Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 09:32
Static task
static1
Behavioral task
behavioral1
Sample
53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe
Resource
win10v2004-20240508-en
General
-
Target
53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe
-
Size
1.9MB
-
MD5
ba40df5eba055a5dd50f3070967e05ef
-
SHA1
b0876b854734ea091c76822f0636b7b35444e8b9
-
SHA256
53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164
-
SHA512
9f4db6caaaef678a6ec3a9399bfa8a8dd24218c3f0b5929b2516fdc89c3af7f8880fd25ceec515a0d0c8dcc3034883f3efa6cbe8a57089e0fd51eb983055781f
-
SSDEEP
49152:hEsF3A/V6iXy3urYHrXw22zuZh4O1DLh0Z7:h9ORsLA2rZh4O1DLKB
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
Processes:
53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exeexplortu.exe1413b623a8.exeaxplont.exeexplortu.exeaxplont.exe046270895a.exeaxplont.exeexplortu.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1413b623a8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 046270895a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1413b623a8.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exe53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exeexplortu.exeexplortu.exe046270895a.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1413b623a8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1413b623a8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 046270895a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 046270895a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe -
Executes dropped EXE 8 IoCs
Processes:
explortu.exe1413b623a8.exeaxplont.exe046270895a.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4032 explortu.exe 3896 1413b623a8.exe 3356 axplont.exe 3912 046270895a.exe 3184 axplont.exe 2692 explortu.exe 4640 axplont.exe 3408 explortu.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explortu.exeaxplont.exeexplortu.exe53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe046270895a.exeaxplont.exeaxplont.exeexplortu.exe1413b623a8.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine 046270895a.exe Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine 1413b623a8.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\046270895a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\046270895a.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exeexplortu.exe1413b623a8.exeaxplont.exe046270895a.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 3716 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe 4032 explortu.exe 3896 1413b623a8.exe 3356 axplont.exe 3912 046270895a.exe 3184 axplont.exe 2692 explortu.exe 4640 axplont.exe 3408 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe1413b623a8.exedescription ioc process File created C:\Windows\Tasks\explortu.job 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe File created C:\Windows\Tasks\axplont.job 1413b623a8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exeexplortu.exe1413b623a8.exeaxplont.exe046270895a.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 3716 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe 3716 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe 4032 explortu.exe 4032 explortu.exe 3896 1413b623a8.exe 3896 1413b623a8.exe 3356 axplont.exe 3356 axplont.exe 3912 046270895a.exe 3912 046270895a.exe 3184 axplont.exe 3184 axplont.exe 2692 explortu.exe 2692 explortu.exe 4640 axplont.exe 4640 axplont.exe 3408 explortu.exe 3408 explortu.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exeexplortu.exe1413b623a8.exedescription pid process target process PID 3716 wrote to memory of 4032 3716 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe explortu.exe PID 3716 wrote to memory of 4032 3716 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe explortu.exe PID 3716 wrote to memory of 4032 3716 53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe explortu.exe PID 4032 wrote to memory of 3968 4032 explortu.exe explortu.exe PID 4032 wrote to memory of 3968 4032 explortu.exe explortu.exe PID 4032 wrote to memory of 3968 4032 explortu.exe explortu.exe PID 4032 wrote to memory of 3896 4032 explortu.exe 1413b623a8.exe PID 4032 wrote to memory of 3896 4032 explortu.exe 1413b623a8.exe PID 4032 wrote to memory of 3896 4032 explortu.exe 1413b623a8.exe PID 3896 wrote to memory of 3356 3896 1413b623a8.exe axplont.exe PID 3896 wrote to memory of 3356 3896 1413b623a8.exe axplont.exe PID 3896 wrote to memory of 3356 3896 1413b623a8.exe axplont.exe PID 4032 wrote to memory of 3912 4032 explortu.exe 046270895a.exe PID 4032 wrote to memory of 3912 4032 explortu.exe 046270895a.exe PID 4032 wrote to memory of 3912 4032 explortu.exe 046270895a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe"C:\Users\Admin\AppData\Local\Temp\53988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵PID:3968
-
C:\Users\Admin\1000004002\1413b623a8.exe"C:\Users\Admin\1000004002\1413b623a8.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\1000005001\046270895a.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\046270895a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3912
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3184
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4640
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\1413b623a8.exeFilesize
1.9MB
MD5436cc491bd26f81d320e0395e5f9a28a
SHA18f9a49356176538741f3dbd364dcfb01bb5b6c26
SHA25608053adfeae7dd9c11597d685dffb87473ba9e1fbaf7c9bea32abe26cc1e1e93
SHA51212931e95c58d549405156013abcdbff91f722549355ab4d22030c2ff43c359b286a68993f87b2daeede954647e6bb389dd5753c0f9ac7d280922ffb496e94581
-
C:\Users\Admin\AppData\Local\Temp\1000005001\046270895a.exeFilesize
2.3MB
MD553935618d57886b1eebd94a7a7811989
SHA13dff13b38128ce79d687e5cf1a8de506b8121bed
SHA2563037913d7d2b2adc8298499f24b3f5069c0d3ad4ed82b404185113faa70790b8
SHA512cdbdf3040acc6070446306c8b49c0eb8235f31e39a31dd1e9e3d9d83a8afdc902aab940ed5675e2ed429eff2d9aeb1ffb3b054348291f6b5f0cda01dfca61690
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.9MB
MD5ba40df5eba055a5dd50f3070967e05ef
SHA1b0876b854734ea091c76822f0636b7b35444e8b9
SHA25653988aed38c987fe2807558991f94425499d7ad8f231af17bc6c7a6dad1a5164
SHA5129f4db6caaaef678a6ec3a9399bfa8a8dd24218c3f0b5929b2516fdc89c3af7f8880fd25ceec515a0d0c8dcc3034883f3efa6cbe8a57089e0fd51eb983055781f
-
memory/2692-89-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/2692-86-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/3184-87-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3184-84-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-102-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-96-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-120-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-117-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-126-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-93-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-53-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-80-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-123-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-114-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-99-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-90-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-75-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3356-105-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/3408-111-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/3408-113-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/3716-17-0x0000000000ED0000-0x00000000013A6000-memory.dmpFilesize
4.8MB
-
memory/3716-0-0x0000000000ED0000-0x00000000013A6000-memory.dmpFilesize
4.8MB
-
memory/3716-5-0x0000000000ED0000-0x00000000013A6000-memory.dmpFilesize
4.8MB
-
memory/3716-3-0x0000000000ED0000-0x00000000013A6000-memory.dmpFilesize
4.8MB
-
memory/3716-2-0x0000000000ED1000-0x0000000000EFF000-memory.dmpFilesize
184KB
-
memory/3716-1-0x0000000077DF6000-0x0000000077DF8000-memory.dmpFilesize
8KB
-
memory/3896-52-0x0000000000FB0000-0x0000000001483000-memory.dmpFilesize
4.8MB
-
memory/3896-39-0x0000000000FB0000-0x0000000001483000-memory.dmpFilesize
4.8MB
-
memory/3912-94-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-106-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-127-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-124-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-81-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-121-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-78-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-118-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-98-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-115-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-72-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-101-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-91-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/3912-103-0x00000000008A0000-0x0000000000E69000-memory.dmpFilesize
5.8MB
-
memory/4032-74-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-122-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-104-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-107-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-128-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-77-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-92-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-73-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-100-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-79-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-116-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-21-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-97-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-119-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-20-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-95-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-76-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-19-0x00000000002A1000-0x00000000002CF000-memory.dmpFilesize
184KB
-
memory/4032-83-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-125-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4032-18-0x00000000002A0000-0x0000000000776000-memory.dmpFilesize
4.8MB
-
memory/4640-112-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB
-
memory/4640-109-0x00000000000A0000-0x0000000000573000-memory.dmpFilesize
4.8MB