a16ec550

                SHA1

                c471e2948d0cd1d4a11902a134735f00cd78c0c1

                SHA256

                82fd40348eb630313d5032910d021ebd982fdde086fbe73ba8947a6d2cb40357

                SHA512

                0ea2457db279159c1983455eee50a69305a151c012b9948950d038c101efc08a00da1f456a76a4351770684783c2e01a536ea194bb7f586865865d90d6dbb8de

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\ICSharpCode.SharpZipLib.dll

                Filesize

                196KB

                MD5

                c8164876b6f66616d68387443621510c

                SHA1

                7a9df9c25d49690b6a3c451607d311a866b131f4

                SHA256

                40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d

                SHA512

                44a6accc70c312a16d0e533d3287e380997c5e5d610dbeaa14b2dbb5567f2c41253b895c9817ecd96c85d286795bbe6ab35fd2352fddd9d191669a2fb0774bc4

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\OpusWrapper.dll

                Filesize

                843KB

                MD5

                bf0ef47bea0139b87d42a449a0240101

                SHA1

                37b65cd6830088707be692d4602b10062a46b91a

                SHA256

                07ec44bca9b44de3b22f9d212db3ecc5191201e27e4310d7bb2b199deffbab5a

                SHA512

                830c5b380c844a8490cf482ef4ca4821b6185f5fd204c3edf21de0b449727448835b9cbfb103eb74aa91f05abb7390ed1c0ed5e815a7101d9127fc38382daa8a

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\SharpDX.DXGI.dll

                Filesize

                125KB

                MD5

                2b44c70c49b70d797fbb748158b5d9bb

                SHA1

                93e00e6527e461c45c7868d14cf05c007e478081

                SHA256

                3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf

                SHA512

                faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\SharpDX.Direct3D11.dll

                Filesize

                271KB

                MD5

                98eb5ba5871acdeaebf3a3b0f64be449

                SHA1

                c965284f60ef789b00b10b3df60ee682b4497de3

                SHA256

                d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c

                SHA512

                a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\SharpDX.Direct3D9.dll

                Filesize

                338KB

                MD5

                934da0e49208d0881c44fe19d5033840

                SHA1

                a19c5a822e82e41752a08d3bd9110db19a8a5016

                SHA256

                02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7

                SHA512

                de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\SharpDX.dll

                Filesize

                247KB

                MD5

                ffb4b61cc11bec6d48226027c2c26704

                SHA1

                fa8b9e344accbdc4dffa9b5d821d23f0716da29e

                SHA256

                061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303

                SHA512

                48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\ShellLibrary.dll

                Filesize

                64KB

                MD5

                20aa983bd64aa1f8a37d9e61961eabec

                SHA1

                48dfd92883f6b60252ab01e57f8de75d21edf173

                SHA256

                ace8dc565164e7612ed3f964a5d16bdcdda0aac7185ba3639b3b7c6064ca1124

                SHA512

                27560fc2983cde678bc3367563c05452004db9dc2523e30ed43ecc413e1ead0eb5d77152f17bd17c58dfe48b2ff7c1c413b6b4da483a664bab3167e74dc3486d

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\TurboJpegWrapper.dll

                Filesize

                1.3MB

                MD5

                ac6acc235ebef6374bed71b37e322874

                SHA1

                a267baad59cd7352167636836bad4b971fcd6b6b

                SHA256

                047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96

                SHA512

                72ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081

              • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\x86\turbojpeg.dll

                Filesize

                646KB

                MD5

                82898ed19da89d7d44e280a3ced95e9b

                SHA1

                eec0af5733c642eac8c5e08479f462d1ec1ed4db

                SHA256

                5f4b9f8360764d75c9faaecd94f6d200c54611b33064cd216e363d973dae7c29

                SHA512

                ee7b884ce7d7366ee28fb17721b6c89bd4eba8fb373cdbb483e26a4ed7a74ab5db847513c54704d753d77a7e18b1fb9fee90ed6bbc0540bff702273fda36b682

              • C:\Users\Admin\AppData\Roaming\Sys322.exe

                Filesize

                9KB

                MD5

                913967b216326e36a08010fb70f9dba3

                SHA1

                7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

                SHA256

                8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

                SHA512

                c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

              • C:\Windows\SysWOW64\WindowsInput.exe

                Filesize

                21KB

                MD5

                e6fcf516d8ed8d0d4427f86e08d0d435

                SHA1

                c7691731583ab7890086635cb7f3e4c22ca5e409

                SHA256

                8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

                SHA512

                c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

              • C:\Windows\SysWOW64\WindowsInput.exe.config

                Filesize

                357B

                MD5

                a2b76cea3a59fa9af5ea21ff68139c98

                SHA1

                35d76475e6a54c168f536e30206578babff58274

                SHA256

                f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

                SHA512

                b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

              • memory/100-56-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/100-83-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/372-51-0x0000000005790000-0x00000000057A0000-memory.dmp

                Filesize

                64KB

              • memory/372-123-0x0000000040000000-0x00000000400C3000-memory.dmp

                Filesize

                780KB

              • memory/372-53-0x0000000005D10000-0x0000000005D5E000-memory.dmp

                Filesize

                312KB

              • memory/372-52-0x00000000058D0000-0x00000000058E2000-memory.dmp

                Filesize

                72KB

              • memory/372-55-0x00000000065D0000-0x00000000065E8000-memory.dmp

                Filesize

                96KB

              • memory/372-50-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/372-57-0x0000000006790000-0x00000000067A0000-memory.dmp

                Filesize

                64KB

              • memory/372-58-0x0000000006EF0000-0x00000000070B2000-memory.dmp

                Filesize

                1.8MB

              • memory/372-59-0x0000000006910000-0x000000000691A000-memory.dmp

                Filesize

                40KB

              • memory/372-653-0x000000000AF20000-0x000000000AFCA000-memory.dmp

                Filesize

                680KB

              • memory/372-527-0x00000000078A0000-0x00000000078D4000-memory.dmp

                Filesize

                208KB

              • memory/372-520-0x0000000008850000-0x0000000008866000-memory.dmp

                Filesize

                88KB

              • memory/372-513-0x0000000008890000-0x00000000088CE000-memory.dmp

                Filesize

                248KB

              • memory/372-289-0x0000000007F20000-0x0000000007F36000-memory.dmp

                Filesize

                88KB

              • memory/372-81-0x0000000007A90000-0x0000000007AF6000-memory.dmp

                Filesize

                408KB

              • memory/372-282-0x0000000001430000-0x000000000143C000-memory.dmp

                Filesize

                48KB

              • memory/372-84-0x0000000008130000-0x0000000008748000-memory.dmp

                Filesize

                6.1MB

              • memory/372-85-0x0000000007B10000-0x0000000007B22000-memory.dmp

                Filesize

                72KB

              • memory/372-86-0x0000000007B70000-0x0000000007BAC000-memory.dmp

                Filesize

                240KB

              • memory/372-87-0x0000000007BB0000-0x0000000007BFC000-memory.dmp

                Filesize

                304KB

              • memory/372-88-0x0000000007D30000-0x0000000007E3A000-memory.dmp

                Filesize

                1.0MB

              • memory/372-256-0x00000000092C0000-0x0000000009414000-memory.dmp

                Filesize

                1.3MB

              • memory/372-249-0x0000000001450000-0x0000000001476000-memory.dmp

                Filesize

                152KB

              • memory/372-91-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/372-92-0x0000000005790000-0x00000000057A0000-memory.dmp

                Filesize

                64KB

              • memory/372-242-0x00000000074F0000-0x000000000754A000-memory.dmp

                Filesize

                360KB

              • memory/372-235-0x00000000074A0000-0x00000000074EA000-memory.dmp

                Filesize

                296KB

              • memory/372-98-0x00000000016A0000-0x0000000001726000-memory.dmp

                Filesize

                536KB

              • memory/372-228-0x0000000007450000-0x0000000007494000-memory.dmp

                Filesize

                272KB

              • memory/372-105-0x0000000007E40000-0x0000000007F1A000-memory.dmp

                Filesize

                872KB

              • memory/372-108-0x0000000005790000-0x00000000057A0000-memory.dmp

                Filesize

                64KB

              • memory/372-110-0x0000000040000000-0x000000004043E000-memory.dmp

                Filesize

                4.2MB

              • memory/372-117-0x0000000040000000-0x000000004049D000-memory.dmp

                Filesize

                4.6MB

              • memory/372-153-0x0000000040000000-0x0000000040032000-memory.dmp

                Filesize

                200KB

              • memory/372-128-0x0000000040000000-0x000000004034B000-memory.dmp

                Filesize

                3.3MB

              • memory/372-134-0x0000000040000000-0x0000000040A99000-memory.dmp

                Filesize

                10.6MB

              • memory/372-140-0x0000000040000000-0x0000000040007000-memory.dmp

                Filesize

                28KB

              • memory/372-148-0x0000000006770000-0x000000000677C000-memory.dmp

                Filesize

                48KB

              • memory/1596-89-0x00007FF9DAB30000-0x00007FF9DB5F1000-memory.dmp

                Filesize

                10.8MB

              • memory/1596-31-0x00007FF9DAB30000-0x00007FF9DB5F1000-memory.dmp

                Filesize

                10.8MB

              • memory/1596-32-0x0000000001270000-0x0000000001280000-memory.dmp

                Filesize

                64KB

              • memory/1596-33-0x000000001AB90000-0x000000001AC9A000-memory.dmp

                Filesize

                1.0MB

              • memory/1596-90-0x0000000001270000-0x0000000001280000-memory.dmp

                Filesize

                64KB

              • memory/2836-29-0x00007FF9DAB30000-0x00007FF9DB5F1000-memory.dmp

                Filesize

                10.8MB

              • memory/2836-25-0x0000000002550000-0x000000000258C000-memory.dmp

                Filesize

                240KB

              • memory/2836-24-0x0000000000C00000-0x0000000000C12000-memory.dmp

                Filesize

                72KB

              • memory/2836-23-0x00007FF9DAB30000-0x00007FF9DB5F1000-memory.dmp

                Filesize

                10.8MB

              • memory/2836-22-0x0000000000320000-0x000000000032C000-memory.dmp

                Filesize

                48KB

              • memory/3272-78-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/3272-74-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/3272-73-0x0000000000D00000-0x0000000000D08000-memory.dmp

                Filesize

                32KB

              • memory/3400-772-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/3400-771-0x0000000005430000-0x0000000005440000-memory.dmp

                Filesize

                64KB

              • memory/3400-770-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/4800-93-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/4800-77-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/4944-6-0x00000000059A0000-0x0000000005A32000-memory.dmp

                Filesize

                584KB

              • memory/4944-4-0x0000000005820000-0x000000000587C000-memory.dmp

                Filesize

                368KB

              • memory/4944-3-0x0000000001950000-0x000000000195E000-memory.dmp

                Filesize

                56KB

              • memory/4944-5-0x0000000005F50000-0x00000000064F4000-memory.dmp

                Filesize

                5.6MB

              • memory/4944-2-0x0000000005990000-0x00000000059A0000-memory.dmp

                Filesize

                64KB

              • memory/4944-49-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/4944-1-0x0000000074AF0000-0x00000000752A0000-memory.dmp

                Filesize

                7.7MB

              • memory/4944-0-0x0000000000EB0000-0x0000000000F9A000-memory.dmp

                Filesize

                936KB

              • memory/4944-7-0x0000000005980000-0x0000000005992000-memory.dmp

                Filesize

                72KB

              • memory/4944-8-0x0000000005EB0000-0x0000000005ED2000-memory.dmp

                Filesize

                136KB