Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-05-2024 09:01
Static task
static1
Behavioral task
behavioral1
Sample
033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe
Resource
win10v2004-20240508-en
General
-
Target
033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe
-
Size
1.8MB
-
MD5
5a996b54fdf70f6892280510c7963ca4
-
SHA1
1961084438cfe019e96fee746bc91ea308838352
-
SHA256
033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158
-
SHA512
f158e0a5dfc4f9a2e606e0b54a4047e8686a707153ebecffc988fbe95c6a379d6869cf29908e1ced6a16e4e12d83a2f7b5897748bc363a97a6c8940ce63e543f
-
SSDEEP
49152:BVL6Eyegl9VyvooYtM242apW6FUhM43mmZ5kZSRKMz:rmbcwX6eZ3P50SRZ
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
Processes:
explortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exe033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe6c77988223.exe6ef7b88bbf.exeaxplont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6c77988223.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6ef7b88bbf.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplont.exeexplortu.exe6c77988223.exeexplortu.exe033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe6ef7b88bbf.exeaxplont.exeexplortu.exeaxplont.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6c77988223.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6ef7b88bbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6ef7b88bbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6c77988223.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe -
Executes dropped EXE 8 IoCs
Processes:
explortu.exe6c77988223.exeaxplont.exe6ef7b88bbf.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4852 explortu.exe 1684 6c77988223.exe 1712 axplont.exe 3460 6ef7b88bbf.exe 2320 axplont.exe 1596 explortu.exe 4928 axplont.exe 2992 explortu.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explortu.exe033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exeexplortu.exe6c77988223.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine 6c77988223.exe Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine axplont.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000005001\6ef7b88bbf.exe themida behavioral2/memory/3460-73-0x0000000000CF0000-0x0000000001364000-memory.dmp themida behavioral2/memory/3460-72-0x0000000000CF0000-0x0000000001364000-memory.dmp themida behavioral2/memory/3460-75-0x0000000000CF0000-0x0000000001364000-memory.dmp themida behavioral2/memory/3460-74-0x0000000000CF0000-0x0000000001364000-memory.dmp themida behavioral2/memory/3460-79-0x0000000000CF0000-0x0000000001364000-memory.dmp themida behavioral2/memory/3460-78-0x0000000000CF0000-0x0000000001364000-memory.dmp themida behavioral2/memory/3460-76-0x0000000000CF0000-0x0000000001364000-memory.dmp themida behavioral2/memory/3460-77-0x0000000000CF0000-0x0000000001364000-memory.dmp themida behavioral2/memory/3460-84-0x0000000000CF0000-0x0000000001364000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\6ef7b88bbf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\6ef7b88bbf.exe" explortu.exe -
Processes:
6ef7b88bbf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6ef7b88bbf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
Processes:
033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exeexplortu.exe6c77988223.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 948 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe 4852 explortu.exe 1684 6c77988223.exe 1712 axplont.exe 2320 axplont.exe 1596 explortu.exe 4928 axplont.exe 2992 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe6c77988223.exedescription ioc process File created C:\Windows\Tasks\explortu.job 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe File created C:\Windows\Tasks\axplont.job 6c77988223.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exeexplortu.exe6c77988223.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 948 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe 948 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe 4852 explortu.exe 4852 explortu.exe 1684 6c77988223.exe 1684 6c77988223.exe 1712 axplont.exe 1712 axplont.exe 2320 axplont.exe 2320 axplont.exe 1596 explortu.exe 1596 explortu.exe 4928 axplont.exe 4928 axplont.exe 2992 explortu.exe 2992 explortu.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exeexplortu.exe6c77988223.exedescription pid process target process PID 948 wrote to memory of 4852 948 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe explortu.exe PID 948 wrote to memory of 4852 948 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe explortu.exe PID 948 wrote to memory of 4852 948 033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe explortu.exe PID 4852 wrote to memory of 1800 4852 explortu.exe explortu.exe PID 4852 wrote to memory of 1800 4852 explortu.exe explortu.exe PID 4852 wrote to memory of 1800 4852 explortu.exe explortu.exe PID 4852 wrote to memory of 1684 4852 explortu.exe 6c77988223.exe PID 4852 wrote to memory of 1684 4852 explortu.exe 6c77988223.exe PID 4852 wrote to memory of 1684 4852 explortu.exe 6c77988223.exe PID 1684 wrote to memory of 1712 1684 6c77988223.exe axplont.exe PID 1684 wrote to memory of 1712 1684 6c77988223.exe axplont.exe PID 1684 wrote to memory of 1712 1684 6c77988223.exe axplont.exe PID 4852 wrote to memory of 3460 4852 explortu.exe 6ef7b88bbf.exe PID 4852 wrote to memory of 3460 4852 explortu.exe 6ef7b88bbf.exe PID 4852 wrote to memory of 3460 4852 explortu.exe 6ef7b88bbf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe"C:\Users\Admin\AppData\Local\Temp\033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\6c77988223.exe"C:\Users\Admin\1000004002\6c77988223.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\6ef7b88bbf.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\6ef7b88bbf.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\6c77988223.exeFilesize
1.8MB
MD57e03538dc25285b705604b2ace4492f0
SHA12a0a13d5eb4d394c6e18443602879aa428211a50
SHA256d890e54e56f84854d4daace1ea55ad979191dd02c682dba496a405372dff1882
SHA5123ae4641fa4410664041bf7d61565a0959faf42c8e16f8639fb6b65f8e7e2ea679fd28246be905289584fb68ff19266be7f86ddb8e681b4dc929ebc1017b7763c
-
C:\Users\Admin\AppData\Local\Temp\1000005001\6ef7b88bbf.exeFilesize
2.1MB
MD5eac40b0f2ff92f87f0805fd66d2616ff
SHA1bd5e547b35bb402294d824114a4f1462e4048fe6
SHA2563596bd6a9c09e6000268927e0e4361dc75496aaa08776e01bc93a4b820614433
SHA5120c06c198bf75fd0a7af990351e93d49df46fe67159cf2b2a0424c449de95a9031ef804a1f5f9cf82ecf98a92312933a4d54f2bf38b009b57f4a656feae196b62
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD55a996b54fdf70f6892280510c7963ca4
SHA11961084438cfe019e96fee746bc91ea308838352
SHA256033f918f491b1e0c4a20deed3227013ddc9faad078aae3d2f043062db0dbe158
SHA512f158e0a5dfc4f9a2e606e0b54a4047e8686a707153ebecffc988fbe95c6a379d6869cf29908e1ced6a16e4e12d83a2f7b5897748bc363a97a6c8940ce63e543f
-
memory/948-0-0x0000000000640000-0x0000000000AEE000-memory.dmpFilesize
4.7MB
-
memory/948-5-0x0000000000640000-0x0000000000AEE000-memory.dmpFilesize
4.7MB
-
memory/948-3-0x0000000000640000-0x0000000000AEE000-memory.dmpFilesize
4.7MB
-
memory/948-16-0x0000000000640000-0x0000000000AEE000-memory.dmpFilesize
4.7MB
-
memory/948-2-0x0000000000641000-0x000000000066F000-memory.dmpFilesize
184KB
-
memory/948-1-0x0000000077A16000-0x0000000077A18000-memory.dmpFilesize
8KB
-
memory/1596-102-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/1596-99-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/1684-52-0x0000000000B10000-0x0000000000FE2000-memory.dmpFilesize
4.8MB
-
memory/1684-39-0x0000000000B10000-0x0000000000FE2000-memory.dmpFilesize
4.8MB
-
memory/1712-110-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-89-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-135-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-107-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-53-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-94-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-112-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-91-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-115-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-103-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-118-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-131-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-81-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-128-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/1712-86-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/2320-97-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/2320-100-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/2992-124-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/2992-127-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/3460-77-0x0000000000CF0000-0x0000000001364000-memory.dmpFilesize
6.5MB
-
memory/3460-78-0x0000000000CF0000-0x0000000001364000-memory.dmpFilesize
6.5MB
-
memory/3460-79-0x0000000000CF0000-0x0000000001364000-memory.dmpFilesize
6.5MB
-
memory/3460-74-0x0000000000CF0000-0x0000000001364000-memory.dmpFilesize
6.5MB
-
memory/3460-75-0x0000000000CF0000-0x0000000001364000-memory.dmpFilesize
6.5MB
-
memory/3460-76-0x0000000000CF0000-0x0000000001364000-memory.dmpFilesize
6.5MB
-
memory/3460-72-0x0000000000CF0000-0x0000000001364000-memory.dmpFilesize
6.5MB
-
memory/3460-84-0x0000000000CF0000-0x0000000001364000-memory.dmpFilesize
6.5MB
-
memory/3460-73-0x0000000000CF0000-0x0000000001364000-memory.dmpFilesize
6.5MB
-
memory/4852-20-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-119-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-106-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-19-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-109-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-17-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-93-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-114-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-90-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-116-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-87-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-104-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-21-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-85-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-134-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-83-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-82-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-129-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-80-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4852-132-0x00000000002A0000-0x000000000074E000-memory.dmpFilesize
4.7MB
-
memory/4928-126-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB
-
memory/4928-122-0x0000000000150000-0x0000000000622000-memory.dmpFilesize
4.8MB