Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-03-2023 02:25
Behavioral task
behavioral1
Sample
CheatHubLauncher.exe
Resource
win7-20230220-en
General
-
Target
CheatHubLauncher.exe
-
Size
12.8MB
-
MD5
0fb32f1fc38ca023300ba5a7b339bbb9
-
SHA1
4cb9f12f4c6ad6fab6926c50116de275f8f75366
-
SHA256
e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
-
SHA512
91db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
SSDEEP
24576:jhf4MROxnFj3JrkxrrcI0AilFEvxHP2ooOtmUh+P:jSMi19qrrcI0AilFEvxHPrmUh+
Malware Config
Extracted
orcus
6.tcp.eu.ngrok.io:15409
4f410509b9144dd9acb87977aa081e27
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
C:\Windows\security\logs\svchost.exe
-
reconnect_delay
10000
-
registry_keyname
svchost
-
taskscheduler_taskname
svchost
-
watchdog_path
AppData\svchost.exe
Signatures
-
Orcus main payload 5 IoCs
Processes:
resource yara_rule \Windows\security\logs\svchost.exe family_orcus C:\Windows\security\logs\svchost.exe family_orcus C:\Windows\security\logs\svchost.exe family_orcus C:\Windows\security\logs\svchost.exe family_orcus C:\Windows\security\logs\svchost.exe family_orcus -
Orcurs Rat Executable 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1212-54-0x0000000000AB0000-0x0000000000BB8000-memory.dmp orcus \Windows\security\logs\svchost.exe orcus C:\Windows\security\logs\svchost.exe orcus C:\Windows\security\logs\svchost.exe orcus C:\Windows\security\logs\svchost.exe orcus behavioral1/memory/1716-69-0x0000000000F10000-0x0000000001018000-memory.dmp orcus C:\Windows\security\logs\svchost.exe orcus -
Executes dropped EXE 4 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exepid process 1716 svchost.exe 1096 svchost.exe 1388 svchost.exe 1732 svchost.exe -
Loads dropped DLL 16 IoCs
Processes:
CheatHubLauncher.exesvchost.exesvchost.exepid process 1212 CheatHubLauncher.exe 1716 svchost.exe 1096 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 3 IoCs
Processes:
CheatHubLauncher.exedescription ioc process File created C:\Windows\security\logs\svchost.exe CheatHubLauncher.exe File opened for modification C:\Windows\security\logs\svchost.exe CheatHubLauncher.exe File created C:\Windows\security\logs\svchost.exe.config CheatHubLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exesvchost.exepid process 1388 svchost.exe 1388 svchost.exe 1388 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe 1388 svchost.exe 1716 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 1716 svchost.exe Token: SeDebugPrivilege 1096 svchost.exe Token: SeDebugPrivilege 1388 svchost.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
CheatHubLauncher.exesvchost.exesvchost.exetaskeng.exedescription pid process target process PID 1212 wrote to memory of 1716 1212 CheatHubLauncher.exe svchost.exe PID 1212 wrote to memory of 1716 1212 CheatHubLauncher.exe svchost.exe PID 1212 wrote to memory of 1716 1212 CheatHubLauncher.exe svchost.exe PID 1212 wrote to memory of 1716 1212 CheatHubLauncher.exe svchost.exe PID 1212 wrote to memory of 1716 1212 CheatHubLauncher.exe svchost.exe PID 1212 wrote to memory of 1716 1212 CheatHubLauncher.exe svchost.exe PID 1212 wrote to memory of 1716 1212 CheatHubLauncher.exe svchost.exe PID 1716 wrote to memory of 1096 1716 svchost.exe svchost.exe PID 1716 wrote to memory of 1096 1716 svchost.exe svchost.exe PID 1716 wrote to memory of 1096 1716 svchost.exe svchost.exe PID 1716 wrote to memory of 1096 1716 svchost.exe svchost.exe PID 1716 wrote to memory of 1096 1716 svchost.exe svchost.exe PID 1716 wrote to memory of 1096 1716 svchost.exe svchost.exe PID 1716 wrote to memory of 1096 1716 svchost.exe svchost.exe PID 1096 wrote to memory of 1388 1096 svchost.exe svchost.exe PID 1096 wrote to memory of 1388 1096 svchost.exe svchost.exe PID 1096 wrote to memory of 1388 1096 svchost.exe svchost.exe PID 1096 wrote to memory of 1388 1096 svchost.exe svchost.exe PID 1096 wrote to memory of 1388 1096 svchost.exe svchost.exe PID 1096 wrote to memory of 1388 1096 svchost.exe svchost.exe PID 1096 wrote to memory of 1388 1096 svchost.exe svchost.exe PID 520 wrote to memory of 1732 520 taskeng.exe svchost.exe PID 520 wrote to memory of 1732 520 taskeng.exe svchost.exe PID 520 wrote to memory of 1732 520 taskeng.exe svchost.exe PID 520 wrote to memory of 1732 520 taskeng.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatHubLauncher.exe"C:\Users\Admin\AppData\Local\Temp\CheatHubLauncher.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\security\logs\svchost.exe"C:\Windows\security\logs\svchost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\Windows\security\logs\svchost.exe" 1716 /protectFile3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\Windows\security\logs\svchost.exe" 1716 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
C:\Windows\system32\taskeng.exetaskeng.exe {6B5CEF1E-5315-48DA-A0BD-96953A30035A} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\security\logs\svchost.exeC:\Windows\security\logs\svchost.exe2⤵
- Executes dropped EXE
PID:1732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\svchost.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
C:\Windows\security\logs\svchost.exeFilesize
12.8MB
MD50fb32f1fc38ca023300ba5a7b339bbb9
SHA14cb9f12f4c6ad6fab6926c50116de275f8f75366
SHA256e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
SHA51291db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
C:\Windows\security\logs\svchost.exeFilesize
12.8MB
MD50fb32f1fc38ca023300ba5a7b339bbb9
SHA14cb9f12f4c6ad6fab6926c50116de275f8f75366
SHA256e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
SHA51291db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
C:\Windows\security\logs\svchost.exeFilesize
12.8MB
MD50fb32f1fc38ca023300ba5a7b339bbb9
SHA14cb9f12f4c6ad6fab6926c50116de275f8f75366
SHA256e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
SHA51291db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
C:\Windows\security\logs\svchost.exeFilesize
12.8MB
MD50fb32f1fc38ca023300ba5a7b339bbb9
SHA14cb9f12f4c6ad6fab6926c50116de275f8f75366
SHA256e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
SHA51291db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
C:\Windows\security\logs\svchost.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\CSCore.dllFilesize
516KB
MD5dde3ec6e17bc518b10c99efbd09ab72e
SHA1a2306e60b74b8a01a0dbc1199a7fffca288f2033
SHA25660a5077b443273238e6629ce5fc3ff7ee3592ea2e377b8fc28bfe6e76bda64b8
SHA51209a528c18291980ca7c5ddca67625035bbb21b9d95ab0854670d28c59c4e7adc6d13a356fa1d2c9ad75d16b334ae9818e06ddb10408a3e776e4ef0d7b295f877
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\CSCore.dllFilesize
516KB
MD5dde3ec6e17bc518b10c99efbd09ab72e
SHA1a2306e60b74b8a01a0dbc1199a7fffca288f2033
SHA25660a5077b443273238e6629ce5fc3ff7ee3592ea2e377b8fc28bfe6e76bda64b8
SHA51209a528c18291980ca7c5ddca67625035bbb21b9d95ab0854670d28c59c4e7adc6d13a356fa1d2c9ad75d16b334ae9818e06ddb10408a3e776e4ef0d7b295f877
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.DXGI.dllFilesize
125KB
MD52b44c70c49b70d797fbb748158b5d9bb
SHA193e00e6527e461c45c7868d14cf05c007e478081
SHA2563762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
SHA512faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.DXGI.dllFilesize
125KB
MD52b44c70c49b70d797fbb748158b5d9bb
SHA193e00e6527e461c45c7868d14cf05c007e478081
SHA2563762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
SHA512faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.Direct3D11.dllFilesize
271KB
MD598eb5ba5871acdeaebf3a3b0f64be449
SHA1c965284f60ef789b00b10b3df60ee682b4497de3
SHA256d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
SHA512a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.Direct3D11.dllFilesize
271KB
MD598eb5ba5871acdeaebf3a3b0f64be449
SHA1c965284f60ef789b00b10b3df60ee682b4497de3
SHA256d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
SHA512a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.Direct3D9.dllFilesize
338KB
MD5934da0e49208d0881c44fe19d5033840
SHA1a19c5a822e82e41752a08d3bd9110db19a8a5016
SHA25602da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
SHA512de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.Direct3D9.dllFilesize
338KB
MD5934da0e49208d0881c44fe19d5033840
SHA1a19c5a822e82e41752a08d3bd9110db19a8a5016
SHA25602da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
SHA512de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.dllFilesize
247KB
MD5ffb4b61cc11bec6d48226027c2c26704
SHA1fa8b9e344accbdc4dffa9b5d821d23f0716da29e
SHA256061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
SHA51248aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\SharpDX.dllFilesize
247KB
MD5ffb4b61cc11bec6d48226027c2c26704
SHA1fa8b9e344accbdc4dffa9b5d821d23f0716da29e
SHA256061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
SHA51248aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\TurboJpegWrapper.dllFilesize
1.3MB
MD5ac6acc235ebef6374bed71b37e322874
SHA1a267baad59cd7352167636836bad4b971fcd6b6b
SHA256047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96
SHA51272ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\TurboJpegWrapper.dllFilesize
1.3MB
MD5ac6acc235ebef6374bed71b37e322874
SHA1a267baad59cd7352167636836bad4b971fcd6b6b
SHA256047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96
SHA51272ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081
-
\Users\Admin\AppData\Roaming\Orcus\lib_4f410509b9144dd9acb87977aa081e27\x86\turbojpeg.dllFilesize
646KB
MD582898ed19da89d7d44e280a3ced95e9b
SHA1eec0af5733c642eac8c5e08479f462d1ec1ed4db
SHA2565f4b9f8360764d75c9faaecd94f6d200c54611b33064cd216e363d973dae7c29
SHA512ee7b884ce7d7366ee28fb17721b6c89bd4eba8fb373cdbb483e26a4ed7a74ab5db847513c54704d753d77a7e18b1fb9fee90ed6bbc0540bff702273fda36b682
-
\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
\Windows\security\logs\svchost.exeFilesize
12.8MB
MD50fb32f1fc38ca023300ba5a7b339bbb9
SHA14cb9f12f4c6ad6fab6926c50116de275f8f75366
SHA256e8f8f059c4850f230af003ad19f23450b4f80df8a58fa547293298f31c6f453a
SHA51291db621ad5a5280102aad31a366a24b4b08148dc4bb706322bd79ed284fe0060691163aefdb0d74d374dc580d5136a849df1a009235d55c7c71f22bd664b922f
-
memory/1096-84-0x0000000000BB0000-0x0000000000BB8000-memory.dmpFilesize
32KB
-
memory/1212-54-0x0000000000AB0000-0x0000000000BB8000-memory.dmpFilesize
1.0MB
-
memory/1212-58-0x0000000000900000-0x0000000000912000-memory.dmpFilesize
72KB
-
memory/1212-57-0x0000000000930000-0x0000000000970000-memory.dmpFilesize
256KB
-
memory/1212-56-0x00000000009A0000-0x00000000009FC000-memory.dmpFilesize
368KB
-
memory/1212-55-0x0000000000260000-0x000000000026E000-memory.dmpFilesize
56KB
-
memory/1716-72-0x0000000000A00000-0x0000000000A4E000-memory.dmpFilesize
312KB
-
memory/1716-141-0x0000000006DC0000-0x0000000006F14000-memory.dmpFilesize
1.3MB
-
memory/1716-120-0x0000000005280000-0x00000000052CA000-memory.dmpFilesize
296KB
-
memory/1716-108-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/1716-107-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/1716-127-0x00000000052D0000-0x000000000532A000-memory.dmpFilesize
360KB
-
memory/1716-134-0x0000000005330000-0x0000000005356000-memory.dmpFilesize
152KB
-
memory/1716-106-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/1716-159-0x0000000005390000-0x000000000539A000-memory.dmpFilesize
40KB
-
memory/1716-74-0x0000000000AB0000-0x0000000000AC0000-memory.dmpFilesize
64KB
-
memory/1716-73-0x0000000000A60000-0x0000000000A78000-memory.dmpFilesize
96KB
-
memory/1716-113-0x0000000004C80000-0x0000000004CC4000-memory.dmpFilesize
272KB
-
memory/1716-144-0x0000000005390000-0x000000000539A000-memory.dmpFilesize
40KB
-
memory/1716-145-0x0000000005390000-0x000000000539A000-memory.dmpFilesize
40KB
-
memory/1716-71-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/1716-149-0x00000000660C0000-0x000000006614F000-memory.dmpFilesize
572KB
-
memory/1716-70-0x00000000003F0000-0x0000000000402000-memory.dmpFilesize
72KB
-
memory/1716-69-0x0000000000F10000-0x0000000001018000-memory.dmpFilesize
1.0MB
-
memory/1716-154-0x0000000006730000-0x00000000067B6000-memory.dmpFilesize
536KB
-
memory/1716-158-0x0000000005390000-0x000000000539A000-memory.dmpFilesize
40KB
-
memory/1732-88-0x0000000004A20000-0x0000000004A60000-memory.dmpFilesize
256KB