orcus | 9c5bedeffdd2f742124a0c081694eea2786a7bf4f9c7963a267aca508ea60f09

Analysis

max time kernel
37s
max time network
32s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-10-2024 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xdrt.exe
Size

3.0MB
MD5

5b6c7b03ad1cf493281271a472dc6b2e
SHA1

edd7fc71647f2713c68391fb8b53488621d2c903
SHA256

9c5bedeffdd2f742124a0c081694eea2786a7bf4f9c7963a267aca508ea60f09
SHA512

3e0fee4c651c5fea933266822f6ff83143f8233a40885640349173e1ab386e06541b92cc522987120adbc5d1c665c9402099f0e5c594cb146d93c00f6e599747
SSDEEP

49152:tNJEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmYXwrZz:tNJtODUKTslWp2MpbfGGilIJPypSbxEw

Score

10^/10

orcus defense_evasion discovery evasion persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

orcus

6.tcp.eu.ngrok.io:10004

Mutex

48cde11ddaf84e58b38e0cc8461c97c5

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/4392-24-0x000000001C680000-0x000000001C68A000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

xdrt.exeOrcus.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Orcus.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcus main payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x001c00000002aae7-51.dat	family_orcus

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

xdrt.exeOrcus.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xdrt.exe

Orcurs Rat Executable 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x001c00000002aae7-51.dat	orcus
behavioral1/memory/2832-61-0x00000000001C0000-0x00000000004BC000-memory.dmp	orcus

Executes dropped EXE 1 IoCs

Processes:

Orcus.exe

pid	Process
2832	Orcus.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

xdrt.exeOrcus.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Orcus.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

xdrt.exeOrcus.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xdrt.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 2 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

Processes:

xdrt.exeOrcus.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	Orcus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

Processes:

flow	ioc
1	6.tcp.eu.ngrok.io

Drops file in Program Files directory 4 IoCs

Processes:

xdrt.exeOrcus.exe

description	ioc	Process
File opened for modification	C:\Program Files\Orcus\Orcus.exe	xdrt.exe
File created	C:\Program Files\Orcus\Orcus.exe.config	xdrt.exe
File opened for modification	C:\Program Files\Orcus\Orcus.exe	Orcus.exe
File created	C:\Program Files\Orcus\Orcus.exe	xdrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXE

pid	Process
2752	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
2752	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
5480	powershell.exe
5480	powershell.exe
4652	powershell.exe
4652	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeOrcus.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	2832	Orcus.exe
Token: SeDebugPrivilege	4652	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Orcus.exe

pid	Process
2832	Orcus.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Orcus.exe

pid	Process
2832	Orcus.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

xdrt.execsc.exeOrcus.execmd.exe

description	pid	Process	procid_target
PID 4392 wrote to memory of 3144	4392	xdrt.exe	77
PID 4392 wrote to memory of 3144	4392	xdrt.exe	77
PID 3144 wrote to memory of 3648	3144	csc.exe	79
PID 3144 wrote to memory of 3648	3144	csc.exe	79
PID 4392 wrote to memory of 5480	4392	xdrt.exe	80
PID 4392 wrote to memory of 5480	4392	xdrt.exe	80
PID 4392 wrote to memory of 2832	4392	xdrt.exe	82
PID 4392 wrote to memory of 2832	4392	xdrt.exe	82
PID 2832 wrote to memory of 4652	2832	Orcus.exe	83
PID 2832 wrote to memory of 4652	2832	Orcus.exe	83
PID 2832 wrote to memory of 2808	2832	Orcus.exe	90
PID 2832 wrote to memory of 2808	2832	Orcus.exe	90
PID 2808 wrote to memory of 2752	2808	cmd.exe	92
PID 2808 wrote to memory of 2752	2808	cmd.exe	92

System policy modification 1 TTPs 14 IoCs

evasion

Modify Registry

T1112

Processes:

Orcus.exexdrt.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xdrt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Orcus.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xdrt.exe
"C:\Users\Admin\AppData\Local\Temp\xdrt.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4392
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\esjm44qs.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87EE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC87ED.tmp"
    3⤵
    PID:3648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5480
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Hijack Execution Flow: Executable Installer File Permissions Weakness
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{f7ced60c-26fb-4cb4-b212-8ddcbc6bd0ff}.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Orcus\Orcus.exe

Filesize
3.0MB

MD5
5b6c7b03ad1cf493281271a472dc6b2e

SHA1
edd7fc71647f2713c68391fb8b53488621d2c903

SHA256
9c5bedeffdd2f742124a0c081694eea2786a7bf4f9c7963a267aca508ea60f09

SHA512
3e0fee4c651c5fea933266822f6ff83143f8233a40885640349173e1ab386e06541b92cc522987120adbc5d1c665c9402099f0e5c594cb146d93c00f6e599747

Download Submit
C:\Program Files\Orcus\Orcus.exe.config

Filesize
349B

MD5
89817519e9e0b4e703f07e8c55247861

SHA1
4636de1f6c997a25c3190f73f46a3fd056238d78

SHA256
f40dfaa50dcbff93611d45607009158f798e9cd845170939b1d6088a7d10ee13

SHA512
b017cb7a522b9c6794f3691cb7266ec82f565a90d7d07cc9beb53b939d2e9bf34275bc25f6f32d9a9c7136a0aab2189d9556af7244450c610d11ed7a4f584ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
408641808e457ab6e23d62e59b767753

SHA1
4205cfa0dfdfee6be08e8c0041d951dcec1d3946

SHA256
3921178878eb416764a6993c4ed81a1f371040dda95c295af535563f168b4258

SHA512
e7f3ffc96c7caad3d73c5cec1e60dc6c7d5ed2ced7d265fbd3a402b6f76fed310a087d2d5f0929ab90413615dad1d54fce52875750057cffe36ff010fc6323fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES87EE.tmp

Filesize
1KB

MD5
ad66faf312d2aa3cef655644a536e723

SHA1
f6602bac5554d676b8e65bc4eefc63360c38c33f

SHA256
5d1bdc97f3ad75819ee9a0b8cc5830d30c1f022626722a7af716b1e4e4918d04

SHA512
84f6dadfd9dffbaa635d806e619ee84f65f12b85a63b36905cddc03eb5ea57c7c63fc01cae417235ded887dc019a2f6179c3155c6425cb6fd253a003f2962300

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jbsusntc.fme.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\esjm44qs.dll

Filesize
76KB

MD5
093a0b51fbd8be5148d3b4921ed9b0ee

SHA1
4fd8bddb6f2f3af913a644e1a6b86c18587cac1f

SHA256
7210a3754111362e7eeac8bf315c2e7c102ae0dfaa0fc9a632572ce6555ee803

SHA512
674cfa849d56794b46deac8f7df937250534b33e9bbbbc3187146f1914699b1861e2efa719ce49778afc027dda6967de8c573f58a1e08b73c7220a963f8218f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{f7ced60c-26fb-4cb4-b212-8ddcbc6bd0ff}.bat

Filesize
171B

MD5
708a6ee3ff2d2f17ccad94ecc9ccf8c4

SHA1
971cd585fb97655cd3f86cbe80359041ecf0605b

SHA256
72bd4715f29087711eec64015d58ea5884e72eaee6ee2b6ab1c720aba0945fef

SHA512
e979c67f94886def6523d415623278dc35e29015152968e9851883258031739719b85d2d5db7636d0fe8cf88734805befc4234e9ea1076b224ebbb9b57128c42

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC87ED.tmp

Filesize
676B

MD5
30a7563fd453875be28747954bde159a

SHA1
3048f88f5dee164afcd59228264d1b4350f2f61b

SHA256
6066e713a118bbef44fdbb73c4de9978cab458f5f99f0f0840029c6c341c001c

SHA512
49e9b9b1a0138de6a18d2af98f446fddb156f71b715606b7b0762fbc0a0ec43a0d8c7a31f10ca87e64a6ee83ad50315472edb0461b9996b9b2224368e5697ad9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\esjm44qs.0.cs

Filesize
208KB

MD5
93f0e697beea6b722e68c61f6586f4bb

SHA1
6f2355f4b2a41d94285a7dbad407f9a72ca83728

SHA256
15602ec06ab3dd64fca5dd82253252f55e5d1b40f3a6c0aad0c9a0a6e2903fca

SHA512
464f6ae5d9e96b843846e3fd711d665e31274f1fc154bca170f25f3e85ad043fe38eaa638676807b7df3819d394ede3b70195339deb716372e957e7fc76676f8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\esjm44qs.cmdline

Filesize
349B

MD5
1633a44994e4fa39d4ae251204f76fb7

SHA1
28047498e92a661824dfda067e8f39fe5fdd8632

SHA256
01910092af997efb22d33124739efa9f049e4e10e65936c99d8523748f4053d4

SHA512
0292b8b05ba08333f38a023d8a95b6836326f848b2362d67988d4819c125b100426b35c90cbf45b208a50c12ef5eaf89646384a2ae036b196bac2363a3d1d9db

Download Submit
memory/2832-76-0x000000001BAA0000-0x000000001BAB2000-memory.dmp

Filesize
72KB

Download
memory/2832-77-0x000000001BB00000-0x000000001BB3C000-memory.dmp

Filesize
240KB

Download
memory/2832-64-0x00000000026F0000-0x0000000002700000-memory.dmp

Filesize
64KB

Download
memory/2832-63-0x00000000026D0000-0x00000000026E8000-memory.dmp

Filesize
96KB

Download
memory/2832-62-0x00000000026B0000-0x00000000026C2000-memory.dmp

Filesize
72KB

Download
memory/2832-61-0x00000000001C0000-0x00000000004BC000-memory.dmp

Filesize
3.0MB

Download
memory/2832-78-0x000000001E520000-0x000000001E62A000-memory.dmp

Filesize
1.0MB

Download
memory/2832-79-0x000000001E410000-0x000000001E45E000-memory.dmp

Filesize
312KB

Download
memory/3144-14-0x00007FF994370000-0x00007FF994D11000-memory.dmp

Filesize
9.6MB

Download
memory/3144-19-0x00007FF994370000-0x00007FF994D11000-memory.dmp

Filesize
9.6MB

Download
memory/4392-32-0x00007FF994625000-0x00007FF994626000-memory.dmp

Filesize
4KB

Download
memory/4392-21-0x000000001C6C0000-0x000000001C6D6000-memory.dmp

Filesize
88KB

Download
memory/4392-33-0x00007FF994370000-0x00007FF994D11000-memory.dmp

Filesize
9.6MB

Download
memory/4392-1-0x00007FF994370000-0x00007FF994D11000-memory.dmp

Filesize
9.6MB

Download
memory/4392-2-0x000000001B750000-0x000000001B7AC000-memory.dmp

Filesize
368KB

Download
memory/4392-3-0x0000000001210000-0x000000000121E000-memory.dmp

Filesize
56KB

Download
memory/4392-0-0x00007FF994625000-0x00007FF994626000-memory.dmp

Filesize
4KB

Download
memory/4392-4-0x00007FF994370000-0x00007FF994D11000-memory.dmp

Filesize
9.6MB

Download
memory/4392-26-0x00007FF994370000-0x00007FF994D11000-memory.dmp

Filesize
9.6MB

Download
memory/4392-60-0x00007FF994370000-0x00007FF994D11000-memory.dmp

Filesize
9.6MB

Download
memory/4392-25-0x000000001C670000-0x000000001C678000-memory.dmp

Filesize
32KB

Download
memory/4392-24-0x000000001C680000-0x000000001C68A000-memory.dmp

Filesize
40KB

Download
memory/4392-23-0x000000001C6A0000-0x000000001C6B2000-memory.dmp

Filesize
72KB

Download
memory/4392-5-0x000000001C060000-0x000000001C52E000-memory.dmp

Filesize
4.8MB

Download
memory/4392-6-0x000000001C5D0000-0x000000001C66C000-memory.dmp

Filesize
624KB

Download
memory/5480-42-0x0000029A2F7E0000-0x0000029A2F802000-memory.dmp

Filesize
136KB

Download
memory/5480-31-0x00007FF9811A3000-0x00007FF9811A5000-memory.dmp

Filesize
8KB

Download
memory/5480-47-0x00007FF9811A0000-0x00007FF981C62000-memory.dmp

Filesize
10.8MB

Download
memory/5480-44-0x00007FF9811A0000-0x00007FF981C62000-memory.dmp

Filesize
10.8MB

Download
memory/5480-43-0x00007FF9811A0000-0x00007FF981C62000-memory.dmp

Filesize
10.8MB

Download