Analysis
-
max time kernel
143s -
max time network
125s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-05-2024 23:32
Static task
static1
General
-
Target
a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe
-
Size
1.8MB
-
MD5
21f488b50b7c21d5b032a03273d12fc9
-
SHA1
333ca9d0e708f196f2099ff1189572d74cd48870
-
SHA256
a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e
-
SHA512
7b70b83c13e75333803d1397c180169806e0e66300c1856612f45f23f9520cbd43ed1acde2074cae96bd1095fc240b41d1b14bf6a901486a8acbc9a867e916d7
-
SSDEEP
49152:tFm3Sm/SetnQm5vcMsMpsSxGbZXqUKKbBsJTQ5ud9:6iIrtQm5XsMp3xGbMm6Jbd
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
Processes:
ebc337dbef.exeexplortu.exeexplortu.exe9b18b51d40.exeaxplont.exeaxplont.exeaxplont.exea785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exeexplortu.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ebc337dbef.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9b18b51d40.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exeaxplont.exeebc337dbef.exeexplortu.exeexplortu.exeexplortu.exe9b18b51d40.exeaxplont.exeaxplont.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ebc337dbef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ebc337dbef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9b18b51d40.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9b18b51d40.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe -
Executes dropped EXE 8 IoCs
Processes:
explortu.exe9b18b51d40.exeaxplont.exeebc337dbef.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 1812 explortu.exe 484 9b18b51d40.exe 3172 axplont.exe 3608 ebc337dbef.exe 1056 axplont.exe 1516 explortu.exe 3412 axplont.exe 3800 explortu.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exeexplortu.exeaxplont.exeebc337dbef.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exe9b18b51d40.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine ebc337dbef.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine 9b18b51d40.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\ebc337dbef.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\ebc337dbef.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exeexplortu.exe9b18b51d40.exeaxplont.exeebc337dbef.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 3540 a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe 1812 explortu.exe 484 9b18b51d40.exe 3172 axplont.exe 3608 ebc337dbef.exe 1056 axplont.exe 1516 explortu.exe 3412 axplont.exe 3800 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
9b18b51d40.exea785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exedescription ioc process File created C:\Windows\Tasks\axplont.job 9b18b51d40.exe File created C:\Windows\Tasks\explortu.job a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exeexplortu.exe9b18b51d40.exeaxplont.exeebc337dbef.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 3540 a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe 3540 a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe 1812 explortu.exe 1812 explortu.exe 484 9b18b51d40.exe 484 9b18b51d40.exe 3172 axplont.exe 3172 axplont.exe 3608 ebc337dbef.exe 3608 ebc337dbef.exe 1056 axplont.exe 1056 axplont.exe 1516 explortu.exe 1516 explortu.exe 3412 axplont.exe 3412 axplont.exe 3800 explortu.exe 3800 explortu.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exeexplortu.exe9b18b51d40.exedescription pid process target process PID 3540 wrote to memory of 1812 3540 a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe explortu.exe PID 3540 wrote to memory of 1812 3540 a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe explortu.exe PID 3540 wrote to memory of 1812 3540 a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe explortu.exe PID 1812 wrote to memory of 4940 1812 explortu.exe explortu.exe PID 1812 wrote to memory of 4940 1812 explortu.exe explortu.exe PID 1812 wrote to memory of 4940 1812 explortu.exe explortu.exe PID 1812 wrote to memory of 484 1812 explortu.exe 9b18b51d40.exe PID 1812 wrote to memory of 484 1812 explortu.exe 9b18b51d40.exe PID 1812 wrote to memory of 484 1812 explortu.exe 9b18b51d40.exe PID 484 wrote to memory of 3172 484 9b18b51d40.exe axplont.exe PID 484 wrote to memory of 3172 484 9b18b51d40.exe axplont.exe PID 484 wrote to memory of 3172 484 9b18b51d40.exe axplont.exe PID 1812 wrote to memory of 3608 1812 explortu.exe ebc337dbef.exe PID 1812 wrote to memory of 3608 1812 explortu.exe ebc337dbef.exe PID 1812 wrote to memory of 3608 1812 explortu.exe ebc337dbef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe"C:\Users\Admin\AppData\Local\Temp\a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\9b18b51d40.exe"C:\Users\Admin\1000004002\9b18b51d40.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\ebc337dbef.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\ebc337dbef.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\9b18b51d40.exeFilesize
1.8MB
MD5c7fd0dbe0c5a1a948f50568f87272f82
SHA173013dc4288440f8d282c5a6f00ef29d16b2069c
SHA256880c0194899ddd41ccd22ad8f0f4cb0162d526cdf5eda0459f2bf4a410e92d43
SHA512f0edc864412e445112aab2e046e062d643ff06f9c41f16613b66ff7f7b8769f44d2b47ff3ee15030fe3cc47fee513cd77672b254784dc70a6125709dd4b862d4
-
C:\Users\Admin\AppData\Local\Temp\1000005001\ebc337dbef.exeFilesize
2.3MB
MD576a1838c46c65e8d65c4cdf3c00c177a
SHA1e1a6f56a29f7791e7fa182bacceaabd689b0e8ac
SHA256e2804deb8c73a29b02dc0a2d0530071aaf2562f10de8e8684e9273d052a1de57
SHA512143d4d90940cf45867af47135e3c86c67097babb76aa8b569905b53c772ce6d5581521a0de3b8ab2df2f733792677e58df284e0db6652ce5af579a43e49277e1
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD521f488b50b7c21d5b032a03273d12fc9
SHA1333ca9d0e708f196f2099ff1189572d74cd48870
SHA256a785eca30240559cc070f34ed58e642c963f96799020e6d664e5a18ca4e83d2e
SHA5127b70b83c13e75333803d1397c180169806e0e66300c1856612f45f23f9520cbd43ed1acde2074cae96bd1095fc240b41d1b14bf6a901486a8acbc9a867e916d7
-
memory/484-52-0x0000000000CF0000-0x00000000011A5000-memory.dmpFilesize
4.7MB
-
memory/484-39-0x0000000000CF0000-0x00000000011A5000-memory.dmpFilesize
4.7MB
-
memory/1056-94-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/1056-91-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/1516-93-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1516-95-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-105-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-76-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-19-0x0000000000221000-0x000000000024F000-memory.dmpFilesize
184KB
-
memory/1812-20-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-18-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-110-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-112-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-102-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-73-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-74-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-75-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-21-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-99-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-79-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-96-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-123-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-125-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-82-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-127-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-88-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/1812-85-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/3172-89-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-106-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-84-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-128-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-124-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-121-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-111-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-80-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-77-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-108-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-97-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-53-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-100-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3172-103-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3412-115-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3412-119-0x0000000000020000-0x00000000004D5000-memory.dmpFilesize
4.7MB
-
memory/3540-3-0x0000000000C90000-0x000000000114C000-memory.dmpFilesize
4.7MB
-
memory/3540-17-0x0000000000C90000-0x000000000114C000-memory.dmpFilesize
4.7MB
-
memory/3540-1-0x0000000077B76000-0x0000000077B78000-memory.dmpFilesize
8KB
-
memory/3540-2-0x0000000000C91000-0x0000000000CBF000-memory.dmpFilesize
184KB
-
memory/3540-0-0x0000000000C90000-0x000000000114C000-memory.dmpFilesize
4.7MB
-
memory/3540-5-0x0000000000C90000-0x000000000114C000-memory.dmpFilesize
4.7MB
-
memory/3608-90-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-122-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-109-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-104-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-107-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-78-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-113-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-129-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-83-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-81-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-72-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-98-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-86-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-126-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3608-101-0x0000000000CC0000-0x000000000128B000-memory.dmpFilesize
5.8MB
-
memory/3800-120-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB
-
memory/3800-117-0x0000000000220000-0x00000000006DC000-memory.dmpFilesize
4.7MB