Resubmissions
22-05-2024 14:51
240522-r8f9xsfa6s 10Analysis
-
max time kernel
1183s -
max time network
1185s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 14:51
Static task
static1
General
-
Target
a15f053b71cda0497efdec08b4680267b936024d.exe
-
Size
6.6MB
-
MD5
064d9b8a16b733266a651332c622a54e
-
SHA1
a15f053b71cda0497efdec08b4680267b936024d
-
SHA256
8e723f79d696edac7fa9da08d07dd796b4fa6f56886a2f10ea66e618bf0273f1
-
SHA512
18cee323ab07689c6e030d647f0296ec97a12af860fce2252d72d11f3f54c69aca266329fa58cf08213417fd0de54dfab7477a3d9923e83812470fa1b8c79110
-
SSDEEP
98304:OHiCrTw8ZnKEkrssgY6B++D0VH5Z1UqoVoMvoH:Qr615rieH
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1312-30-0x0000000000B00000-0x0000000000BC6000-memory.dmp family_sectoprat -
Executes dropped EXE 6 IoCs
Processes:
OrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exeOrtosLauncher.exepid process 3080 OrtosLauncher.exe 1640 OrtosLauncher.exe 1944 OrtosLauncher.exe 420 OrtosLauncher.exe 3168 OrtosLauncher.exe 2056 OrtosLauncher.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 14 IoCs
Processes:
a15f053b71cda0497efdec08b4680267b936024d.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exedescription pid process target process PID 2524 set thread context of 4012 2524 a15f053b71cda0497efdec08b4680267b936024d.exe netsh.exe PID 4012 set thread context of 1312 4012 netsh.exe MSBuild.exe PID 3080 set thread context of 2268 3080 OrtosLauncher.exe netsh.exe PID 2268 set thread context of 2452 2268 netsh.exe MSBuild.exe PID 1640 set thread context of 1868 1640 OrtosLauncher.exe netsh.exe PID 1868 set thread context of 4804 1868 netsh.exe MSBuild.exe PID 1944 set thread context of 1344 1944 OrtosLauncher.exe netsh.exe PID 1344 set thread context of 4792 1344 netsh.exe MSBuild.exe PID 420 set thread context of 1336 420 OrtosLauncher.exe netsh.exe PID 1336 set thread context of 3276 1336 netsh.exe MSBuild.exe PID 3168 set thread context of 3296 3168 OrtosLauncher.exe netsh.exe PID 3296 set thread context of 1056 3296 netsh.exe MSBuild.exe PID 2056 set thread context of 5072 2056 OrtosLauncher.exe netsh.exe PID 5072 set thread context of 1640 5072 netsh.exe MSBuild.exe -
Drops file in Windows directory 1 IoCs
Processes:
netsh.exedescription ioc process File created C:\Windows\Tasks\Ortos Launcher.job netsh.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
a15f053b71cda0497efdec08b4680267b936024d.exenetsh.exeMSBuild.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exepid process 2524 a15f053b71cda0497efdec08b4680267b936024d.exe 2524 a15f053b71cda0497efdec08b4680267b936024d.exe 4012 netsh.exe 4012 netsh.exe 1312 MSBuild.exe 1312 MSBuild.exe 1312 MSBuild.exe 1312 MSBuild.exe 3080 OrtosLauncher.exe 3080 OrtosLauncher.exe 2268 netsh.exe 2268 netsh.exe 1640 OrtosLauncher.exe 1640 OrtosLauncher.exe 1868 netsh.exe 1868 netsh.exe 1944 OrtosLauncher.exe 1944 OrtosLauncher.exe 1344 netsh.exe 1344 netsh.exe 420 OrtosLauncher.exe 420 OrtosLauncher.exe 1336 netsh.exe 1336 netsh.exe 3168 OrtosLauncher.exe 3168 OrtosLauncher.exe 3296 netsh.exe 3296 netsh.exe 2056 OrtosLauncher.exe 2056 OrtosLauncher.exe 5072 netsh.exe 5072 netsh.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
Processes:
a15f053b71cda0497efdec08b4680267b936024d.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exepid process 2524 a15f053b71cda0497efdec08b4680267b936024d.exe 4012 netsh.exe 4012 netsh.exe 3080 OrtosLauncher.exe 2268 netsh.exe 2268 netsh.exe 1640 OrtosLauncher.exe 1868 netsh.exe 1868 netsh.exe 1944 OrtosLauncher.exe 1344 netsh.exe 1344 netsh.exe 420 OrtosLauncher.exe 1336 netsh.exe 1336 netsh.exe 3168 OrtosLauncher.exe 3296 netsh.exe 3296 netsh.exe 2056 OrtosLauncher.exe 5072 netsh.exe 5072 netsh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1312 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 1312 MSBuild.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
a15f053b71cda0497efdec08b4680267b936024d.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exeOrtosLauncher.exenetsh.exedescription pid process target process PID 2524 wrote to memory of 4012 2524 a15f053b71cda0497efdec08b4680267b936024d.exe netsh.exe PID 2524 wrote to memory of 4012 2524 a15f053b71cda0497efdec08b4680267b936024d.exe netsh.exe PID 2524 wrote to memory of 4012 2524 a15f053b71cda0497efdec08b4680267b936024d.exe netsh.exe PID 2524 wrote to memory of 4012 2524 a15f053b71cda0497efdec08b4680267b936024d.exe netsh.exe PID 4012 wrote to memory of 1312 4012 netsh.exe MSBuild.exe PID 4012 wrote to memory of 1312 4012 netsh.exe MSBuild.exe PID 4012 wrote to memory of 1312 4012 netsh.exe MSBuild.exe PID 4012 wrote to memory of 1312 4012 netsh.exe MSBuild.exe PID 4012 wrote to memory of 1312 4012 netsh.exe MSBuild.exe PID 3080 wrote to memory of 2268 3080 OrtosLauncher.exe netsh.exe PID 3080 wrote to memory of 2268 3080 OrtosLauncher.exe netsh.exe PID 3080 wrote to memory of 2268 3080 OrtosLauncher.exe netsh.exe PID 3080 wrote to memory of 2268 3080 OrtosLauncher.exe netsh.exe PID 2268 wrote to memory of 2452 2268 netsh.exe MSBuild.exe PID 2268 wrote to memory of 2452 2268 netsh.exe MSBuild.exe PID 2268 wrote to memory of 2452 2268 netsh.exe MSBuild.exe PID 2268 wrote to memory of 2452 2268 netsh.exe MSBuild.exe PID 2268 wrote to memory of 2452 2268 netsh.exe MSBuild.exe PID 1640 wrote to memory of 1868 1640 OrtosLauncher.exe netsh.exe PID 1640 wrote to memory of 1868 1640 OrtosLauncher.exe netsh.exe PID 1640 wrote to memory of 1868 1640 OrtosLauncher.exe netsh.exe PID 1640 wrote to memory of 1868 1640 OrtosLauncher.exe netsh.exe PID 1868 wrote to memory of 4804 1868 netsh.exe MSBuild.exe PID 1868 wrote to memory of 4804 1868 netsh.exe MSBuild.exe PID 1868 wrote to memory of 4804 1868 netsh.exe MSBuild.exe PID 1868 wrote to memory of 4804 1868 netsh.exe MSBuild.exe PID 1868 wrote to memory of 4804 1868 netsh.exe MSBuild.exe PID 1944 wrote to memory of 1344 1944 OrtosLauncher.exe netsh.exe PID 1944 wrote to memory of 1344 1944 OrtosLauncher.exe netsh.exe PID 1944 wrote to memory of 1344 1944 OrtosLauncher.exe netsh.exe PID 1944 wrote to memory of 1344 1944 OrtosLauncher.exe netsh.exe PID 1344 wrote to memory of 4792 1344 netsh.exe MSBuild.exe PID 1344 wrote to memory of 4792 1344 netsh.exe MSBuild.exe PID 1344 wrote to memory of 4792 1344 netsh.exe MSBuild.exe PID 1344 wrote to memory of 4792 1344 netsh.exe MSBuild.exe PID 1344 wrote to memory of 4792 1344 netsh.exe MSBuild.exe PID 420 wrote to memory of 1336 420 OrtosLauncher.exe netsh.exe PID 420 wrote to memory of 1336 420 OrtosLauncher.exe netsh.exe PID 420 wrote to memory of 1336 420 OrtosLauncher.exe netsh.exe PID 420 wrote to memory of 1336 420 OrtosLauncher.exe netsh.exe PID 1336 wrote to memory of 3276 1336 netsh.exe MSBuild.exe PID 1336 wrote to memory of 3276 1336 netsh.exe MSBuild.exe PID 1336 wrote to memory of 3276 1336 netsh.exe MSBuild.exe PID 1336 wrote to memory of 3276 1336 netsh.exe MSBuild.exe PID 1336 wrote to memory of 3276 1336 netsh.exe MSBuild.exe PID 3168 wrote to memory of 3296 3168 OrtosLauncher.exe netsh.exe PID 3168 wrote to memory of 3296 3168 OrtosLauncher.exe netsh.exe PID 3168 wrote to memory of 3296 3168 OrtosLauncher.exe netsh.exe PID 3168 wrote to memory of 3296 3168 OrtosLauncher.exe netsh.exe PID 3296 wrote to memory of 1056 3296 netsh.exe MSBuild.exe PID 3296 wrote to memory of 1056 3296 netsh.exe MSBuild.exe PID 3296 wrote to memory of 1056 3296 netsh.exe MSBuild.exe PID 3296 wrote to memory of 1056 3296 netsh.exe MSBuild.exe PID 3296 wrote to memory of 1056 3296 netsh.exe MSBuild.exe PID 2056 wrote to memory of 5072 2056 OrtosLauncher.exe netsh.exe PID 2056 wrote to memory of 5072 2056 OrtosLauncher.exe netsh.exe PID 2056 wrote to memory of 5072 2056 OrtosLauncher.exe netsh.exe PID 2056 wrote to memory of 5072 2056 OrtosLauncher.exe netsh.exe PID 5072 wrote to memory of 1640 5072 netsh.exe MSBuild.exe PID 5072 wrote to memory of 1640 5072 netsh.exe MSBuild.exe PID 5072 wrote to memory of 1640 5072 netsh.exe MSBuild.exe PID 5072 wrote to memory of 1640 5072 netsh.exe MSBuild.exe PID 5072 wrote to memory of 1640 5072 netsh.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a15f053b71cda0497efdec08b4680267b936024d.exe"C:\Users\Admin\AppData\Local\Temp\a15f053b71cda0497efdec08b4680267b936024d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exeC:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
-
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exeC:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
-
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exeC:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
-
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exeC:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
-
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exeC:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
-
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exeC:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.logFilesize
410B
MD5595b2b7794a0b04788c75aa8f0076a58
SHA1ba783556d6bd69f69adf72e02b28be49eda4161f
SHA256bc4bad840727fda53dc12d08840e47bfc0583be9bb1d512af15ccbc48790ce2e
SHA512aaec254c32eed006381c75cdb9a559a82b5ff6b852aab10f2a84f0c54b44b24aaea74c29a0e8228425b9e8226b676c9a008ba4639a99c7ae78adcdf058ffd3dd
-
C:\Users\Admin\AppData\Local\Temp\8cb685dcFilesize
1.4MB
MD5bb79b37303351aed686bafdbda965145
SHA129dfc99df03ebeba465887c1c93990244010701f
SHA256832bd77a59171267e41c2559bce0abd6c8a5d172367726dd289f3fc133beae29
SHA5126cb74f6fe35775c562cbf1c8126d633259e4b6077638fff57f70326bac8e3a0e6deaa7ca26de9bab6364cf88fa750bfb7c2af6cde82f73ed731989685b75de8a
-
C:\Users\Admin\AppData\Local\Temp\904aa7dcFilesize
1.4MB
MD514bacd6d01f76c333f9a5eaec6769c1f
SHA10eda34d639ef60004776d1b7df89fef2afc696a9
SHA2566bf2af4c1f4ea42dc69c4215b7656b40b2cfef203bd8177c31c3832d78436be6
SHA512f83fde9b33d124ffd4defc949ccd506c75187f602b42a538d64670b9712825078e80477d9153b57ed0a82babec269e263083927d5af22684ef988b6200797d98
-
C:\Users\Admin\AppData\Local\Temp\c1a43df5Filesize
1.4MB
MD5090a858c9fdecb91fff399b98384a480
SHA1227e88411bde058fd61635225f47a5ba8f656227
SHA2563f613d6220036e5527bdaba824f303117662ffa48903abb0accad36d76466b7a
SHA512e4b3b07b025a10cd81f57039371f824ab4bdfac38d031eb4d8c7577aaa17ade9376b085344073ebba7c679a0b9f8cd7e1cbd3a8d6ff176379cb8bd08bdef5191
-
C:\Users\Admin\AppData\Local\Temp\tmpC045.tmpFilesize
20KB
MD542c395b8db48b6ce3d34c301d1eba9d5
SHA1b7cfa3de344814bec105391663c0df4a74310996
SHA2565644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA5127b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845
-
C:\Users\Admin\AppData\Local\Temp\tmpC067.tmpFilesize
20KB
MD522be08f683bcc01d7a9799bbd2c10041
SHA12efb6041cf3d6e67970135e592569c76fc4c41de
SHA256451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA5120eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936
-
C:\Users\Admin\AppData\Roaming\SecurityUpdate\OrtosLauncher.exeFilesize
6.6MB
MD5064d9b8a16b733266a651332c622a54e
SHA1a15f053b71cda0497efdec08b4680267b936024d
SHA2568e723f79d696edac7fa9da08d07dd796b4fa6f56886a2f10ea66e618bf0273f1
SHA51218cee323ab07689c6e030d647f0296ec97a12af860fce2252d72d11f3f54c69aca266329fa58cf08213417fd0de54dfab7477a3d9923e83812470fa1b8c79110
-
C:\Windows\Tasks\Ortos Launcher.jobFilesize
300B
MD5c7a361f3995732cdb4473dceda0fd93e
SHA123afa872ceccf05afcc610f943aa4f4a567de7fc
SHA25682afb3b787907d05a9b9137a9cabe8ebff40ff00a0d58a8862dc4aea04e05667
SHA512a2a90db1526dbef003dcf16c4c7a818aca9fa616c98d0602b1f603f33af2c329904cdf7dbd2d4b483185ca2361a5fddce49be8988604a1aede3c033f23bbbab8
-
memory/420-304-0x0000000000400000-0x0000000000AC3000-memory.dmpFilesize
6.8MB
-
memory/420-310-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/420-311-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/420-312-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/1056-334-0x0000000071A90000-0x0000000072DA7000-memory.dmpFilesize
19.1MB
-
memory/1312-29-0x000000007475E000-0x000000007475F000-memory.dmpFilesize
4KB
-
memory/1312-32-0x00000000058E0000-0x0000000005E86000-memory.dmpFilesize
5.6MB
-
memory/1312-63-0x0000000007E50000-0x0000000007E5A000-memory.dmpFilesize
40KB
-
memory/1312-227-0x000000007475E000-0x000000007475F000-memory.dmpFilesize
4KB
-
memory/1312-24-0x0000000071A90000-0x0000000072DA7000-memory.dmpFilesize
19.1MB
-
memory/1312-228-0x0000000005510000-0x0000000005522000-memory.dmpFilesize
72KB
-
memory/1312-229-0x0000000005570000-0x00000000055AC000-memory.dmpFilesize
240KB
-
memory/1312-30-0x0000000000B00000-0x0000000000BC6000-memory.dmpFilesize
792KB
-
memory/1312-31-0x0000000005290000-0x0000000005322000-memory.dmpFilesize
584KB
-
memory/1312-66-0x0000000005650000-0x0000000005662000-memory.dmpFilesize
72KB
-
memory/1312-33-0x00000000056C0000-0x0000000005882000-memory.dmpFilesize
1.8MB
-
memory/1312-35-0x0000000005480000-0x00000000054D0000-memory.dmpFilesize
320KB
-
memory/1312-34-0x00000000053B0000-0x0000000005426000-memory.dmpFilesize
472KB
-
memory/1312-36-0x0000000005280000-0x000000000528A000-memory.dmpFilesize
40KB
-
memory/1312-37-0x00000000064C0000-0x00000000069EC000-memory.dmpFilesize
5.2MB
-
memory/1312-38-0x0000000006020000-0x000000000603E000-memory.dmpFilesize
120KB
-
memory/1312-39-0x00000000060F0000-0x0000000006156000-memory.dmpFilesize
408KB
-
memory/1336-316-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/1344-299-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/1640-269-0x0000000000400000-0x0000000000AC3000-memory.dmpFilesize
6.8MB
-
memory/1640-275-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/1640-276-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/1640-277-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/1640-351-0x0000000071A90000-0x0000000072DA7000-memory.dmpFilesize
19.1MB
-
memory/1868-281-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/1944-295-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/1944-294-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/1944-293-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/1944-287-0x0000000000400000-0x0000000000AC3000-memory.dmpFilesize
6.8MB
-
memory/2056-344-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/2056-338-0x0000000000400000-0x0000000000AC3000-memory.dmpFilesize
6.8MB
-
memory/2056-346-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/2056-345-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/2268-262-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/2452-264-0x0000000071A90000-0x0000000072DA7000-memory.dmpFilesize
19.1MB
-
memory/2524-7-0x0000000073FE0000-0x000000007415D000-memory.dmpFilesize
1.5MB
-
memory/2524-0-0x00000000011F0000-0x00000000011F1000-memory.dmpFilesize
4KB
-
memory/2524-1-0x0000000000400000-0x0000000000AC3000-memory.dmpFilesize
6.8MB
-
memory/2524-8-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/2524-10-0x0000000073FE0000-0x000000007415D000-memory.dmpFilesize
1.5MB
-
memory/2524-9-0x0000000073FF2000-0x0000000073FF4000-memory.dmpFilesize
8KB
-
memory/2524-11-0x0000000073FE0000-0x000000007415D000-memory.dmpFilesize
1.5MB
-
memory/3080-250-0x0000000000400000-0x0000000000AC3000-memory.dmpFilesize
6.8MB
-
memory/3080-257-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/3080-258-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/3080-256-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/3168-329-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/3168-328-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/3168-327-0x000000006E6A0000-0x000000006E81D000-memory.dmpFilesize
1.5MB
-
memory/3168-321-0x0000000000400000-0x0000000000AC3000-memory.dmpFilesize
6.8MB
-
memory/3276-317-0x0000000071A90000-0x0000000072DA7000-memory.dmpFilesize
19.1MB
-
memory/3296-333-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/4012-22-0x0000000073FEE000-0x0000000073FF0000-memory.dmpFilesize
8KB
-
memory/4012-14-0x0000000073FE1000-0x0000000073FEF000-memory.dmpFilesize
56KB
-
memory/4012-16-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB
-
memory/4012-19-0x0000000073FE1000-0x0000000073FEF000-memory.dmpFilesize
56KB
-
memory/4012-18-0x0000000073FEE000-0x0000000073FF2000-memory.dmpFilesize
16KB
-
memory/4012-21-0x0000000073FE1000-0x0000000073FEF000-memory.dmpFilesize
56KB
-
memory/4012-23-0x0000000073FE1000-0x0000000073FEF000-memory.dmpFilesize
56KB
-
memory/4012-25-0x0000000073FE1000-0x0000000073FEF000-memory.dmpFilesize
56KB
-
memory/4012-28-0x0000000073FEE000-0x0000000073FF2000-memory.dmpFilesize
16KB
-
memory/4792-300-0x0000000071A90000-0x0000000072DA7000-memory.dmpFilesize
19.1MB
-
memory/4804-282-0x0000000071A90000-0x0000000072DA7000-memory.dmpFilesize
19.1MB
-
memory/5072-350-0x00007FFC6A820000-0x00007FFC6AA29000-memory.dmpFilesize
2.0MB