orcus | 6895bec83e891c87783c0fd0a99f338205c8426d5cd0f2e298b22979e3e497f2

Analysis

max time kernel
40s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xd.exe
Size

3.0MB
MD5

b8006a0ea8243be30ddbc2009aa05d93
SHA1

81df425e729edd90c7b7e50b995803da783557ef
SHA256

6895bec83e891c87783c0fd0a99f338205c8426d5cd0f2e298b22979e3e497f2
SHA512

4535e0547d479b58663dcc71dc49e7658438e79145cf0eb7d8748864209aa33fb35bf41d506ad527fc25132448c9800ca1cc8eff7568f5af4878da667ad462a4
SSDEEP

49152:6zTEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmNMrZEu:6zTtODUKTslWp2MpbfGGilIJPypSbxE8

Score

10^/10

orcus defense_evasion evasion persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

orcus

89.23.100.155:1337

Mutex

1ff7891fa0904651aeca5ed123954333

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1676-24-0x0000000001810000-0x000000000181A000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Orcus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	xd.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcus main payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c000000023b65-186.dat	family_orcus
behavioral1/files/0x0007000000023cbc-215.dat	family_orcus

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xd.exe

Orcurs Rat Executable 3 IoCs

resource	yara_rule
behavioral1/memory/1676-59-0x0000000020B50000-0x0000000020E4E000-memory.dmp	orcus
behavioral1/files/0x000c000000023b65-186.dat	orcus
behavioral1/files/0x0007000000023cbc-215.dat	orcus

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	xd.exe

Executes dropped EXE 1 IoCs

pid	Process
512	Orcus.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Orcus.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xd.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 2 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	Orcus.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Orcus\Orcus.exe	xd.exe
File opened for modification	C:\Program Files\Orcus\Orcus.exe	xd.exe
File created	C:\Program Files\Orcus\Orcus.exe.config	xd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1344	powershell.exe
1344	powershell.exe
164	powershell.exe
164	powershell.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	512	Orcus.exe
Token: SeDebugPrivilege	164	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 3276	1676	xd.exe	86
PID 1676 wrote to memory of 3276	1676	xd.exe	86
PID 3276 wrote to memory of 4808	3276	csc.exe	89
PID 3276 wrote to memory of 4808	3276	csc.exe	89
PID 1676 wrote to memory of 1344	1676	xd.exe	95
PID 1676 wrote to memory of 1344	1676	xd.exe	95
PID 1676 wrote to memory of 512	1676	xd.exe	114
PID 1676 wrote to memory of 512	1676	xd.exe	114
PID 512 wrote to memory of 164	512	Orcus.exe	115
PID 512 wrote to memory of 164	512	Orcus.exe	115

System policy modification 1 TTPs 14 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xd.exe

C:\Users\Admin\AppData\Local\Temp\xd.exe
"C:\Users\Admin\AppData\Local\Temp\xd.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1676
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y5hqku6x.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC14D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC14C.tmp"
    3⤵
    PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Hijack Execution Flow: Executable Installer File Permissions Weakness
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Orcus\Orcus.exe

Filesize
3.0MB

MD5
b8006a0ea8243be30ddbc2009aa05d93

SHA1
81df425e729edd90c7b7e50b995803da783557ef

SHA256
6895bec83e891c87783c0fd0a99f338205c8426d5cd0f2e298b22979e3e497f2

SHA512
4535e0547d479b58663dcc71dc49e7658438e79145cf0eb7d8748864209aa33fb35bf41d506ad527fc25132448c9800ca1cc8eff7568f5af4878da667ad462a4

Download Submit
C:\Program Files\Orcus\Orcus.exe.config

Filesize
349B

MD5
89817519e9e0b4e703f07e8c55247861

SHA1
4636de1f6c997a25c3190f73f46a3fd056238d78

SHA256
f40dfaa50dcbff93611d45607009158f798e9cd845170939b1d6088a7d10ee13

SHA512
b017cb7a522b9c6794f3691cb7266ec82f565a90d7d07cc9beb53b939d2e9bf34275bc25f6f32d9a9c7136a0aab2189d9556af7244450c610d11ed7a4f584ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1857.exe

Filesize
3.0MB

MD5
0aa6a14b26944d7f9ff50bfcc3e9e0c9

SHA1
de21f62e9ea5618fa793ce3593c6c57e26bdedad

SHA256
b92a6bfcff5ad36cb34871413e4b046bd5d4d2c573ab86b6aaade7f4e23e380a

SHA512
f7c202588f071cbef074b36d7cc3a0aeda7c27af02e20268ba5750803a0ba5c990ce7f50b9f9d32b047110c1ab9e5d9fb65e2f1992c3d8f92b0ea84ddd96103b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC14D.tmp

Filesize
1KB

MD5
e8df2d46bba185975a58c38525aca177

SHA1
5ebe4afde4604039eb5b7690b178be37188c8b01

SHA256
f0f8ef5fe817ba6c1202608ac17a9b926c68301191510930118f981cbf334dc4

SHA512
d7a8a6d918b627426ffb86b80ac4846142ce874328436d1d18253d2f8858391bd93160bb694ad9507ccc58f667b74602b1e561d54e92b206c3017c63f282f4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hvcv33jb.c1u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\y5hqku6x.dll

Filesize
76KB

MD5
678dcccea09c97296d86d5f8feb5337c

SHA1
85cb4f54c71c19ae6fde67cd6d92bc2b7635b668

SHA256
202b18142ec7c292c081ac096560d772e187cabf60d93eebfce4e99db4dc90a3

SHA512
85074b3cb9e67c2c3f132f064d09916093fcce4431e3d864d9d691ec24eb9ac7469e266abe80ecbafdfe3ee4fc8ac3d2a86c53c36c94680c5d8302ad86ca3db9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCC14C.tmp

Filesize
676B

MD5
d86bd19ea12ae646b6d056ed8ba23c11

SHA1
373ab55060ab4f137aacb6aa7b5f0dbe15f7c24f

SHA256
56c0b10c0c7462e21ebc0aa6f4c3dbfd59b1c91b86affc4fca701d2d914859b4

SHA512
74f3ae62b0ecce97b9b8f290e668633f6820113e5ecf50fefeacb925746808ed2bdef9e6669c52a44307f0bafc3100391d2e1f3b78052562e7efd8a0caeceb7a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y5hqku6x.0.cs

Filesize
208KB

MD5
1eb7e32194b55faeb4159e53183057fe

SHA1
95b7f7e01f8452682b4670f525b324c0f2fc1770

SHA256
95e457e46c3d9cc914040ddf3fc80c2f666ce6e1d0679b3b7c0d161394214375

SHA512
254c43fc0ea72f102a8e23533467c8113eaddc7b9083fb5ea4cacc6e39ea74a6728d793ac01897ad2104180dce320c7134fadf7a05b59d70fe2975e545546606

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y5hqku6x.cmdline

Filesize
349B

MD5
3d268e4be3d599f19924777c0ca5805f

SHA1
d89bc10251d77817a290152f92fe346f08697104

SHA256
6638a896065793d64d265e5cee597b6e58bed3d15b50fbf50bff25673268536e

SHA512
7c3c385375152d78832d8e6670b6318077816a8f633211f91838a433a4f7aa6cfa9ec270b1212c3a43d9f152d8dfed02d15f8be1c2c950a56596663dcdd68cc5

Download Submit
memory/1344-47-0x00007FFD4B8D0000-0x00007FFD4C391000-memory.dmp

Filesize
10.8MB

Download
memory/1344-44-0x00007FFD4B8D0000-0x00007FFD4C391000-memory.dmp

Filesize
10.8MB

Download
memory/1344-43-0x00007FFD4B8D0000-0x00007FFD4C391000-memory.dmp

Filesize
10.8MB

Download
memory/1344-32-0x00007FFD4B8D3000-0x00007FFD4B8D5000-memory.dmp

Filesize
8KB

Download
memory/1344-38-0x0000020C41960000-0x0000020C41982000-memory.dmp

Filesize
136KB

Download
memory/1676-83-0x000000001D4D0000-0x000000001D4DA000-memory.dmp

Filesize
40KB

Download
memory/1676-98-0x000000001D4D0000-0x000000001D4E0000-memory.dmp

Filesize
64KB

Download
memory/1676-27-0x00007FFD4F900000-0x00007FFD502A1000-memory.dmp

Filesize
9.6MB

Download
memory/1676-25-0x000000001BEA0000-0x000000001BEA8000-memory.dmp

Filesize
32KB

Download
memory/1676-24-0x0000000001810000-0x000000000181A000-memory.dmp

Filesize
40KB

Download
memory/1676-23-0x0000000001840000-0x0000000001852000-memory.dmp

Filesize
72KB

Download
memory/1676-21-0x000000001BE80000-0x000000001BE96000-memory.dmp

Filesize
88KB

Download
memory/1676-0-0x00007FFD4FBB5000-0x00007FFD4FBB6000-memory.dmp

Filesize
4KB

Download
memory/1676-6-0x000000001CB60000-0x000000001CBFC000-memory.dmp

Filesize
624KB

Download
memory/1676-48-0x000000001E540000-0x000000001E54E000-memory.dmp

Filesize
56KB

Download
memory/1676-49-0x000000001E530000-0x000000001E5B4000-memory.dmp

Filesize
528KB

Download
memory/1676-50-0x000000001D130000-0x000000001D138000-memory.dmp

Filesize
32KB

Download
memory/1676-52-0x000000001E530000-0x000000001E538000-memory.dmp

Filesize
32KB

Download
memory/1676-51-0x000000001E530000-0x000000001E538000-memory.dmp

Filesize
32KB

Download
memory/1676-55-0x000000001E560000-0x000000001E590000-memory.dmp

Filesize
192KB

Download
memory/1676-56-0x000000001E800000-0x000000001E874000-memory.dmp

Filesize
464KB

Download
memory/1676-54-0x000000001E530000-0x000000001E53A000-memory.dmp

Filesize
40KB

Download
memory/1676-53-0x000000001E530000-0x000000001E53C000-memory.dmp

Filesize
48KB

Download
memory/1676-57-0x00007FFD4FBB5000-0x00007FFD4FBB6000-memory.dmp

Filesize
4KB

Download
memory/1676-59-0x0000000020B50000-0x0000000020E4E000-memory.dmp

Filesize
3.0MB

Download
memory/1676-58-0x00007FFD4F900000-0x00007FFD502A1000-memory.dmp

Filesize
9.6MB

Download
memory/1676-61-0x000000001E550000-0x000000001E570000-memory.dmp

Filesize
128KB

Download
memory/1676-62-0x000000001E530000-0x000000001E53E000-memory.dmp

Filesize
56KB

Download
memory/1676-63-0x000000001E800000-0x000000001E894000-memory.dmp

Filesize
592KB

Download
memory/1676-64-0x0000000140000000-0x000000014002C000-memory.dmp

Filesize
176KB

Download
memory/1676-70-0x00007FFD4F900000-0x00007FFD502A1000-memory.dmp

Filesize
9.6MB

Download
memory/1676-71-0x000000001E530000-0x000000001E548000-memory.dmp

Filesize
96KB

Download
memory/1676-72-0x000000001E530000-0x000000001E546000-memory.dmp

Filesize
88KB

Download
memory/1676-73-0x000000001E560000-0x000000001E58A000-memory.dmp

Filesize
168KB

Download
memory/1676-74-0x000000001D4D0000-0x000000001D4D8000-memory.dmp

Filesize
32KB

Download
memory/1676-75-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-76-0x000000001E530000-0x000000001E550000-memory.dmp

Filesize
128KB

Download
memory/1676-77-0x00007FFD4F900000-0x00007FFD502A1000-memory.dmp

Filesize
9.6MB

Download
memory/1676-78-0x000000001E560000-0x000000001E586000-memory.dmp

Filesize
152KB

Download
memory/1676-79-0x000000001E570000-0x000000001E5B0000-memory.dmp

Filesize
256KB

Download
memory/1676-80-0x000000001E570000-0x000000001E5AE000-memory.dmp

Filesize
248KB

Download
memory/1676-81-0x000000001E560000-0x000000001E58C000-memory.dmp

Filesize
176KB

Download
memory/1676-82-0x000000001D4D0000-0x000000001D4D8000-memory.dmp

Filesize
32KB

Download
memory/1676-5-0x000000001C690000-0x000000001CB5E000-memory.dmp

Filesize
4.8MB

Download
memory/1676-86-0x000000001E560000-0x000000001E584000-memory.dmp

Filesize
144KB

Download
memory/1676-89-0x000000001E560000-0x000000001E588000-memory.dmp

Filesize
160KB

Download
memory/1676-90-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-91-0x000000001D4D0000-0x000000001D4DA000-memory.dmp

Filesize
40KB

Download
memory/1676-92-0x000000001E530000-0x000000001E54E000-memory.dmp

Filesize
120KB

Download
memory/1676-99-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-26-0x0000000001800000-0x0000000001808000-memory.dmp

Filesize
32KB

Download
memory/1676-97-0x000000001E530000-0x000000001E544000-memory.dmp

Filesize
80KB

Download
memory/1676-96-0x000000001D4D0000-0x000000001D4DE000-memory.dmp

Filesize
56KB

Download
memory/1676-95-0x000000001D4D0000-0x000000001D4DA000-memory.dmp

Filesize
40KB

Download
memory/1676-94-0x000000001D4D0000-0x000000001D4D8000-memory.dmp

Filesize
32KB

Download
memory/1676-93-0x000000001E530000-0x000000001E54E000-memory.dmp

Filesize
120KB

Download
memory/1676-100-0x000000001E560000-0x000000001E588000-memory.dmp

Filesize
160KB

Download
memory/1676-101-0x000000001D4D0000-0x000000001D4DA000-memory.dmp

Filesize
40KB

Download
memory/1676-102-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-103-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-104-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-105-0x000000001E530000-0x000000001E544000-memory.dmp

Filesize
80KB

Download
memory/1676-106-0x000000001E530000-0x000000001E548000-memory.dmp

Filesize
96KB

Download
memory/1676-107-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-108-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-109-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-110-0x000000001D4D0000-0x000000001D4E0000-memory.dmp

Filesize
64KB

Download
memory/1676-111-0x000000001D4D0000-0x000000001D4DE000-memory.dmp

Filesize
56KB

Download
memory/1676-113-0x000000001E530000-0x000000001E54C000-memory.dmp

Filesize
112KB

Download
memory/1676-112-0x000000001E560000-0x000000001E582000-memory.dmp

Filesize
136KB

Download
memory/1676-114-0x000000001E530000-0x000000001E544000-memory.dmp

Filesize
80KB

Download
memory/1676-115-0x000000001E530000-0x000000001E54A000-memory.dmp

Filesize
104KB

Download
memory/1676-116-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

Filesize
48KB

Download
memory/1676-117-0x000000001D4D0000-0x000000001D4DE000-memory.dmp

Filesize
56KB

Download
memory/1676-118-0x000000001E530000-0x000000001E548000-memory.dmp

Filesize
96KB

Download
memory/1676-119-0x000000001E530000-0x000000001E542000-memory.dmp

Filesize
72KB

Download
memory/1676-120-0x000000001D4D0000-0x000000001D4DE000-memory.dmp

Filesize
56KB

Download
memory/1676-121-0x000000001D4D0000-0x000000001D4DA000-memory.dmp

Filesize
40KB

Download
memory/1676-122-0x000000001D4D0000-0x000000001D4D8000-memory.dmp

Filesize
32KB

Download
memory/1676-123-0x000000001E530000-0x000000001E54C000-memory.dmp

Filesize
112KB

Download
memory/1676-124-0x000000001E530000-0x000000001E54C000-memory.dmp

Filesize
112KB

Download
memory/1676-125-0x000000001D4D0000-0x000000001D4D8000-memory.dmp

Filesize
32KB

Download
memory/1676-126-0x000000001D4D0000-0x000000001D4D8000-memory.dmp

Filesize
32KB

Download
memory/1676-127-0x000000001D4D0000-0x000000001D4D8000-memory.dmp

Filesize
32KB

Download
memory/1676-128-0x000000001D4D0000-0x000000001D4DE000-memory.dmp

Filesize
56KB

Download
memory/1676-129-0x000000001E530000-0x000000001E542000-memory.dmp

Filesize
72KB

Download
memory/1676-130-0x000000001D4D0000-0x000000001D4DE000-memory.dmp

Filesize
56KB

Download
memory/1676-131-0x000000001D4D0000-0x000000001D4DA000-memory.dmp

Filesize
40KB

Download
memory/1676-132-0x000000001E560000-0x000000001E58A000-memory.dmp

Filesize
168KB

Download
memory/1676-133-0x000000001E560000-0x000000001E588000-memory.dmp

Filesize
160KB

Download
memory/1676-134-0x000000001E530000-0x000000001E54E000-memory.dmp

Filesize
120KB

Download
memory/1676-4-0x0000000001730000-0x000000000173E000-memory.dmp

Filesize
56KB

Download
memory/1676-3-0x0000000001780000-0x00000000017DC000-memory.dmp

Filesize
368KB

Download
memory/1676-2-0x00007FFD4F900000-0x00007FFD502A1000-memory.dmp

Filesize
9.6MB

Download
memory/1676-1-0x00007FFD4F900000-0x00007FFD502A1000-memory.dmp

Filesize
9.6MB

Download
memory/3276-15-0x00007FFD4F900000-0x00007FFD502A1000-memory.dmp

Filesize
9.6MB

Download
memory/3276-19-0x00007FFD4F900000-0x00007FFD502A1000-memory.dmp

Filesize
9.6MB

Download