orcus | 675a8aa47c9032b3588c440435744c3a01c04edc4ea204631eee0b53f0405a8f

Resubmissions

26-10-2024 23:19

241026-3a1rfsxrgm 10

26-10-2024 23:18

241026-3absbs1fnl 10

26-10-2024 23:16

241026-29dkjaymaw 10

Analysis

max time kernel
35s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

3.0MB
MD5

7b3150ddd3df859f8f6f36cb041b23f7
SHA1

c3934ab76025c17cab3d309a96c1e32df9ad9d65
SHA256

675a8aa47c9032b3588c440435744c3a01c04edc4ea204631eee0b53f0405a8f
SHA512

a1fe1559965a5eac9a6eef26bbcd559d8a3aa1719f81c35e4106ca0664805cde9566e7bd163fc63a27e356e034b64ef6af5a0f4a299997352bdf4b51e6b6d214
SSDEEP

49152:ONJEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmYXdrZz:ONJtODUKTslWp2MpbfGGilIJPypSbxEw

Score

10^/10

orcus defense_evasion evasion persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

orcus

Index1337z-43991.portmap.host:43991

Mutex

be9b19219c62425cbffd5b98125d81a6

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/3436-24-0x000000001BBB0000-0x000000001BBBA000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Orcus.exetest.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Orcus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	test.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcus main payload 1 IoCs

Processes:

resource	yara_rule
C:\Program Files\Orcus\Orcus.exe	family_orcus

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

test.exeOrcus.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	test.exe

Orcurs Rat Executable 2 IoCs

Processes:

resource	yara_rule
C:\Program Files\Orcus\Orcus.exe	orcus
behavioral1/memory/2860-59-0x0000000000030000-0x000000000032C000-memory.dmp	orcus

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

test.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation test.exe
Executes dropped EXE 1 IoCs

Processes:

Orcus.exe

pid process

2860 Orcus.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	test.exe

pid	process
2860	Orcus.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

test.exeOrcus.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Orcus.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

test.exeOrcus.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	test.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 2 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

Processes:

test.exeOrcus.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	Orcus.exe

Drops file in Program Files directory 3 IoCs

Processes:

test.exe

description	ioc	process
File created	C:\Program Files\Orcus\Orcus.exe	test.exe
File opened for modification	C:\Program Files\Orcus\Orcus.exe	test.exe
File created	C:\Program Files\Orcus\Orcus.exe.config	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

4104 powershell.exe
4104 powershell.exe
4104 powershell.exe
4308 powershell.exe
4308 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4104 powershell.exe
Token: SeDebugPrivilege 4308 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Orcus.exe

pid process

2860 Orcus.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Orcus.exe

pid process

2860 Orcus.exe

pid	process
4104	powershell.exe
4104	powershell.exe
4104	powershell.exe
4308	powershell.exe
4308	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe

pid	process
2860	Orcus.exe

pid	process
2860	Orcus.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

test.execsc.exeOrcus.exe

description	pid	process	target process
PID 3436 wrote to memory of 3156	3436	test.exe	csc.exe
PID 3436 wrote to memory of 3156	3436	test.exe	csc.exe
PID 3156 wrote to memory of 3700	3156	csc.exe	cvtres.exe
PID 3156 wrote to memory of 3700	3156	csc.exe	cvtres.exe
PID 3436 wrote to memory of 4104	3436	test.exe	powershell.exe
PID 3436 wrote to memory of 4104	3436	test.exe	powershell.exe
PID 3436 wrote to memory of 2860	3436	test.exe	Orcus.exe
PID 3436 wrote to memory of 2860	3436	test.exe	Orcus.exe
PID 2860 wrote to memory of 4308	2860	Orcus.exe	powershell.exe
PID 2860 wrote to memory of 4308	2860	Orcus.exe	powershell.exe

System policy modification 1 TTPs 14 IoCs

evasion

Modify Registry

T1112

Processes:

Orcus.exetest.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	Orcus.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3436
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fdorqgj3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB54.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAB44.tmp"
    3⤵
    PID:3700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Hijack Execution Flow: Executable Installer File Permissions Weakness
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Orcus\Orcus.exe

Filesize
3.0MB

MD5
7b3150ddd3df859f8f6f36cb041b23f7

SHA1
c3934ab76025c17cab3d309a96c1e32df9ad9d65

SHA256
675a8aa47c9032b3588c440435744c3a01c04edc4ea204631eee0b53f0405a8f

SHA512
a1fe1559965a5eac9a6eef26bbcd559d8a3aa1719f81c35e4106ca0664805cde9566e7bd163fc63a27e356e034b64ef6af5a0f4a299997352bdf4b51e6b6d214

Download Submit
C:\Program Files\Orcus\Orcus.exe.config

Filesize
349B

MD5
89817519e9e0b4e703f07e8c55247861

SHA1
4636de1f6c997a25c3190f73f46a3fd056238d78

SHA256
f40dfaa50dcbff93611d45607009158f798e9cd845170939b1d6088a7d10ee13

SHA512
b017cb7a522b9c6794f3691cb7266ec82f565a90d7d07cc9beb53b939d2e9bf34275bc25f6f32d9a9c7136a0aab2189d9556af7244450c610d11ed7a4f584ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAB54.tmp

Filesize
1KB

MD5
2f98a96851eade64cc1e29d1a9cfc3e7

SHA1
19e3e51109fc26b3fed4bbfe679c8425004ce553

SHA256
2f9c35bad1a7f83877c9a61da724c03427b77c5c2447d9a50f46d7add1725924

SHA512
0dd4735db23ee222a0becf0f6ac7d56baba64e739d93497255c10ef9a5b3ea06213f162d478638fc95c3b33e0d2d9f0ca1eb5b0e47471b19b2c499cc07fc4a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b5gro2zk.u4c.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdorqgj3.dll

Filesize
76KB

MD5
81b311dfe901c7b74c066c938e10b4fc

SHA1
ad469a13cfc3322322bf420fca56488cd88e96ec

SHA256
b333514cbe187d79a301abfb1e9a72a3a8a29e2fc6f394516db34e7de7a41382

SHA512
50ddb0a79646167fa69a858eb1fb80b4d07e2b5085761dc82770baee28cd61a638df41de75fba9e1d08392b7cf0bc9b93be32e0a3530268f12c8cd9e714b61ab

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCAB44.tmp

Filesize
676B

MD5
e765db30e1c17f80f99cc7770e38dd5f

SHA1
42e6d30dfb93425265347b7970304c479947739f

SHA256
84666eeed177fdab724428c93e7347bead11ac8be99af24c04d9bdb9524a2a07

SHA512
8351f450bdb90193f2c01bb82be8ef1e9e3caad3addfa6321dd8d22821e94161429cf14fe35d4c077a36e469b14c613c2125e5d380df7abb832cb7f4ebfddad7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fdorqgj3.0.cs

Filesize
208KB

MD5
9d78b6ef0cf0f7efd4d774ffda46759c

SHA1
a04f6bc1a9bf598ef41030d5a9691dfc8270c0a2

SHA256
691d94681dd6005b1f78c7e6452d202f06a3527d105a8ce7740b1a57133f204b

SHA512
bf951713645762fc8b28b0fd6b9b89f3bf878137a71129070d8171e3b3ef936e10ef3979eb5ebf8cca63f10beff790d1b2d6f3e01c9604e78c4d73b082e14c0b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fdorqgj3.cmdline

Filesize
349B

MD5
8570395a563330dec5114e0efbdd2000

SHA1
1c0f872aef6928ac65f0aea7bd2b6664128fca6d

SHA256
45bb56920c22e3c3061cdac80b5db77357891ca5435f6defa073ab1b0c0d3834

SHA512
6c915cb866129e3312fa7e72e9448600889d31fa23eecd125f2303bacfac1b7c6c427436d24256184cec029d46af61cdd7449b24fee7eea67c2ee97ed536928f

Download Submit
memory/2860-62-0x000000001AF50000-0x000000001AF60000-memory.dmp

Filesize
64KB

Download
memory/2860-59-0x0000000000030000-0x000000000032C000-memory.dmp

Filesize
3.0MB

Download
memory/2860-61-0x000000001AF30000-0x000000001AF48000-memory.dmp

Filesize
96KB

Download
memory/3156-12-0x00007FFD9EF70000-0x00007FFD9F911000-memory.dmp

Filesize
9.6MB

Download
memory/3156-19-0x00007FFD9EF70000-0x00007FFD9F911000-memory.dmp

Filesize
9.6MB

Download
memory/3436-24-0x000000001BBB0000-0x000000001BBBA000-memory.dmp

Filesize
40KB

Download
memory/3436-60-0x00007FFD9EF70000-0x00007FFD9F911000-memory.dmp

Filesize
9.6MB

Download
memory/3436-25-0x000000001BBA0000-0x000000001BBA8000-memory.dmp

Filesize
32KB

Download
memory/3436-26-0x00007FFD9EF70000-0x00007FFD9F911000-memory.dmp

Filesize
9.6MB

Download
memory/3436-1-0x00007FFD9EF70000-0x00007FFD9F911000-memory.dmp

Filesize
9.6MB

Download
memory/3436-0-0x00007FFD9F225000-0x00007FFD9F226000-memory.dmp

Filesize
4KB

Download
memory/3436-23-0x000000001BBD0000-0x000000001BBE2000-memory.dmp

Filesize
72KB

Download
memory/3436-2-0x000000001BCA0000-0x000000001BCFC000-memory.dmp

Filesize
368KB

Download
memory/3436-3-0x0000000001740000-0x000000000174E000-memory.dmp

Filesize
56KB

Download
memory/3436-4-0x00007FFD9EF70000-0x00007FFD9F911000-memory.dmp

Filesize
9.6MB

Download
memory/3436-21-0x000000001CAE0000-0x000000001CAF6000-memory.dmp

Filesize
88KB

Download
memory/3436-6-0x000000001CA40000-0x000000001CADC000-memory.dmp

Filesize
624KB

Download
memory/3436-5-0x000000001C4D0000-0x000000001C99E000-memory.dmp

Filesize
4.8MB

Download
memory/4104-32-0x000002A878A10000-0x000002A878A32000-memory.dmp

Filesize
136KB

Download
memory/4104-46-0x00007FFD9AF10000-0x00007FFD9B9D1000-memory.dmp

Filesize
10.8MB

Download
memory/4104-43-0x00007FFD9AF10000-0x00007FFD9B9D1000-memory.dmp

Filesize
10.8MB

Download
memory/4104-42-0x00007FFD9AF10000-0x00007FFD9B9D1000-memory.dmp

Filesize
10.8MB

Download
memory/4104-31-0x00007FFD9AF13000-0x00007FFD9AF15000-memory.dmp

Filesize
8KB

Download