orcus | 4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2

Resubmissions

28-03-2024 06:38

240328-hd4x3ace47 10

28-03-2024 01:50

240328-b9e59aae35 10

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Size

3.0MB
MD5

e067840e2f9733e5d7bc083cc11ed4fa
SHA1

4d9ad6f1c50a9eb4141a17a5af43f0e0c105b9e0
SHA256

4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2
SHA512

278a8da77ac55e97776239813cc9b19940dc6e99a4792a4ecdc806a4b026fe3adb1b1cf6c169545569ef54cad07abc97dd1522fcb939eae2a03a9bd1d3e7f4ec
SSDEEP

49152:WVFonuvKFmwLGZeM9/dFQMDjjzKCkElU+fPONM6WAypQxb1o9JnCmwKWnzFfGI7k:W9CFmwLvEeMDjnpHfP56xypSb1o9JCm

Score

10^/10

orcus conflicker evasion rat spyware stealer trojan

Malware Config

Extracted

Family

orcus

Botnet

Conflicker

Conflicker-35081.portmap.host:35081

Mutex

09bbf5ad32294289979fe0ce356efd76

Attributes

autostart_method
TaskScheduler
enable_keylogger
true
install_path
%programfiles%\Config\Conflicker.exe
reconnect_delay
10000
registry_keyname
Conflicker
taskscheduler_taskname
Secure
watchdog_path
AppData\%appdata%\conflicker\conflicker.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2060-8-0x0000000000740000-0x000000000074A000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Conflicker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe

Orcurs Rat Executable 5 IoCs

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000B10000-0x0000000000E18000-memory.dmp	orcus
behavioral1/memory/2060-47-0x000000001CC60000-0x000000001CF68000-memory.dmp	orcus
behavioral1/memory/2060-51-0x000000001CC60000-0x000000001CF68000-memory.dmp	orcus
behavioral1/files/0x00070000000144e9-224.dat	orcus
behavioral1/files/0x00070000000144e9-244.dat	orcus

Executes dropped EXE 4 IoCs

pid	Process
2148	WindowsInput.exe
2588	WindowsInput.exe
1768	Conflicker.exe
2300	Conflicker.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	Conflicker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Conflicker.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.exe	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Config\Conflicker.exe	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
File created	C:\Program Files\Config\Conflicker.exe.config	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
File created	C:\Program Files\Config\Conflicker.exe	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2484	powershell.exe
2304	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	1768	Conflicker.exe
Token: SeDebugPrivilege	2304	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	Conflicker.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2148	2060	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe	28
PID 2060 wrote to memory of 2148	2060	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe	28
PID 2060 wrote to memory of 2148	2060	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe	28
PID 2060 wrote to memory of 2484	2060	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe	31
PID 2060 wrote to memory of 2484	2060	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe	31
PID 2060 wrote to memory of 2484	2060	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe	31
PID 2060 wrote to memory of 1768	2060	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe	33
PID 2060 wrote to memory of 1768	2060	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe	33
PID 2060 wrote to memory of 1768	2060	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe	33
PID 1660 wrote to memory of 2300	1660	taskeng.exe	35
PID 1660 wrote to memory of 2300	1660	taskeng.exe	35
PID 1660 wrote to memory of 2300	1660	taskeng.exe	35
PID 1768 wrote to memory of 2304	1768	Conflicker.exe	36
PID 1768 wrote to memory of 2304	1768	Conflicker.exe	36
PID 1768 wrote to memory of 2304	1768	Conflicker.exe	36

System policy modification 1 TTPs 16 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	Conflicker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	Conflicker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe
"C:\Users\Admin\AppData\Local\Temp\4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2060
- C:\Windows\SysWOW64\WindowsInput.exe
  "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Program Files\Config\Conflicker.exe
  "C:\Program Files\Config\Conflicker.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2304

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\system32\taskeng.exe
taskeng.exe {BE85436D-8F2F-4D0F-BE0C-6AC336C00B58} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files\Config\Conflicker.exe
  "C:\Program Files\Config\Conflicker.exe"
  2⤵
  - Executes dropped EXE
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Config\Conflicker.exe

Filesize
3.0MB

MD5
e067840e2f9733e5d7bc083cc11ed4fa

SHA1
4d9ad6f1c50a9eb4141a17a5af43f0e0c105b9e0

SHA256
4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2

SHA512
278a8da77ac55e97776239813cc9b19940dc6e99a4792a4ecdc806a4b026fe3adb1b1cf6c169545569ef54cad07abc97dd1522fcb939eae2a03a9bd1d3e7f4ec

Download Submit
C:\Program Files\Config\Conflicker.exe

Filesize
128KB

MD5
7fca7ede989ee726d2b7e6444704314c

SHA1
752ac5e49efb053e1d46e3f439f87adcb6a3125a

SHA256
2cab3db82491e2b9209233261346a1b672bb78d9fbc15b3176d5c0cad5163562

SHA512
385599e5744f3c7fb7e0553d5477eeca1bd1b8dad005045d2445b29c30b1c6468568c3c35726ed3e5544d6fd9b0fc4267679eae7e4ff996629ed3e30bcece4ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YYJTTHQ7H0C13M241FFU.temp

Filesize
7KB

MD5
0ae0b49960dba8f228da5fefcc2b0e8a

SHA1
360fac01b52b2a142bd2c6ff378239805b9b4172

SHA256
d6c45e48118cb61ed894afc354673392d15291776447ddb63ea7d7679051a762

SHA512
2fe463c09a5ed562218c4a377a21854cec082e1412ce75984e6e516fe9a3cf4c5946523a267210d251c4384b0806c26f85003176b3227ac82862154063e40fa4

Download Submit
C:\Users\Admin\AppData\Roaming\conflicker\err_09bbf5ad32294289979fe0ce356efd76.dat

Filesize
1KB

MD5
f9f47e502c73fc9f0d6526c397c8b01b

SHA1
ab82e105597e6d620c06281d147c1f3781bbde91

SHA256
514720e4b4e18ee06d1dbd3b968f9cc69964389ea7047135c61ad9b0477b7123

SHA512
0b157c0bf955d3cb1ab807791a13ac9213b4e206171f24e660ab452f20e90468499934283673b1f629c518e14050655f79873f4a9d28beac85ac1e08926f937c

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe

Filesize
21KB

MD5
b7b8815f40cfcfafe94eedef0f9626f7

SHA1
9309f5f229845c27332d6a98d1e1f864400755c6

SHA256
4a8878876c87cd8d74f90b4947449c6d72bed6d8d70e1643b2e2572a64c0d8a8

SHA512
b5224ec900b13f3da823c1948e1cdad4a9d855ea6da0e07b28b1c412dfcbda84dab829ccc4f414bef35902bc587cc3b2a3d4ce2b60f958081c6ce1ff6be8d12f

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config

Filesize
349B

MD5
89817519e9e0b4e703f07e8c55247861

SHA1
4636de1f6c997a25c3190f73f46a3fd056238d78

SHA256
f40dfaa50dcbff93611d45607009158f798e9cd845170939b1d6088a7d10ee13

SHA512
b017cb7a522b9c6794f3691cb7266ec82f565a90d7d07cc9beb53b939d2e9bf34275bc25f6f32d9a9c7136a0aab2189d9556af7244450c610d11ed7a4f584ba3

Download Submit
memory/2060-70-0x000000001A9F0000-0x000000001AA0C000-memory.dmp

Filesize
112KB

Download
memory/2060-72-0x000000001A9D0000-0x000000001AA0B000-memory.dmp

Filesize
236KB

Download
memory/2060-8-0x0000000000740000-0x000000000074A000-memory.dmp

Filesize
40KB

Download
memory/2060-9-0x0000000000750000-0x0000000000758000-memory.dmp

Filesize
32KB

Download
memory/2060-6-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/2060-5-0x0000000000580000-0x0000000000592000-memory.dmp

Filesize
72KB

Download
memory/2060-1-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/2060-2-0x000000001B230000-0x000000001B2B0000-memory.dmp

Filesize
512KB

Download
memory/2060-56-0x000000001AA00000-0x000000001AA2A000-memory.dmp

Filesize
168KB

Download
memory/2060-4-0x0000000000540000-0x000000000054E000-memory.dmp

Filesize
56KB

Download
memory/2060-58-0x000000001AA00000-0x000000001AA26000-memory.dmp

Filesize
152KB

Download
memory/2060-57-0x000000001A9E0000-0x000000001A9E8000-memory.dmp

Filesize
32KB

Download
memory/2060-84-0x000000001A9E0000-0x000000001A9EE000-memory.dmp

Filesize
56KB

Download
memory/2060-83-0x000000001A9E0000-0x000000001A9EA000-memory.dmp

Filesize
40KB

Download
memory/2060-82-0x000000001A9E0000-0x000000001A9E8000-memory.dmp

Filesize
32KB

Download
memory/2060-81-0x000000001A9E0000-0x000000001A9E8000-memory.dmp

Filesize
32KB

Download
memory/2060-80-0x000000001A9F0000-0x000000001AA0E000-memory.dmp

Filesize
120KB

Download
memory/2060-79-0x000000001A9F0000-0x000000001AA0E000-memory.dmp

Filesize
120KB

Download
memory/2060-78-0x000000001A9E0000-0x000000001A9EA000-memory.dmp

Filesize
40KB

Download
memory/2060-77-0x000000001A9E0000-0x000000001A9EC000-memory.dmp

Filesize
48KB

Download
memory/2060-76-0x000000001A9E0000-0x000000001A9EA000-memory.dmp

Filesize
40KB

Download
memory/2060-75-0x000000001AA00000-0x000000001AA26000-memory.dmp

Filesize
152KB

Download
memory/2060-47-0x000000001CC60000-0x000000001CF68000-memory.dmp

Filesize
3.0MB

Download
memory/2060-49-0x000000001BDA0000-0x000000001BDF6000-memory.dmp

Filesize
344KB

Download
memory/2060-50-0x000000001A9E0000-0x000000001A9EA000-memory.dmp

Filesize
40KB

Download
memory/2060-51-0x000000001CC60000-0x000000001CF68000-memory.dmp

Filesize
3.0MB

Download
memory/2060-52-0x000000001AA00000-0x000000001AA26000-memory.dmp

Filesize
152KB

Download
memory/2060-53-0x000000001A9F0000-0x000000001AA08000-memory.dmp

Filesize
96KB

Download
memory/2060-54-0x000000001A9D0000-0x000000001AA0B000-memory.dmp

Filesize
236KB

Download
memory/2060-55-0x000000001A9F0000-0x000000001AA06000-memory.dmp

Filesize
88KB

Download
memory/2060-3-0x0000000000A80000-0x0000000000ADC000-memory.dmp

Filesize
368KB

Download
memory/2060-85-0x000000001A9F0000-0x000000001AA04000-memory.dmp

Filesize
80KB

Download
memory/2060-74-0x000000001A9F0000-0x000000001AA0C000-memory.dmp

Filesize
112KB

Download
memory/2060-59-0x000000001A9F0000-0x000000001AA0C000-memory.dmp

Filesize
112KB

Download
memory/2060-60-0x000000001C950000-0x000000001CA5A000-memory.dmp

Filesize
1.0MB

Download
memory/2060-61-0x000000001A9E0000-0x000000001A9EC000-memory.dmp

Filesize
48KB

Download
memory/2060-62-0x000000001A9F0000-0x000000001AA10000-memory.dmp

Filesize
128KB

Download
memory/2060-63-0x000000001AA00000-0x000000001AA26000-memory.dmp

Filesize
152KB

Download
memory/2060-64-0x000000001BDA0000-0x000000001BE39000-memory.dmp

Filesize
612KB

Download
memory/2060-65-0x000000001A9D0000-0x000000001A9D6000-memory.dmp

Filesize
24KB

Download
memory/2060-66-0x000000001A9D0000-0x000000001A9DE000-memory.dmp

Filesize
56KB

Download
memory/2060-67-0x000000001C4E0000-0x000000001C5D8000-memory.dmp

Filesize
992KB

Download
memory/2060-68-0x000000001A9D0000-0x000000001AA40000-memory.dmp

Filesize
448KB

Download
memory/2060-69-0x000000001A9D0000-0x000000001AA3D000-memory.dmp

Filesize
436KB

Download
memory/2060-71-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/2060-0-0x0000000000B10000-0x0000000000E18000-memory.dmp

Filesize
3.0MB

Download
memory/2060-7-0x0000000000730000-0x0000000000738000-memory.dmp

Filesize
32KB

Download
memory/2060-73-0x000000001A9F0000-0x000000001AA02000-memory.dmp

Filesize
72KB

Download
memory/2148-24-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/2148-19-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/2148-20-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/2148-21-0x000000001A810000-0x000000001A890000-memory.dmp

Filesize
512KB

Download
memory/2484-42-0x000007FEEC430000-0x000007FEECDCD000-memory.dmp

Filesize
9.6MB

Download
memory/2484-41-0x0000000002C50000-0x0000000002CD0000-memory.dmp

Filesize
512KB

Download
memory/2484-37-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2484-45-0x000007FEEC430000-0x000007FEECDCD000-memory.dmp

Filesize
9.6MB

Download
memory/2484-43-0x0000000002C50000-0x0000000002CD0000-memory.dmp

Filesize
512KB

Download
memory/2484-38-0x000007FEEC430000-0x000007FEECDCD000-memory.dmp

Filesize
9.6MB

Download
memory/2484-39-0x0000000002A60000-0x0000000002A68000-memory.dmp

Filesize
32KB

Download
memory/2484-44-0x0000000002C50000-0x0000000002CD0000-memory.dmp

Filesize
512KB

Download
memory/2484-40-0x0000000002C50000-0x0000000002CD0000-memory.dmp

Filesize
512KB

Download
memory/2588-28-0x0000000019A70000-0x0000000019AF0000-memory.dmp

Filesize
512KB

Download
memory/2588-27-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/2588-26-0x0000000001230000-0x000000000123C000-memory.dmp

Filesize
48KB

Download