Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 01:41
Static task
static1
Behavioral task
behavioral1
Sample
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe
Resource
win10v2004-20240426-en
General
-
Target
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe
-
Size
1.8MB
-
MD5
f95938fcc8b1f0a823606f05455cfb01
-
SHA1
988529fdcabe71e26adef2bff1266486b26b3bb0
-
SHA256
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e
-
SHA512
26db0ac9d52cdb296e1a8bee835f2a800ea9aa9bbc421f5d627b1a687bb447881b50697d23851d3144f3955cef73aba940cb1ad06944636402e431719634924a
-
SSDEEP
49152:9DReee9U+XGcQdA3T86/a4sBm3W3/lL4D:91eh9PGcqkMBha
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
Processes:
explortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeexplortu.exeeb5bb14787.exeaxplont.exece2f22f298.exef566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ eb5bb14787.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ce2f22f298.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeaxplont.exeexplortu.exece2f22f298.exeaxplont.exeexplortu.exeeb5bb14787.exeexplortu.exeexplortu.exeaxplont.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ce2f22f298.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ce2f22f298.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion eb5bb14787.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion eb5bb14787.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeexplortu.exeeb5bb14787.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation explortu.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation eb5bb14787.exe -
Executes dropped EXE 9 IoCs
Processes:
explortu.exeeb5bb14787.exeexplortu.exeaxplont.exece2f22f298.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exepid process 3120 explortu.exe 2348 eb5bb14787.exe 2520 explortu.exe 3636 axplont.exe 4472 ce2f22f298.exe 3132 axplont.exe 3712 explortu.exe 1672 explortu.exe 3396 axplont.exe -
Identifies Wine through registry keys 2 TTPs 10 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explortu.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exef566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeeb5bb14787.exece2f22f298.exeaxplont.exeexplortu.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine eb5bb14787.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine ce2f22f298.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine explortu.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ce2f22f298.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\ce2f22f298.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeexplortu.exeeb5bb14787.exeexplortu.exeaxplont.exece2f22f298.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4504 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe 3120 explortu.exe 2348 eb5bb14787.exe 2520 explortu.exe 3636 axplont.exe 4472 ce2f22f298.exe 3132 axplont.exe 3712 explortu.exe 3396 axplont.exe 1672 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeeb5bb14787.exedescription ioc process File created C:\Windows\Tasks\explortu.job f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe File created C:\Windows\Tasks\axplont.job eb5bb14787.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeexplortu.exeeb5bb14787.exeexplortu.exeaxplont.exece2f22f298.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4504 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe 4504 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe 3120 explortu.exe 3120 explortu.exe 2348 eb5bb14787.exe 2348 eb5bb14787.exe 2520 explortu.exe 2520 explortu.exe 3636 axplont.exe 3636 axplont.exe 4472 ce2f22f298.exe 4472 ce2f22f298.exe 3132 axplont.exe 3132 axplont.exe 3712 explortu.exe 3712 explortu.exe 3396 axplont.exe 3396 axplont.exe 1672 explortu.exe 1672 explortu.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeexplortu.exeeb5bb14787.exedescription pid process target process PID 4504 wrote to memory of 3120 4504 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe explortu.exe PID 4504 wrote to memory of 3120 4504 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe explortu.exe PID 4504 wrote to memory of 3120 4504 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe explortu.exe PID 3120 wrote to memory of 3696 3120 explortu.exe explortu.exe PID 3120 wrote to memory of 3696 3120 explortu.exe explortu.exe PID 3120 wrote to memory of 3696 3120 explortu.exe explortu.exe PID 3120 wrote to memory of 2348 3120 explortu.exe eb5bb14787.exe PID 3120 wrote to memory of 2348 3120 explortu.exe eb5bb14787.exe PID 3120 wrote to memory of 2348 3120 explortu.exe eb5bb14787.exe PID 2348 wrote to memory of 3636 2348 eb5bb14787.exe axplont.exe PID 2348 wrote to memory of 3636 2348 eb5bb14787.exe axplont.exe PID 2348 wrote to memory of 3636 2348 eb5bb14787.exe axplont.exe PID 3120 wrote to memory of 4472 3120 explortu.exe ce2f22f298.exe PID 3120 wrote to memory of 4472 3120 explortu.exe ce2f22f298.exe PID 3120 wrote to memory of 4472 3120 explortu.exe ce2f22f298.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe"C:\Users\Admin\AppData\Local\Temp\f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\eb5bb14787.exe"C:\Users\Admin\1000004002\eb5bb14787.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\ce2f22f298.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\ce2f22f298.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\eb5bb14787.exeFilesize
1.8MB
MD55d6d56228a521ee752a238ea18074f56
SHA126140280dbe2f52eb65e3b91b88e6060f5c1275f
SHA256bf2d25a995a7bdc2f458bd3347a4f128b4c99285283b8434663f7a1f47d93703
SHA512396293c2281b3d757b3071fe5f708c057b2026c90a0012a9418f4e4ab548f5d753e7a42af3944d00820056500b61b73f5b25fa2f51ad75db1ad4f098cd71dfc0
-
C:\Users\Admin\AppData\Local\Temp\1000005001\ce2f22f298.exeFilesize
2.3MB
MD51d7070198b11f8f874cb131e8661f744
SHA158d190cd05534276f3e8798ea4ff48c4f99a71d3
SHA2569721a3aec263d78d2ba7d6739818dca2dea59cb63797a37abbbba6d210857aa5
SHA5127e45e0a0fcfdfc30d690af35f0db65074153b85cb938590e9aff230239900c2ad9caf47dd7c42e0208163e46d75ba067d194a59c93b571381cebe373d30af537
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD5f95938fcc8b1f0a823606f05455cfb01
SHA1988529fdcabe71e26adef2bff1266486b26b3bb0
SHA256f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e
SHA51226db0ac9d52cdb296e1a8bee835f2a800ea9aa9bbc421f5d627b1a687bb447881b50697d23851d3144f3955cef73aba940cb1ad06944636402e431719634924a
-
memory/1672-123-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/1672-126-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/2348-56-0x00000000005A0000-0x0000000000A52000-memory.dmpFilesize
4.7MB
-
memory/2348-39-0x00000000005A0000-0x0000000000A52000-memory.dmpFilesize
4.7MB
-
memory/2520-51-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/2520-41-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-19-0x00000000009A1000-0x00000000009CF000-memory.dmpFilesize
184KB
-
memory/3120-80-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-20-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-93-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-18-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-90-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-88-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-127-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-130-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-76-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-118-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-78-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-79-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-21-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-82-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-115-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-112-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-84-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-110-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-106-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3120-103-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3132-100-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3132-98-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3396-125-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3396-124-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-91-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-85-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-94-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-131-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-113-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-128-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-57-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-109-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-104-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-87-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-119-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-116-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-107-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3636-81-0x00000000003E0000-0x0000000000892000-memory.dmpFilesize
4.7MB
-
memory/3712-99-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/3712-102-0x00000000009A0000-0x0000000000E56000-memory.dmpFilesize
4.7MB
-
memory/4472-83-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-120-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-114-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-111-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-108-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-86-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-117-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-77-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-105-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-132-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-89-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-95-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-129-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4472-92-0x00000000005E0000-0x0000000000BE2000-memory.dmpFilesize
6.0MB
-
memory/4504-3-0x0000000000490000-0x0000000000946000-memory.dmpFilesize
4.7MB
-
memory/4504-2-0x0000000000491000-0x00000000004BF000-memory.dmpFilesize
184KB
-
memory/4504-5-0x0000000000490000-0x0000000000946000-memory.dmpFilesize
4.7MB
-
memory/4504-1-0x00000000770B4000-0x00000000770B6000-memory.dmpFilesize
8KB
-
memory/4504-17-0x0000000000490000-0x0000000000946000-memory.dmpFilesize
4.7MB
-
memory/4504-0-0x0000000000490000-0x0000000000946000-memory.dmpFilesize
4.7MB