Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 17:11
Static task
static1
Behavioral task
behavioral1
Sample
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe
Resource
win11-20240508-en
General
-
Target
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe
-
Size
1.8MB
-
MD5
3ac66faefeb01b927f04a52b51662695
-
SHA1
70f115a7aa3113bcdcb88f0733a5e5ab961ea1d7
-
SHA256
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64
-
SHA512
0de6d26b08d06a8a1284f8ee674c7eb3a7467c3700fad67697e5ef71c07700fa3cf577779cbcda0f481ae58320d198c168ac198d3d98bd646f1b334035458300
-
SSDEEP
49152:nekySKb4aDxjL5fuzrerv14JK9HBSdcz3xOgItA:ek3wxnwzOqJGH0dcz3tx
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
Processes:
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe7cae33ef9c.exeaxplont.exeexplortu.exeaxplont.exee99eac554d.exeexplortu.exeaxplont.exeexplortu.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7cae33ef9c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e99eac554d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplont.exeaxplont.exeexplortu.exec0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exeexplortu.exe7cae33ef9c.exee99eac554d.exeexplortu.exeaxplont.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7cae33ef9c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e99eac554d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e99eac554d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7cae33ef9c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exeexplortu.exe7cae33ef9c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation explortu.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 7cae33ef9c.exe -
Executes dropped EXE 8 IoCs
Processes:
explortu.exe7cae33ef9c.exeaxplont.exee99eac554d.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exepid process 4564 explortu.exe 1736 7cae33ef9c.exe 3272 axplont.exe 952 e99eac554d.exe 2344 explortu.exe 3248 axplont.exe 3296 explortu.exe 3436 axplont.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe7cae33ef9c.exee99eac554d.exeexplortu.exeexplortu.exeaxplont.exeaxplont.exeaxplont.exeexplortu.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Wine c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Wine 7cae33ef9c.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Wine e99eac554d.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Wine explortu.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e99eac554d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\e99eac554d.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exeexplortu.exe7cae33ef9c.exeaxplont.exee99eac554d.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exepid process 2408 c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe 4564 explortu.exe 1736 7cae33ef9c.exe 3272 axplont.exe 952 e99eac554d.exe 2344 explortu.exe 3248 axplont.exe 3296 explortu.exe 3436 axplont.exe -
Drops file in Windows directory 2 IoCs
Processes:
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe7cae33ef9c.exedescription ioc process File created C:\Windows\Tasks\explortu.job c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe File created C:\Windows\Tasks\axplont.job 7cae33ef9c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exeexplortu.exe7cae33ef9c.exeaxplont.exee99eac554d.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exepid process 2408 c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe 2408 c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe 4564 explortu.exe 4564 explortu.exe 1736 7cae33ef9c.exe 1736 7cae33ef9c.exe 3272 axplont.exe 3272 axplont.exe 952 e99eac554d.exe 952 e99eac554d.exe 2344 explortu.exe 2344 explortu.exe 3248 axplont.exe 3248 axplont.exe 3296 explortu.exe 3296 explortu.exe 3436 axplont.exe 3436 axplont.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exeexplortu.exe7cae33ef9c.exedescription pid process target process PID 2408 wrote to memory of 4564 2408 c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe explortu.exe PID 2408 wrote to memory of 4564 2408 c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe explortu.exe PID 2408 wrote to memory of 4564 2408 c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe explortu.exe PID 4564 wrote to memory of 1192 4564 explortu.exe explortu.exe PID 4564 wrote to memory of 1192 4564 explortu.exe explortu.exe PID 4564 wrote to memory of 1192 4564 explortu.exe explortu.exe PID 4564 wrote to memory of 1736 4564 explortu.exe 7cae33ef9c.exe PID 4564 wrote to memory of 1736 4564 explortu.exe 7cae33ef9c.exe PID 4564 wrote to memory of 1736 4564 explortu.exe 7cae33ef9c.exe PID 1736 wrote to memory of 3272 1736 7cae33ef9c.exe axplont.exe PID 1736 wrote to memory of 3272 1736 7cae33ef9c.exe axplont.exe PID 1736 wrote to memory of 3272 1736 7cae33ef9c.exe axplont.exe PID 4564 wrote to memory of 952 4564 explortu.exe e99eac554d.exe PID 4564 wrote to memory of 952 4564 explortu.exe e99eac554d.exe PID 4564 wrote to memory of 952 4564 explortu.exe e99eac554d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe"C:\Users\Admin\AppData\Local\Temp\c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\7cae33ef9c.exe"C:\Users\Admin\1000004002\7cae33ef9c.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\e99eac554d.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\e99eac554d.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\7cae33ef9c.exeFilesize
1.8MB
MD557a1724fa90e010c896cbfb4cfcda2bc
SHA1b3c31c410d0b67e184af9313244b59714f5a6a2e
SHA2568331f6fbf71445326af651297ea4507d7160256a00e267cd7fa20e56f7c3d222
SHA51224b437751d7f67f08e91306df00c355238d0d9e4c3e922603efbaaa76cb214823b395da481e5bf8e6dd69ae81827ed1db02298529fc0057e41a3c09ef6c09f38
-
C:\Users\Admin\AppData\Local\Temp\1000005001\e99eac554d.exeFilesize
2.3MB
MD5deeac5c0ccf149b1cd710865de019b4c
SHA170bcd60da570dbe579cdb9023efe89d8c78131d0
SHA256db1de0d217ae9c5e65fc5106fa4f8650f1f48b7e861098605d0fd9e7e01d801e
SHA512bb7da06caa21ac3ce01ac790efae95658572e53333bad9c829b8f519184adc48ef91abaff79757793047e3c73ed8bc0e338a18f93090fb5779cab63b003ff59f
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD53ac66faefeb01b927f04a52b51662695
SHA170f115a7aa3113bcdcb88f0733a5e5ab961ea1d7
SHA256c0bc56175a3e98b5afcbacaf0105b23c7cb43799d7c8913ea68cb2181e963b64
SHA5120de6d26b08d06a8a1284f8ee674c7eb3a7467c3700fad67697e5ef71c07700fa3cf577779cbcda0f481ae58320d198c168ac198d3d98bd646f1b334035458300
-
memory/952-100-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-86-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-126-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-112-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-109-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-106-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-103-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-80-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-129-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-83-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-74-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-132-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-89-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/952-115-0x0000000000E40000-0x0000000001412000-memory.dmpFilesize
5.8MB
-
memory/1736-53-0x0000000000540000-0x0000000000A01000-memory.dmpFilesize
4.8MB
-
memory/1736-40-0x0000000000540000-0x0000000000A01000-memory.dmpFilesize
4.8MB
-
memory/1736-39-0x0000000000540000-0x0000000000A01000-memory.dmpFilesize
4.8MB
-
memory/2344-92-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/2344-95-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/2408-2-0x0000000000FB1000-0x0000000000FDF000-memory.dmpFilesize
184KB
-
memory/2408-0-0x0000000000FB0000-0x0000000001477000-memory.dmpFilesize
4.8MB
-
memory/2408-5-0x0000000000FB0000-0x0000000001477000-memory.dmpFilesize
4.8MB
-
memory/2408-17-0x0000000000FB0000-0x0000000001477000-memory.dmpFilesize
4.8MB
-
memory/2408-1-0x0000000077EA4000-0x0000000077EA6000-memory.dmpFilesize
8KB
-
memory/2408-3-0x0000000000FB0000-0x0000000001477000-memory.dmpFilesize
4.8MB
-
memory/3248-97-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3248-93-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-76-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-104-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-107-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-130-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-124-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-84-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-127-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-87-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-98-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-113-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-110-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-101-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-81-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3272-54-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3296-118-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/3296-121-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/3436-119-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/3436-123-0x0000000000E80000-0x0000000001341000-memory.dmpFilesize
4.8MB
-
memory/4564-77-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-19-0x00000000006E1000-0x000000000070F000-memory.dmpFilesize
184KB
-
memory/4564-21-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-111-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-18-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-99-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-114-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-88-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-108-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-105-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-20-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-102-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-55-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-125-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-85-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-75-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-128-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-82-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-79-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-131-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB
-
memory/4564-78-0x00000000006E0000-0x0000000000BA7000-memory.dmpFilesize
4.8MB