orcus | hxxp://example[.]com

Resubmissions

16-07-2024 00:52

240716-a7538axekq 10

16-07-2024 00:38

240716-azbjmszcpe 10

16-07-2024 00:24

240716-aqbs2syhpd 10

Analysis

max time kernel
476s
max time network
475s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16-07-2024 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://example.com

Score

10^/10

orcus rat spyware stealer

Malware Config

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcurs Rat Executable 1 IoCs

resource	yara_rule
behavioral1/memory/1792-582-0x0000000000390000-0x00000000013CE000-memory.dmp	orcus

Executes dropped EXE 3 IoCs

pid	Process
2132	Orcus.Server.exe
4584	poooo.exe
3928	AudioDriver.exe

Loads dropped DLL 4 IoCs

pid	Process
1792	Orcus.Administration.exe
4196	Orcus.Server.exe
2132	Orcus.Server.exe
4568	Orcus.Administration.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	poooo.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	poooo.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
59	raw.githubusercontent.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	poooo.exe
File opened for modification	C:\Windows\assembly	poooo.exe
File created	C:\Windows\assembly\Desktop.ini	poooo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133655642271727309"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\MRUListEx = ffffffff	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 8400310000000000f058f1051100444f574e4c4f7e3100006c0009000400efbe84580662f058f1052e000000975201000000010000000000000000004200000000009d47090144006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1	Orcus.Administration.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 5e00310000000000f058f10510004f524355532d7e310000460009000400efbef058f105f058f1052e0000004da101000000030000000000000000000000000000006b86fd006f0072006300750073002d006d00610069006e00000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1 = 5a00310000000000f058220610005345525645527e310000420009000400efbef0582206f05822062e000000fcac0100000008000000000000000000000000000000d3c82a0173006500720076006500720020003100000018000000	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 500031000000000084583168100041646d696e003c0009000400efbe84580662845831682e0000008f520100000001000000000000000000000000000000c2026300410064006d0069006e00000014000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\NodeSlot = "5"	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Orcus.Administration.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Orcus.Administration.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 7800310000000000845806621100557365727300640009000400efbe724a0b5d845806622e000000320500000000010000000000000000003a0000000000d2dd940055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1104	explorer.exe
2300	explorer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1888	chrome.exe
1888	chrome.exe
2724	chrome.exe
2724	chrome.exe
3928	AudioDriver.exe
3928	AudioDriver.exe
3928	AudioDriver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2300	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe
Token: SeShutdownPrivilege	1888	chrome.exe
Token: SeCreatePagefilePrivilege	1888	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
4196	Orcus.Server.exe
4196	Orcus.Server.exe
4196	Orcus.Server.exe
2132	Orcus.Server.exe
2132	Orcus.Server.exe
1792	Orcus.Administration.exe
3928	AudioDriver.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
1888	chrome.exe
4196	Orcus.Server.exe
4196	Orcus.Server.exe
2132	Orcus.Server.exe
3928	AudioDriver.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
1792	Orcus.Administration.exe
1104	explorer.exe
1104	explorer.exe
1792	Orcus.Administration.exe
1792	Orcus.Administration.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 4804	1888	chrome.exe	73
PID 1888 wrote to memory of 4804	1888	chrome.exe	73
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 312	1888	chrome.exe	75
PID 1888 wrote to memory of 424	1888	chrome.exe	76
PID 1888 wrote to memory of 424	1888	chrome.exe	76
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77
PID 1888 wrote to memory of 1488	1888	chrome.exe	77

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://example.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd7d1b9758,0x7ffd7d1b9768,0x7ffd7d1b9778
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:2
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:8
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2692 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2668 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:8
  2⤵
  PID:596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4412 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4336 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4308 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:8
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1848,i,9367699115618330384,12707413444572552355,131072 /prefetch:8
  2⤵
  PID:4140

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1564

C:\Users\Admin\Downloads\orcus-main\orcus-main\Orcus.Administration.exe
"C:\Users\Admin\Downloads\orcus-main\orcus-main\Orcus.Administration.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1792
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /select, "C:\Users\Admin\Downloads\orcus-main\orcus-main\Orcus.Server.exe"
  2⤵
  PID:3564
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /select, "C:\Users\Admin\Downloads\orcus-main\orcus-main\poooo.exe"
  2⤵
  PID:2452

C:\Users\Admin\Downloads\orcus-main\orcus-main\server\Orcus.Server.exe
"C:\Users\Admin\Downloads\orcus-main\orcus-main\server\Orcus.Server.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4196

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1104
- C:\Users\Admin\Downloads\orcus-main\orcus-main\Orcus.Server.exe
  "C:\Users\Admin\Downloads\orcus-main\orcus-main\Orcus.Server.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2132

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2300
- C:\Users\Admin\Downloads\orcus-main\orcus-main\poooo.exe
  "C:\Users\Admin\Downloads\orcus-main\orcus-main\poooo.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  PID:4584
- - C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3928
- C:\Users\Admin\Downloads\orcus-main\orcus-main\Orcus.Administration.exe
  "C:\Users\Admin\Downloads\orcus-main\orcus-main\Orcus.Administration.exe"
  2⤵
  - Loads dropped DLL
  PID:4568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x310
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
23KB

MD5
cba68946d3694c460fe5acc9d751d427

SHA1
3e93f6164d0ed467f70062275ff14f2aff33fa0e

SHA256
073de9884f36c190971412d4d109e4bdcd3f494d530964dd4686341454654c7f

SHA512
e6cf0ee7039b02e5bb83c11640aab6f897ae7227b18db00befaf5180bb5fa5d85ef2a0f86e9ada1150348db56ee0a4f6756d33bafbb849e2cee3180afe3b0e5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e2e9b2a44a42f24699a74a5db89fa616

SHA1
a8192b7003fd9255364097c5ee62d099813feb43

SHA256
404785025c8121b0cf7895cacfa0007dd1f7779075327ed7c389b08dd72a2247

SHA512
3e0c8efc8b5f24ca0dc1c7f20cb2555fd1880695dd93eafab31bcdfacf0a75e2336599c14b704ff0c925df5c9a37c38b7d3b65df0788e9816574267ede9b7fa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
da0f32309cb6caa86f35f8d9956d3b93

SHA1
deb03c54f6e06201138d43ed77b8c9387c9cd107

SHA256
6e0871331c40539bc2eeef42fd99c29f49ea6226584d28178d00c4b21f814e61

SHA512
ddd2fc58633812bfdbae199e09787a1fb82c7e6299efe9ae6be542bd5015228ed103693e14192917331529cee4fc92ddc9f67657a0ed82d5477c3fb28388ebce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b1c6e1bb816dc1e31f8d2f5b94a27636

SHA1
866a9981fa9780f00bd75bca325680812c822865

SHA256
960120acf476c6dda92a8c8b3fa8bcece4a33d8f5061be92aaa469c0ceec71a8

SHA512
3b332207881fc4703fe3e7890a34f22f48286107a6bdbf0d019dc200ecd3c0480a99764f2c5690a9e01cfdef03e336f20c8894b74d3df92b17fa382bb2e0afdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
2bc64fc7a0f25088248cbfc5c969499e

SHA1
5818ca3f0215896b396593ee58686dce78eb2d21

SHA256
a287fb8e209b1600ebc534da778690358c922bee834b1a37849de738b7f5cdb6

SHA512
c36bcfa45d8ea88c76676988e95f9c73420f0ec57fa1e7c5e8f9bdd387fdfb69e199946ede7a7fe5b220d4985a4b311e557f3a070036710de3b55e523b3afe94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a3a0f4828b20d3b39fdc93950d4fd5fc

SHA1
a15b167c1ba4927c56d8bcf91587c4128d9c4667

SHA256
0015ef8c2d26702b241e3a3e7120cf061f2667411478ec5c4034604efebed8bd

SHA512
853df381b51e9a6f3432c414c945584bae2ecf0261227af9b7ab93096f54219f2e92570298660b0102657196f3574799be93fec08c57fe5fc8faca77617c0db7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
990B

MD5
0117a1716c5954ef759154441c6be786

SHA1
b637a856807ba35c4a7a2198c4d3052cb48f897b

SHA256
76bc0d526fc1616187ae7097a1f9aacd136a9690a23bd01c3d6f6a4c77dbb1b4

SHA512
3bd1c4a460cb13684371144b7494f07707a74b615f00fe52986504f4c7c92746becfbe23186e966fd6750d61dc6f6dcc216cf75c5963cd0683b6649c4e22dae0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3f1ddb3b111c40de2825604613ea76a8

SHA1
0829486a9d6517c34df4e57b2cf0bd6b3c35efdf

SHA256
1c03b56c84e7b7fe8f5598a626046413fde6bd8eb4641f451c4422a07ac6fc65

SHA512
330d69bb8f07fab7508e487a995dddd6f838e91f8546ef81712864a47da052a41be030643162610572b565fb1256632b99315d4997fc25de77a4b373fc6e7408

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
60e5ff82095290defecacb91da02ebef

SHA1
460326a6624dca29e6e5fadf743c660499f7ec32

SHA256
28d0dde3dd22052ae9099f8850d90a5c13789b9ecbe334c659f027589ce8e61f

SHA512
3ea32fb967a93e52dadc3f3ca16cdf76bdbae0a8093d28778a887f6571f214e30e24533e985434b0198d9d80940cf502ae802c67a29200cd9aa053402889e4e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4d07aaaa521047cc683d9b7e4ccf0b26

SHA1
10897da2610786bf10e29845c128646f71101899

SHA256
0d57ec8a927af0d572239b256746ce388f4ac30fcba9dee02bfc932e6a5a2ef7

SHA512
cb934701a8d1f6e14a9d16eb982a1590c0919a4ff0c6e8879b2e0076a47befa37c60d5f6c66643d53eb4f3e7691bb1dd9c246465c6d064d6b95540bf413e727e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5a89982849c54fc526a37b88c72acace

SHA1
2326831138749fc36b79194298d3196cc61bbeb4

SHA256
3bbba6946cf6563eff89f975a9e468003873e8f45ca92e42ba49798ac111c250

SHA512
7d107de41237adfa4cf3b4761b894193b1c2d008810d6c4e7fa9e463143f0c66b4f113d4e4d767e8dfb387f32d2a25f07ad2219cc3f1a5ee5ee3bdc4a0033c7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5ec932e9b7be0c3a68cf248ae1e44687

SHA1
10ae29b4c45f00de4dca82bdf06417b057fb70e6

SHA256
ecd09d1e433a4e61c4aac8b7f357cf0b39cb05c4a4fe212b344c6337583ed2d4

SHA512
1d2eb6c6098b3e5c594b112b846a5ee4dffeffe071f285c067d6555e3a2de66fe31213bd68859a73bf2f76f7229e3890247f53101b7d51fe7afb1818f6a5759c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
43fbfc495c7d2e831c42457b5913f5d5

SHA1
49d3a1f3590c4003d49be10a693c6afaab4d0e55

SHA256
855bb2841732034a064335ce1d511848cf12221087b94be00e654534aa25c48a

SHA512
ffeb33b4f0005225fb29919aff87932e569d735d2074489463a423a56aa929d032e4d6ad96f5d675b754eaf5c5f986c62a9e2f53fc879df85cb7e8c1bbfc313c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e296fe0e0a51ebd85a590af076d8b4a0

SHA1
e15c575818b3f59437a66f0ca14c346ca8208d3a

SHA256
431c04f22dac3175fd6db53a75797e6a915e7a6383abe6317a0e50dd33853b4f

SHA512
91b1ff147982b2fb5f175bf900feeadbf1ed7062a44673c5ab3300454a72228369cfc9cc7b6c7de9d02b2e34659f25d03bad00edfa70797ab65ac48c12869c51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3e94dc80ea710c97a762b8bcb558ec0e

SHA1
1d1b069a1711cfe326e08a99f0a530bb76e39574

SHA256
95baf1d8c88af16623b41f98792b8bfd635dc283c2a56c0ee5a2578ad96cb104

SHA512
f3b9672737196bdbf7831c5e545b4c5ff26bd85502487646c57ee3474236e6ba29e05fa1efad0fe90b92342607e27ed96627e69bb2efaef64dab9102ee6ede95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d553a0b354b028c691bbfea252eb9942

SHA1
9063669a19c162bdfeb9abed09e1d311d4cebce5

SHA256
3c9c52bac2835d26a6182351505ae356ca40a86441fce750e1b02dd55909d74d

SHA512
ffe3dd392f65ae27f791934c7b32652dae49e6cf6f060cc7ecc2d4976e7ec211c8acbeb45bd3833629dcd0603e39ce5601d18da7ec8c2b8e809fd5480eccccb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9f57a41d08865f03c4b629d6364f67b0

SHA1
e6ff67c8c8537724a0a0c018948c15a3500a8208

SHA256
653588b0ae1d7c6eaf1b77226d98fd09a2f34387326c3b9e2f0cb1ab6b50e57d

SHA512
8cb676e7fe5b0ae4097b89c4bf9379c2e554d870ffb5e493b257befacce61d5f002131e2b17aac66b6c117c77a3e4cd6f8ad54c852a85945a2b622d11a450576

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
754347e2af43f9da79e47281aa18b666

SHA1
f5a8df0a0afce321b0cd3b81158a1e57dcab75cd

SHA256
eb363f8f5c88167252f452775dd964d36a9dc4e3ed7a9842cd7c7467e7b2f382

SHA512
d545ca7a89390b1dcd8838069e16d257fe28eac9aa2c43db3122483dd05739335fb256bdd2b3852159d7f0a16b86f5b95e0821a75d6f79b6365239d2f0a358b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
962da00eae69c4009649333d103e2b77

SHA1
b68f29ed8e2d1dca360d095fe11d57b54d1a3f70

SHA256
37ac196cf686df83416bd9becdc03a687921d88a899cadec8637e8c6c1b124f8

SHA512
38d849432fad993d005d5eaabbfa5e460447a24f547a7d683643914900dfeec9c51ddd225564112f3cdcf4a9712c0fbe6e3dabf0d25014bf0ef1040d41efe670

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d20ba4b7d9d6119a46e0b79c3ca2d986

SHA1
b0c38e22d0733ea2a2df8cb242dc0e6e11a7f5ab

SHA256
ae94776409e82133614c897c976410740e3db9d579245fff8317165bd02dfc01

SHA512
d372ff0bf25bbe0bcc801bdb1492ef13b46822e1cdacdd5760571006213f6212f9410a2094c97ec35a764def81641ec7e166ddbc6fe8418bd835016edcc918bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
8cc44bc8645ef7f72b5206700001f8ae

SHA1
0872986209b8ea66fb91f2c0101c91d8f39ad877

SHA256
be70798358af82230a618550ffd483ec89fc1deda24495577934fcfea798d3c6

SHA512
5878289137738f5bea2ba4852c619d4e2e143aac5b5d0c8d0fa5476bacecb835cdb2ee404ab97fa176cf1fa7b1c0e93e89141ac514b42bf8d8100f65abcb5e75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
109KB

MD5
9987f9e66df6527304857b6d3a174544

SHA1
fca3cad6803967809805a5c064cbb2683fd8362e

SHA256
855d06b5221fc215967495a26dae0f829e3c5c4ccf7bd891b60e0572b9b37a27

SHA512
6b0665fad00d672a6b5822ef050798898fa7ee9cfd80c1b1e6c62bf6f3ecbb254104dda5cf4a9116ed137fafb50f4e7e1ef461e948e0a2fdbc4fa3eceed71906

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
3532156d391a7640f180b8b792f65d5e

SHA1
62b52d198af6abfb9c4deff6c84e1e7d3fe92b24

SHA256
26944fec5e363161a9db9a7b68b161139550048ddd763b982ddb017bc0c434b0

SHA512
cbd3b92321e293bf0ae1ed7e752a097c049e220d1e50d93221ffaa5066535fd803203ebc2ad8e95c279a578592491301078e19f8eae21a5323e315f859951835

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
22cb4a6b299433361aca89b18e58d5e1

SHA1
5009f5ce6f8fcc7ad613ccc267afaf20470eb14d

SHA256
311d4baf913543ea340613e1c576220e5f5d2a8994c0c36f46ebd014bd43708d

SHA512
21efff565f40fb532b9c67e17cb4175ccda5f216e5687e8f700354f22f3da1c13b99eef3daff89bbc62016f2003e3279eecfe5c936e49bc72e740b5510ee4f4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57fabb.TMP

Filesize
91KB

MD5
92daf009e982d32ac90252a27d147f24

SHA1
85a990d544c052afb062e68eb51e25cb813c12ba

SHA256
0528c4e443df95e675589e2462e4fb9dc74fda8c9281913592dbd8fda7782ef6

SHA512
ee29d1090b9e2ce2747c3ba2a17861f8732bb1f3469ebced8e807bf341db4b1ad7ebb842e55237d451a76925978fa664b0ee12471ee6e2e37252cf23f5d4c126

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Orcus.Administration.exe.log

Filesize
3KB

MD5
35a9972020e13b77eca4962f760dba7e

SHA1
c16f11fa858a38c60c153dd077d670af14b225d6

SHA256
32582f255505ae8b6178ee12b1a9d56592c04bdf5ec2949e8713a4c49cb9db40

SHA512
d2240ae4e9785ef61d4161e9d2e34ee2f4f1df27653d2f10cb99b8b49aae67e6c769301c98f800cb6ea46c69319ea797d6c49886fab30a252f51e2a29608d55c

Download Submit
C:\Users\Admin\Downloads\orcus-main.zip.crdownload

Filesize
25.0MB

MD5
5f3e12c67b2b4601cc2ffe51625dd7ea

SHA1
091e17ec9124e4061d52583fcde25552845350ad

SHA256
44a34863a81a6cc97cbeb441ee2f87d67c84c74f629d8997824252d949580ee0

SHA512
7b9453f4ab43abd318e8232f5195aa4bdbe059d7acd3a85eacf045e9926cca6f1f6834049a3bee38307e9723ea3527230e96a2e3751dc26ecd39a2432f8b659b

Download Submit
C:\Users\Admin\Downloads\orcus-main\orcus-main\Orcus.Server.exe

Filesize
3.3MB

MD5
423c84c4e8fe8fa7685ceed43acf8335

SHA1
7270183b6507932681257b9d9033f51600c4704d

SHA256
a5e07a905fa95fd8e7370fc706682d823ab9b8974f5867e96f1be9c4e16e0557

SHA512
ae1bbbe7e51df645f2afd3c64b8a8ae87b71db98929a1f87fd4903ec74a5fe54f6d996dbba71ac4dee985f50bb05ce4dd3df55b4965fab0477f01885146724d4

Download Submit
C:\Users\Admin\Downloads\orcus-main\orcus-main\certificate.pfx

Filesize
1KB

MD5
bc71af296f1454b58bd666eb5164317a

SHA1
9d03da57522eae74add524a871c94248bc392c50

SHA256
5142db50f3ce185fa2449d9a52b47fd6f483aef7b4a35e12cf5bad21b7178662

SHA512
33ddc5963c9befc65871f07421276bd98b2f43427f161407ca6b2c7d553c80628a47f6f21615964744fac511eee45537864ddb0dfb1660963a1ec6b014bdb120

Download Submit
C:\Users\Admin\Downloads\orcus-main\orcus-main\log.txt

Filesize
13KB

MD5
5218b765df14cd34935b5b5d17a9c278

SHA1
03b4f12620f9281f07c76a6398c43522f3fffb5e

SHA256
7a4480076bdc7a0f78dea17d2789e145a5f25a9b9d222ac36ed4c270e5c62f51

SHA512
6266059b749ac90c66a46d82f7cb4abb46960c3b89b7fb62fac5da20274696a9d9301f6c69fc1f8c2934c43c257314ddc3e806eeea022addaeef3e5214e7c7aa

Download Submit
C:\Users\Admin\Downloads\orcus-main\orcus-main\log.txt

Filesize
13KB

MD5
74bc96e616232ff0939dd7fc3f37588c

SHA1
c7ebe84844e5c5d52ed5168ee51b01503836dd20

SHA256
cef4779933ff9c8ad693097082c509ce7513438bb4b5c62fbc9d8215527c8748

SHA512
774cc20e1d597457aab5f6b6541569bf8e1c8df8855ae8f3e0340205280348a48e0dc2a147448cb6bc5597ffb7951cee97adeee73654518ce4478b11756490d5

Download Submit
C:\Users\Admin\Downloads\orcus-main\orcus-main\log.txt

Filesize
25KB

MD5
4e7262fdde30f83d4e21b2e71ef61286

SHA1
03659e98a1a376d38c440b70635fceae4133c0a2

SHA256
7b37df1a58ad7e552a42afc35172ba2bf4ef89e8cd57d0f255746fe364553c64

SHA512
45f508f4e3fddb21ef9da53a1c06e1d16d6425548630f29618a994b1954bfa9c50136790427f5d92c192cfb207eeb4d550ea37e83cd080658c680c49064bb66d

Download Submit
C:\Users\Admin\Downloads\orcus-main\orcus-main\poooo.exe

Filesize
839KB

MD5
8a5f4fef99f4897405cbadae7b250619

SHA1
8e151141dd94fcf95545eadefc16b6f32f6d853f

SHA256
c5dcaad2ad405aa4a868870f88f210541f416bcd4b9692dee60f661dbfeba405

SHA512
ce1773648769d17682a6e020c9de64aede3978b4d65fbe13cdc03f5a6efde6a85c9735055a622efb72fabe2675266168544c5825fc9792c6cfb3e6ccafd6e677

Download Submit
C:\Users\Admin\Downloads\orcus-main\orcus-main\settings.json

Filesize
632B

MD5
1c162aad99566a5f5dfc601033dcedb0

SHA1
890b91886415076b329e5bb522f3a3fa22db05b7

SHA256
1aa64891a09ddba7251d051a4b651fd24513653428f77e7c79e52b2f40d42116

SHA512
743ec2b37b276c62ddc47ec9d56f2b187247f4f32969858898870122636170815a2db4645dc784d1c75b8516c973366218d7f92d1d3fae7ea68419bdc53dfdc2

Download Submit
C:\Users\Admin\Downloads\orcus-main\orcus-main\settings.json

Filesize
895B

MD5
c273e081134ba1fb99f1234a47882fa6

SHA1
b15014cee26c6f1fdeb45736039f8b4c09de81ad

SHA256
b764677aaa5382b84c67fdf0a3ee74149980899e66e754f5e1944b0448faafce

SHA512
2c7fc8f8c797ccbfd1be5251c03e096f281d087488318fad269323832f6a2590f45ec797e6ff97054dd229925ad40105cffd8edcc350bec154761d6c3c73896f

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\2C9662276C8B885676D4578FFA67621B\32\sqlite3.dll

Filesize
626KB

MD5
d8aec01ff14e3e7ad43a4b71e30482e4

SHA1
e3015f56f17d845ec7eef11d41bbbc28cc16d096

SHA256
da1d608be064555ab3d3d35e6db64527b8c44f3fa5ddd7c3ec723f80fc99736e

SHA512
f5b2f4bda0cc13e1d1c541fb0caea14081ee4daffd497e31a3d4d55d5f9d85a61158b4891a6527efe623b2f32b697ac912320d9be5c0303812ca98dcc8866fcf

Download Submit
\Users\Admin\AppData\Local\Temp\opus.dll

Filesize
332KB

MD5
1fc04b8bb4896745163df806695ee193

SHA1
39174ce2fca9a3e86bb7a5686037bc42f2572de1

SHA256
3f2b2fd440fdd84288dadfc63e37a4bc7ea0aae26889ab0d4a5ef6148f44ce14

SHA512
3ff18bdd364f27e54ffbf2d1af53e3500ec57e7e8fa14185f7fb1ef6639d69ac6253543b9e2155ade45ca5bcd567e94334f1ee7ad0a7ff28194168dc49883261

Download Submit
memory/1792-610-0x00000000083F0000-0x0000000008482000-memory.dmp

Filesize
584KB

Download
memory/1792-587-0x0000000006660000-0x0000000006762000-memory.dmp

Filesize
1.0MB

Download
memory/1792-596-0x000000000FF80000-0x000000000FF8E000-memory.dmp

Filesize
56KB

Download
memory/1792-597-0x0000000010020000-0x00000000100A8000-memory.dmp

Filesize
544KB

Download
memory/1792-598-0x000000000FF90000-0x000000000FF9A000-memory.dmp

Filesize
40KB

Download
memory/1792-599-0x000000000FFC0000-0x000000000FFD2000-memory.dmp

Filesize
72KB

Download
memory/1792-600-0x00000000100B0000-0x0000000010162000-memory.dmp

Filesize
712KB

Download
memory/1792-601-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1792-602-0x0000000010010000-0x000000001001A000-memory.dmp

Filesize
40KB

Download
memory/1792-603-0x00000000105E0000-0x00000000105E8000-memory.dmp

Filesize
32KB

Download
memory/1792-604-0x00000000079A0000-0x0000000007CE2000-memory.dmp

Filesize
3.3MB

Download
memory/1792-605-0x0000000007E30000-0x0000000007E38000-memory.dmp

Filesize
32KB

Download
memory/1792-606-0x0000000007E90000-0x0000000007E9A000-memory.dmp

Filesize
40KB

Download
memory/1792-607-0x00000000082A0000-0x00000000082B4000-memory.dmp

Filesize
80KB

Download
memory/1792-608-0x00000000082D0000-0x00000000082E2000-memory.dmp

Filesize
72KB

Download
memory/1792-609-0x00000000082F0000-0x0000000008354000-memory.dmp

Filesize
400KB

Download
memory/1792-594-0x000000000C490000-0x000000000C4B2000-memory.dmp

Filesize
136KB

Download
memory/1792-611-0x0000000008360000-0x000000000836C000-memory.dmp

Filesize
48KB

Download
memory/1792-593-0x000000000C4D0000-0x000000000C556000-memory.dmp

Filesize
536KB

Download
memory/1792-616-0x0000000008370000-0x0000000008382000-memory.dmp

Filesize
72KB

Download
memory/1792-617-0x0000000008380000-0x0000000008388000-memory.dmp

Filesize
32KB

Download
memory/1792-618-0x0000000008490000-0x00000000084DA000-memory.dmp

Filesize
296KB

Download
memory/1792-619-0x00000000083A0000-0x00000000083C2000-memory.dmp

Filesize
136KB

Download
memory/1792-620-0x00000000083C0000-0x00000000083D2000-memory.dmp

Filesize
72KB

Download
memory/1792-621-0x00000000090F0000-0x00000000095EE000-memory.dmp

Filesize
5.0MB

Download
memory/1792-622-0x0000000008D30000-0x0000000008D38000-memory.dmp

Filesize
32KB

Download
memory/1792-623-0x0000000008D60000-0x0000000008D68000-memory.dmp

Filesize
32KB

Download
memory/1792-624-0x0000000009090000-0x00000000090DC000-memory.dmp

Filesize
304KB

Download
memory/1792-625-0x0000000009050000-0x0000000009060000-memory.dmp

Filesize
64KB

Download
memory/1792-626-0x000000000B810000-0x000000000B818000-memory.dmp

Filesize
32KB

Download
memory/1792-627-0x000000000BA00000-0x000000000BA08000-memory.dmp

Filesize
32KB

Download
memory/1792-628-0x000000000BAA0000-0x000000000BAD8000-memory.dmp

Filesize
224KB

Download
memory/1792-629-0x0000000006A00000-0x0000000006A10000-memory.dmp

Filesize
64KB

Download
memory/1792-630-0x000000007366E000-0x000000007366F000-memory.dmp

Filesize
4KB

Download
memory/1792-631-0x0000000073660000-0x0000000073D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1792-581-0x000000007366E000-0x000000007366F000-memory.dmp

Filesize
4KB

Download
memory/1792-592-0x000000000C420000-0x000000000C432000-memory.dmp

Filesize
72KB

Download
memory/1792-582-0x0000000000390000-0x00000000013CE000-memory.dmp

Filesize
16.2MB

Download
memory/1792-583-0x0000000005BF0000-0x0000000005CA0000-memory.dmp

Filesize
704KB

Download
memory/1792-785-0x0000000073660000-0x0000000073D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1792-584-0x00000000062B0000-0x0000000006546000-memory.dmp

Filesize
2.6MB

Download
memory/1792-585-0x0000000073660000-0x0000000073D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1792-775-0x0000000015EF0000-0x00000000164F6000-memory.dmp

Filesize
6.0MB

Download
memory/1792-774-0x00000000074C0000-0x0000000007540000-memory.dmp

Filesize
512KB

Download
memory/1792-773-0x0000000006D40000-0x0000000006D68000-memory.dmp

Filesize
160KB

Download
memory/1792-766-0x00000000068A0000-0x00000000068C0000-memory.dmp

Filesize
128KB

Download
memory/1792-586-0x00000000061A0000-0x000000000628C000-memory.dmp

Filesize
944KB

Download
memory/1792-733-0x0000000006570000-0x000000000657E000-memory.dmp

Filesize
56KB

Download
memory/1792-732-0x0000000006840000-0x0000000006854000-memory.dmp

Filesize
80KB

Download
memory/1792-595-0x000000000C560000-0x000000000C8B0000-memory.dmp

Filesize
3.3MB

Download
memory/1792-588-0x0000000006290000-0x00000000062AC000-memory.dmp

Filesize
112KB

Download
memory/1792-591-0x0000000006630000-0x0000000006648000-memory.dmp

Filesize
96KB

Download
memory/1792-590-0x0000000006170000-0x0000000006176000-memory.dmp

Filesize
24KB

Download
memory/1792-589-0x0000000006550000-0x000000000656C000-memory.dmp

Filesize
112KB

Download
memory/2132-771-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2132-769-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2132-805-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2132-800-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2132-767-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2132-734-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2132-719-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/4196-655-0x000000000BCC0000-0x000000000BCCA000-memory.dmp

Filesize
40KB

Download
memory/4196-642-0x00000000066C0000-0x00000000066F0000-memory.dmp

Filesize
192KB

Download
memory/4196-649-0x0000000007630000-0x000000000763A000-memory.dmp

Filesize
40KB

Download
memory/4196-632-0x0000000000CB0000-0x0000000001002000-memory.dmp

Filesize
3.3MB

Download
memory/4196-650-0x00000000098C0000-0x0000000009B56000-memory.dmp

Filesize
2.6MB

Download
memory/4196-653-0x000000000BE00000-0x000000000BE7C000-memory.dmp

Filesize
496KB

Download
memory/4196-643-0x0000000006C60000-0x0000000006CAB000-memory.dmp

Filesize
300KB

Download
memory/4196-644-0x0000000007370000-0x00000000073AC000-memory.dmp

Filesize
240KB

Download
memory/4196-641-0x0000000006E40000-0x000000000736C000-memory.dmp

Filesize
5.2MB

Download
memory/4196-640-0x0000000006740000-0x0000000006902000-memory.dmp

Filesize
1.8MB

Download
memory/4196-639-0x0000000005E20000-0x0000000005E6C000-memory.dmp

Filesize
304KB

Download
memory/4196-638-0x0000000005CF0000-0x0000000005D1C000-memory.dmp

Filesize
176KB

Download
memory/4196-654-0x000000000AA20000-0x000000000AA2C000-memory.dmp

Filesize
48KB

Download
memory/4196-645-0x0000000006DD0000-0x0000000006DF0000-memory.dmp

Filesize
128KB

Download
memory/4196-657-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download