Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 07:02
Static task
static1
Behavioral task
behavioral1
Sample
15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe
Resource
win10v2004-20240508-en
General
-
Target
15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe
-
Size
1.9MB
-
MD5
18f684e26b30434930a86699389d73a2
-
SHA1
be27ef9c6bf5107f5dfef23340d02f50382d09f8
-
SHA256
15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9
-
SHA512
6c7b61550617a84ca9535b08d810039b283d89108aa9ab478c0bb45c250a80f80d2635de87f892c0e7b3c82976c8f7c354d532f4aca861721e8b884720b3820b
-
SSDEEP
49152:lSkD5PPAxuoPif8SRTZITZpcIhiwS1BPwQ:lSeQxuYiUSETZpcIdSoQ
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
risepro
147.45.47.126:58709
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
Processes:
axplont.exeexplortu.exeexplortu.exee2cd695bec.exef7c779f058.exeaxplont.exeexplortu.exe15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exeexplortu.exeaxplont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e2cd695bec.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f7c779f058.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplont.exeaxplont.exe15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exeexplortu.exeaxplont.exef7c779f058.exeexplortu.exeexplortu.exeexplortu.exee2cd695bec.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f7c779f058.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f7c779f058.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e2cd695bec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e2cd695bec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe -
Executes dropped EXE 9 IoCs
Processes:
explortu.exeexplortu.exee2cd695bec.exeaxplont.exef7c779f058.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4612 explortu.exe 2632 explortu.exe 2260 e2cd695bec.exe 780 axplont.exe 4588 f7c779f058.exe 2400 axplont.exe 4052 explortu.exe 3440 axplont.exe 1640 explortu.exe -
Identifies Wine through registry keys 2 TTPs 10 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explortu.exee2cd695bec.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exe15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exeexplortu.exeaxplont.exef7c779f058.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine e2cd695bec.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine f7c779f058.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\f7c779f058.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\f7c779f058.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exeexplortu.exeexplortu.exee2cd695bec.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4560 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe 4612 explortu.exe 2632 explortu.exe 2260 e2cd695bec.exe 780 axplont.exe 2400 axplont.exe 4052 explortu.exe 3440 axplont.exe 1640 explortu.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
explortu.exedescription pid process target process PID 4612 set thread context of 2632 4612 explortu.exe explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exee2cd695bec.exedescription ioc process File created C:\Windows\Tasks\explortu.job 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe File created C:\Windows\Tasks\axplont.job e2cd695bec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exeexplortu.exeexplortu.exee2cd695bec.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4560 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe 4560 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe 4612 explortu.exe 4612 explortu.exe 2632 explortu.exe 2632 explortu.exe 2260 e2cd695bec.exe 2260 e2cd695bec.exe 780 axplont.exe 780 axplont.exe 2400 axplont.exe 2400 axplont.exe 4052 explortu.exe 4052 explortu.exe 3440 axplont.exe 3440 axplont.exe 1640 explortu.exe 1640 explortu.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exeexplortu.exee2cd695bec.exedescription pid process target process PID 4560 wrote to memory of 4612 4560 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe explortu.exe PID 4560 wrote to memory of 4612 4560 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe explortu.exe PID 4560 wrote to memory of 4612 4560 15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2632 4612 explortu.exe explortu.exe PID 4612 wrote to memory of 2260 4612 explortu.exe e2cd695bec.exe PID 4612 wrote to memory of 2260 4612 explortu.exe e2cd695bec.exe PID 4612 wrote to memory of 2260 4612 explortu.exe e2cd695bec.exe PID 2260 wrote to memory of 780 2260 e2cd695bec.exe axplont.exe PID 2260 wrote to memory of 780 2260 e2cd695bec.exe axplont.exe PID 2260 wrote to memory of 780 2260 e2cd695bec.exe axplont.exe PID 4612 wrote to memory of 4588 4612 explortu.exe f7c779f058.exe PID 4612 wrote to memory of 4588 4612 explortu.exe f7c779f058.exe PID 4612 wrote to memory of 4588 4612 explortu.exe f7c779f058.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe"C:\Users\Admin\AppData\Local\Temp\15c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2632 -
C:\Users\Admin\1000004002\e2cd695bec.exe"C:\Users\Admin\1000004002\e2cd695bec.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:780 -
C:\Users\Admin\AppData\Local\Temp\1000005001\f7c779f058.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\f7c779f058.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
PID:4588
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2400
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4052
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3440
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\e2cd695bec.exeFilesize
1.8MB
MD54a30ecff4261b364c0e2d3d9e6994919
SHA11b1a786a441f668400a5ad1179bc87e0e8595294
SHA256c610fefa68e2ef606ac7eeda5ed0abcd29185f35da8c03791bcad88c13a47663
SHA51245b5dce78ae9392fac1419014215df0785c97dc1423aed14c61d6f9c19ec3f7dde72d8cbe8b9b3762c6a4326f537bf19520d7fa63285afd406c4e0c736f20571
-
C:\Users\Admin\AppData\Local\Temp\1000005001\f7c779f058.exeFilesize
2.3MB
MD528ddf87f51051c2bcc7f5335b410463c
SHA19bfc469b77ce9d005cef60214d7cb9e701923e30
SHA256c36b89151d6e9f17c61fba8892303f2bfa9558abeb424399435c1f9adc5ae54b
SHA51222865cc662c8b7d2590175018e54caa3d2f116aff655736bd0e5b6807cfaa2391fefa9127468e203a093a86673a9ebef8f8c74496bdfbe998aac9bc90b382204
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.9MB
MD518f684e26b30434930a86699389d73a2
SHA1be27ef9c6bf5107f5dfef23340d02f50382d09f8
SHA25615c9280f9458de84c4b8534fa91219d4a78d54b90bdd4cab599bff29c4dc99c9
SHA5126c7b61550617a84ca9535b08d810039b283d89108aa9ab478c0bb45c250a80f80d2635de87f892c0e7b3c82976c8f7c354d532f4aca861721e8b884720b3820b
-
memory/780-127-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/780-112-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/780-139-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/780-133-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/780-130-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/780-87-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/780-124-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/780-108-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/780-136-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/780-115-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/1640-149-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/1640-145-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/2260-86-0x0000000000760000-0x0000000000C23000-memory.dmpFilesize
4.8MB
-
memory/2260-73-0x0000000000760000-0x0000000000C23000-memory.dmpFilesize
4.8MB
-
memory/2400-119-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/2400-122-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/2632-49-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-53-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-40-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-45-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-46-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-47-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-44-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-43-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-42-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-41-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-36-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-34-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-30-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-29-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-48-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-50-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-52-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-51-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-54-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-56-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-55-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-27-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-24-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-38-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-28-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/2632-37-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-35-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-31-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-33-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-39-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/2632-32-0x0000000000400000-0x00000000009C0000-memory.dmpFilesize
5.8MB
-
memory/3440-143-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/3440-147-0x0000000000F50000-0x0000000001413000-memory.dmpFilesize
4.8MB
-
memory/4052-123-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4052-121-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4560-2-0x00000000004E1000-0x000000000050F000-memory.dmpFilesize
184KB
-
memory/4560-3-0x00000000004E0000-0x00000000009B2000-memory.dmpFilesize
4.8MB
-
memory/4560-5-0x00000000004E0000-0x00000000009B2000-memory.dmpFilesize
4.8MB
-
memory/4560-1-0x0000000077C26000-0x0000000077C28000-memory.dmpFilesize
8KB
-
memory/4560-17-0x00000000004E0000-0x00000000009B2000-memory.dmpFilesize
4.8MB
-
memory/4560-0-0x00000000004E0000-0x00000000009B2000-memory.dmpFilesize
4.8MB
-
memory/4588-110-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4588-113-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4588-116-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4588-105-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4588-140-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4588-137-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4588-125-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4588-134-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4588-131-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4588-128-0x00000000009E0000-0x0000000000FB0000-memory.dmpFilesize
5.8MB
-
memory/4612-132-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-138-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-19-0x0000000000A91000-0x0000000000ABF000-memory.dmpFilesize
184KB
-
memory/4612-118-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-18-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-126-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-135-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-111-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-20-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-129-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-109-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-114-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-141-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-107-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-106-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-21-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB
-
memory/4612-72-0x0000000000A90000-0x0000000000F62000-memory.dmpFilesize
4.8MB