Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-05-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe
Resource
win10v2004-20240426-en
General
-
Target
ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe
-
Size
1.8MB
-
MD5
4c0dd50a592a3e148f7fdff9be9257b3
-
SHA1
31302b72469f10eeecca30ad7484802422587c21
-
SHA256
ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d
-
SHA512
f77adf77d019056be365d80dccb8bb47d72166af6e40c875f9470434ce452061138c1d1b174edfd9a9c282150ac40fb2a79fc15e61038c591ca0584936954f52
-
SSDEEP
49152:/enivSVjodL2a9u8C7GE5202jWeMfzpY8jwonv:/wivSx7a9ulGV02WlWCBv
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
Processes:
explortu.exe49bd961015.exeaxplont.exee8bda8d3b4.exeexplortu.exeaxplont.exeef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 49bd961015.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e8bda8d3b4.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explortu.exe49bd961015.exeaxplont.exeaxplont.exeaxplont.exeaxplont.exeef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exeexplortu.exeexplortu.exee8bda8d3b4.exeexplortu.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 49bd961015.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 49bd961015.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e8bda8d3b4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e8bda8d3b4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe -
Executes dropped EXE 10 IoCs
Processes:
explortu.exe49bd961015.exeaxplont.exee8bda8d3b4.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 3916 explortu.exe 2828 49bd961015.exe 2408 axplont.exe 648 e8bda8d3b4.exe 428 axplont.exe 1884 explortu.exe 1624 axplont.exe 1460 explortu.exe 1644 axplont.exe 1080 explortu.exe -
Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
49bd961015.exeaxplont.exeaxplont.exeexplortu.exeexplortu.exee8bda8d3b4.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine 49bd961015.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine e8bda8d3b4.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\e8bda8d3b4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\e8bda8d3b4.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
Processes:
ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exeexplortu.exe49bd961015.exeaxplont.exee8bda8d3b4.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 1412 ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe 3916 explortu.exe 2828 49bd961015.exe 2408 axplont.exe 648 e8bda8d3b4.exe 428 axplont.exe 1884 explortu.exe 1624 axplont.exe 1460 explortu.exe 1644 axplont.exe 1080 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe49bd961015.exedescription ioc process File created C:\Windows\Tasks\explortu.job ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe File created C:\Windows\Tasks\axplont.job 49bd961015.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exeexplortu.exe49bd961015.exeaxplont.exee8bda8d3b4.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 1412 ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe 1412 ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe 3916 explortu.exe 3916 explortu.exe 2828 49bd961015.exe 2828 49bd961015.exe 2408 axplont.exe 2408 axplont.exe 648 e8bda8d3b4.exe 648 e8bda8d3b4.exe 428 axplont.exe 428 axplont.exe 1884 explortu.exe 1884 explortu.exe 1624 axplont.exe 1624 axplont.exe 1460 explortu.exe 1460 explortu.exe 1644 axplont.exe 1644 axplont.exe 1080 explortu.exe 1080 explortu.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
49bd961015.exepid process 2828 49bd961015.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exeexplortu.exe49bd961015.exedescription pid process target process PID 1412 wrote to memory of 3916 1412 ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe explortu.exe PID 1412 wrote to memory of 3916 1412 ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe explortu.exe PID 1412 wrote to memory of 3916 1412 ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe explortu.exe PID 3916 wrote to memory of 3088 3916 explortu.exe explortu.exe PID 3916 wrote to memory of 3088 3916 explortu.exe explortu.exe PID 3916 wrote to memory of 3088 3916 explortu.exe explortu.exe PID 3916 wrote to memory of 2828 3916 explortu.exe 49bd961015.exe PID 3916 wrote to memory of 2828 3916 explortu.exe 49bd961015.exe PID 3916 wrote to memory of 2828 3916 explortu.exe 49bd961015.exe PID 2828 wrote to memory of 2408 2828 49bd961015.exe axplont.exe PID 2828 wrote to memory of 2408 2828 49bd961015.exe axplont.exe PID 2828 wrote to memory of 2408 2828 49bd961015.exe axplont.exe PID 3916 wrote to memory of 648 3916 explortu.exe e8bda8d3b4.exe PID 3916 wrote to memory of 648 3916 explortu.exe e8bda8d3b4.exe PID 3916 wrote to memory of 648 3916 explortu.exe e8bda8d3b4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe"C:\Users\Admin\AppData\Local\Temp\ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\49bd961015.exe"C:\Users\Admin\1000004002\49bd961015.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\e8bda8d3b4.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\e8bda8d3b4.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\49bd961015.exeFilesize
1.8MB
MD52476e52ad77b0ffe3ee3fad31dec7963
SHA16488f320219297e79218274429fa37dbe44d47af
SHA256cb326c6454516589b7b30807602ae25ae8ba533ab45c8ec3b57f2db72dcae555
SHA51245ab022a5ac1af892a8f82eac9525d627cd180d6ecac9856164fdb03351c82533dd7a0f9e988522786be87bce21f62b1b591832c043bddd398839409d830022d
-
C:\Users\Admin\AppData\Local\Temp\1000005001\e8bda8d3b4.exeFilesize
2.3MB
MD508a99d42896142ff7e11085c5624b443
SHA1b69774b8f2c55a92f5254fa746d4cb848e5a068a
SHA25666247a9c4a16609db6e65bb6f8b20b1ed102278e0957a1d397679455a9042a6c
SHA51272de47aaf9eb830d149b5918f116891b7180147ea177f689dc5ec6958aa5035f00376fd8f008d1669a215a51a2143afefbe5fb2f686aabea69a704354d40ad94
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD54c0dd50a592a3e148f7fdff9be9257b3
SHA131302b72469f10eeecca30ad7484802422587c21
SHA256ef0db9bfb85e8a883ac898bf90bdb649a5548ab8c83c25d7c8d5cffe750e661d
SHA512f77adf77d019056be365d80dccb8bb47d72166af6e40c875f9470434ce452061138c1d1b174edfd9a9c282150ac40fb2a79fc15e61038c591ca0584936954f52
-
memory/428-83-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/428-78-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/648-86-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-96-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-94-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-100-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-103-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-90-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-91-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-130-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-126-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-106-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-71-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-123-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-121-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-118-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/648-114-0x0000000000700000-0x0000000000CDC000-memory.dmpFilesize
5.9MB
-
memory/1080-133-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/1080-135-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/1412-5-0x0000000000790000-0x0000000000C4D000-memory.dmpFilesize
4.7MB
-
memory/1412-2-0x0000000000791000-0x00000000007BF000-memory.dmpFilesize
184KB
-
memory/1412-1-0x0000000077586000-0x0000000077588000-memory.dmpFilesize
8KB
-
memory/1412-0-0x0000000000790000-0x0000000000C4D000-memory.dmpFilesize
4.7MB
-
memory/1412-3-0x0000000000790000-0x0000000000C4D000-memory.dmpFilesize
4.7MB
-
memory/1412-17-0x0000000000790000-0x0000000000C4D000-memory.dmpFilesize
4.7MB
-
memory/1460-109-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/1460-111-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/1624-110-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/1624-107-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/1644-131-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/1644-134-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/1884-81-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/1884-84-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/2408-116-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-104-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-137-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-98-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-76-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-50-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-101-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-128-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-92-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-119-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-95-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-88-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-87-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-113-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-125-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2408-122-0x00000000002D0000-0x0000000000790000-memory.dmpFilesize
4.8MB
-
memory/2828-52-0x0000000000540000-0x0000000000A00000-memory.dmpFilesize
4.8MB
-
memory/2828-38-0x0000000000540000-0x0000000000A00000-memory.dmpFilesize
4.8MB
-
memory/3916-89-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-85-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-117-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-74-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-115-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-120-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-73-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-112-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-72-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-124-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-80-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-77-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-127-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-102-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-93-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-99-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-20-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-19-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-18-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-136-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB
-
memory/3916-97-0x00000000002F0000-0x00000000007AD000-memory.dmpFilesize
4.7MB