Analysis
-
max time kernel
144s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe
Resource
win10v2004-20240508-en
General
-
Target
0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe
-
Size
1.8MB
-
MD5
ee9644154c6741a3daefcaf68ad8b89f
-
SHA1
32cecf28a7cea80dacdf713f59b75f1c72019c04
-
SHA256
0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d
-
SHA512
43b2fa09bb33e6707e217d2d9e73f6020b549f13a1b3ea40b9f74b1acec0cb313a77f7edb405ac72f4d128e28e33a918dbcded8b350c9fb96046ba241a80a853
-
SSDEEP
49152:zT8TKaZM2Kw6O7WZztSOoqJ3VidGTh6g0B00UT+oJbOzA:Er5KQWDi6MgRd+oJC0
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
Processes:
0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exeaxplont.exeexplortu.exeexplortu.exe50f748d7c5.exeaxplont.exe533e673a8b.exeexplortu.exeexplortu.exeaxplont.exeaxplont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 50f748d7c5.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 533e673a8b.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explortu.exeaxplont.exe0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exe50f748d7c5.exe533e673a8b.exeaxplont.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 50f748d7c5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 533e673a8b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 533e673a8b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 50f748d7c5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exeexplortu.exe50f748d7c5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation explortu.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 50f748d7c5.exe -
Executes dropped EXE 10 IoCs
Processes:
explortu.exe50f748d7c5.exeaxplont.exe533e673a8b.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exepid process 856 explortu.exe 4252 50f748d7c5.exe 1040 axplont.exe 2460 533e673a8b.exe 2180 explortu.exe 116 axplont.exe 5020 explortu.exe 2192 axplont.exe 5020 axplont.exe 2652 explortu.exe -
Identifies Wine through registry keys 2 TTPs 10 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explortu.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeaxplont.exe0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exeexplortu.exeexplortu.exe50f748d7c5.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine 50f748d7c5.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000005001\533e673a8b.exe themida behavioral1/memory/2460-72-0x0000000000350000-0x00000000009C1000-memory.dmp themida behavioral1/memory/2460-73-0x0000000000350000-0x00000000009C1000-memory.dmp themida behavioral1/memory/2460-75-0x0000000000350000-0x00000000009C1000-memory.dmp themida behavioral1/memory/2460-74-0x0000000000350000-0x00000000009C1000-memory.dmp themida behavioral1/memory/2460-76-0x0000000000350000-0x00000000009C1000-memory.dmp themida behavioral1/memory/2460-78-0x0000000000350000-0x00000000009C1000-memory.dmp themida behavioral1/memory/2460-77-0x0000000000350000-0x00000000009C1000-memory.dmp themida behavioral1/memory/2460-79-0x0000000000350000-0x00000000009C1000-memory.dmp themida behavioral1/memory/2460-89-0x0000000000350000-0x00000000009C1000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\533e673a8b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\533e673a8b.exe" explortu.exe -
Processes:
533e673a8b.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 533e673a8b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exeexplortu.exe50f748d7c5.exeaxplont.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exepid process 2004 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe 856 explortu.exe 4252 50f748d7c5.exe 1040 axplont.exe 116 axplont.exe 2180 explortu.exe 5020 explortu.exe 2192 axplont.exe 5020 axplont.exe 2652 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
50f748d7c5.exe0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exedescription ioc process File created C:\Windows\Tasks\axplont.job 50f748d7c5.exe File created C:\Windows\Tasks\explortu.job 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exeexplortu.exe50f748d7c5.exeaxplont.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exepid process 2004 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe 2004 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe 856 explortu.exe 856 explortu.exe 4252 50f748d7c5.exe 4252 50f748d7c5.exe 1040 axplont.exe 1040 axplont.exe 116 axplont.exe 116 axplont.exe 2180 explortu.exe 2180 explortu.exe 5020 explortu.exe 5020 explortu.exe 2192 axplont.exe 2192 axplont.exe 5020 axplont.exe 5020 axplont.exe 2652 explortu.exe 2652 explortu.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exeexplortu.exe50f748d7c5.exedescription pid process target process PID 2004 wrote to memory of 856 2004 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe explortu.exe PID 2004 wrote to memory of 856 2004 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe explortu.exe PID 2004 wrote to memory of 856 2004 0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe explortu.exe PID 856 wrote to memory of 1808 856 explortu.exe explortu.exe PID 856 wrote to memory of 1808 856 explortu.exe explortu.exe PID 856 wrote to memory of 1808 856 explortu.exe explortu.exe PID 856 wrote to memory of 4252 856 explortu.exe 50f748d7c5.exe PID 856 wrote to memory of 4252 856 explortu.exe 50f748d7c5.exe PID 856 wrote to memory of 4252 856 explortu.exe 50f748d7c5.exe PID 4252 wrote to memory of 1040 4252 50f748d7c5.exe axplont.exe PID 4252 wrote to memory of 1040 4252 50f748d7c5.exe axplont.exe PID 4252 wrote to memory of 1040 4252 50f748d7c5.exe axplont.exe PID 856 wrote to memory of 2460 856 explortu.exe 533e673a8b.exe PID 856 wrote to memory of 2460 856 explortu.exe 533e673a8b.exe PID 856 wrote to memory of 2460 856 explortu.exe 533e673a8b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe"C:\Users\Admin\AppData\Local\Temp\0deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\50f748d7c5.exe"C:\Users\Admin\1000004002\50f748d7c5.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\533e673a8b.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\533e673a8b.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\50f748d7c5.exeFilesize
1.9MB
MD58770844d27273e43452b451440790fce
SHA12e111edbdb49266f51503c02e172011724faba4c
SHA2562e755d6122d46f6bcf56eff18f03a9d58354b3ce92b28b0b6c4c533d46afd358
SHA512afd9be819c40bef746f64ec0141e7f132b497e95a2b95ae97218574b7dfc5e991196143560ace13585936b49cf511ce10908d5ea17fb802f6783dd728df0dac2
-
C:\Users\Admin\AppData\Local\Temp\1000005001\533e673a8b.exeFilesize
2.1MB
MD598660f47b96363c7daa37d827599c91a
SHA17cc750a98d315f8a655f0a52e61224f51ccecbb8
SHA256b6979caab5615f99852bb6c7d9cf0fd8262c0e2d98660cbbe313fc359ada43b4
SHA5126fc48643e5bd814811e1c0033a8ee9a658b9cf1a418c776e0a261889e2fe0d186e37751006badd9d652333d13208f290752810e247763acb2570d3ad9643d9d5
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD5ee9644154c6741a3daefcaf68ad8b89f
SHA132cecf28a7cea80dacdf713f59b75f1c72019c04
SHA2560deaf5eda6a1895787e1231c8c173964eeaf01d6c75c3cbb0271437f7e3c106d
SHA51243b2fa09bb33e6707e217d2d9e73f6020b549f13a1b3ea40b9f74b1acec0cb313a77f7edb405ac72f4d128e28e33a918dbcded8b350c9fb96046ba241a80a853
-
memory/116-86-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/116-85-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/856-118-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-103-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-16-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-19-0x0000000000FA1000-0x0000000000FCF000-memory.dmpFilesize
184KB
-
memory/856-20-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-21-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-124-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-127-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-115-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-107-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-130-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-121-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-101-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-98-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-95-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-92-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-91-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-90-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-139-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-80-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/856-83-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/1040-113-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-128-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-51-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-116-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-88-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-137-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-119-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-122-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-105-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-93-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-125-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-96-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-102-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/1040-99-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/2004-2-0x00000000005C1000-0x00000000005EF000-memory.dmpFilesize
184KB
-
memory/2004-5-0x00000000005C0000-0x0000000000A85000-memory.dmpFilesize
4.8MB
-
memory/2004-17-0x00000000005C0000-0x0000000000A85000-memory.dmpFilesize
4.8MB
-
memory/2004-3-0x00000000005C0000-0x0000000000A85000-memory.dmpFilesize
4.8MB
-
memory/2004-0-0x00000000005C0000-0x0000000000A85000-memory.dmpFilesize
4.8MB
-
memory/2004-1-0x0000000077294000-0x0000000077296000-memory.dmpFilesize
8KB
-
memory/2180-84-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/2180-87-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/2192-110-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/2192-112-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/2460-76-0x0000000000350000-0x00000000009C1000-memory.dmpFilesize
6.4MB
-
memory/2460-74-0x0000000000350000-0x00000000009C1000-memory.dmpFilesize
6.4MB
-
memory/2460-79-0x0000000000350000-0x00000000009C1000-memory.dmpFilesize
6.4MB
-
memory/2460-72-0x0000000000350000-0x00000000009C1000-memory.dmpFilesize
6.4MB
-
memory/2460-78-0x0000000000350000-0x00000000009C1000-memory.dmpFilesize
6.4MB
-
memory/2460-75-0x0000000000350000-0x00000000009C1000-memory.dmpFilesize
6.4MB
-
memory/2460-77-0x0000000000350000-0x00000000009C1000-memory.dmpFilesize
6.4MB
-
memory/2460-89-0x0000000000350000-0x00000000009C1000-memory.dmpFilesize
6.4MB
-
memory/2460-73-0x0000000000350000-0x00000000009C1000-memory.dmpFilesize
6.4MB
-
memory/2652-134-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/2652-136-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/4252-39-0x00000000004B0000-0x0000000000985000-memory.dmpFilesize
4.8MB
-
memory/4252-53-0x00000000004B0000-0x0000000000985000-memory.dmpFilesize
4.8MB
-
memory/5020-111-0x0000000000FA0000-0x0000000001465000-memory.dmpFilesize
4.8MB
-
memory/5020-133-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB
-
memory/5020-135-0x0000000000A50000-0x0000000000F25000-memory.dmpFilesize
4.8MB