Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-05-2024 05:10
Static task
static1
Behavioral task
behavioral1
Sample
0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe
Resource
win10v2004-20240226-en
General
-
Target
0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe
-
Size
1.8MB
-
MD5
960e350d0826e0dfb4deb06203ef9de8
-
SHA1
c90314ec63d474ef31db8a3abf1223d313c04006
-
SHA256
0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162
-
SHA512
6ac6eaedf1708f2473578c8159c5fbd265aaefb9bf926d21b2d863f167de6cb0826290d60e1319dbfda9912bf54d15af2792c862eff2da9673266871b39bcb10
-
SSDEEP
24576:GWPnMx2UWGW+Y9EFtGJYZGqBY5cQjuvybL0y9lVdSYIUHQHTYJvwIB525ezYBqP2:5PnMxhWGAjy7Y3jua30SlG9EOIttP
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
Processes:
explortu.exeaxplont.exe0d7ac7becb.exeexplortu.exeaxplont.exeexplortu.exe0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exeexplortu.exe17077649b8.exeaxplont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0d7ac7becb.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 17077649b8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explortu.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exe0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe17077649b8.exe0d7ac7becb.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 17077649b8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0d7ac7becb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 17077649b8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0d7ac7becb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe -
Executes dropped EXE 9 IoCs
Processes:
explortu.exeexplortu.exe17077649b8.exeaxplont.exe0d7ac7becb.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 2364 explortu.exe 2096 explortu.exe 4628 17077649b8.exe 1396 axplont.exe 4088 0d7ac7becb.exe 2624 axplont.exe 492 explortu.exe 3848 axplont.exe 1340 explortu.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explortu.exeaxplont.exeexplortu.exeexplortu.exe17077649b8.exeaxplont.exeaxplont.exe0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exeexplortu.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine 17077649b8.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine explortu.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000005001\0d7ac7becb.exe themida behavioral2/memory/4088-78-0x0000000000E10000-0x0000000001495000-memory.dmp themida behavioral2/memory/4088-77-0x0000000000E10000-0x0000000001495000-memory.dmp themida behavioral2/memory/4088-76-0x0000000000E10000-0x0000000001495000-memory.dmp themida behavioral2/memory/4088-79-0x0000000000E10000-0x0000000001495000-memory.dmp themida behavioral2/memory/4088-81-0x0000000000E10000-0x0000000001495000-memory.dmp themida behavioral2/memory/4088-82-0x0000000000E10000-0x0000000001495000-memory.dmp themida behavioral2/memory/4088-83-0x0000000000E10000-0x0000000001495000-memory.dmp themida behavioral2/memory/4088-80-0x0000000000E10000-0x0000000001495000-memory.dmp themida behavioral2/memory/4088-89-0x0000000000E10000-0x0000000001495000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\0d7ac7becb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\0d7ac7becb.exe" explortu.exe -
Processes:
0d7ac7becb.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0d7ac7becb.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exeexplortu.exeexplortu.exe17077649b8.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 2452 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe 2364 explortu.exe 2096 explortu.exe 4628 17077649b8.exe 1396 axplont.exe 2624 axplont.exe 492 explortu.exe 3848 axplont.exe 1340 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe17077649b8.exedescription ioc process File created C:\Windows\Tasks\explortu.job 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe File created C:\Windows\Tasks\axplont.job 17077649b8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exeexplortu.exeexplortu.exe17077649b8.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 2452 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe 2452 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe 2364 explortu.exe 2364 explortu.exe 2096 explortu.exe 2096 explortu.exe 4628 17077649b8.exe 4628 17077649b8.exe 1396 axplont.exe 1396 axplont.exe 2624 axplont.exe 2624 axplont.exe 492 explortu.exe 492 explortu.exe 3848 axplont.exe 3848 axplont.exe 1340 explortu.exe 1340 explortu.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exepid process 2452 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exeexplortu.exe17077649b8.exedescription pid process target process PID 2452 wrote to memory of 2364 2452 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe explortu.exe PID 2452 wrote to memory of 2364 2452 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe explortu.exe PID 2452 wrote to memory of 2364 2452 0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe explortu.exe PID 2364 wrote to memory of 1400 2364 explortu.exe explortu.exe PID 2364 wrote to memory of 1400 2364 explortu.exe explortu.exe PID 2364 wrote to memory of 1400 2364 explortu.exe explortu.exe PID 2364 wrote to memory of 4628 2364 explortu.exe 17077649b8.exe PID 2364 wrote to memory of 4628 2364 explortu.exe 17077649b8.exe PID 2364 wrote to memory of 4628 2364 explortu.exe 17077649b8.exe PID 4628 wrote to memory of 1396 4628 17077649b8.exe axplont.exe PID 4628 wrote to memory of 1396 4628 17077649b8.exe axplont.exe PID 4628 wrote to memory of 1396 4628 17077649b8.exe axplont.exe PID 2364 wrote to memory of 4088 2364 explortu.exe 0d7ac7becb.exe PID 2364 wrote to memory of 4088 2364 explortu.exe 0d7ac7becb.exe PID 2364 wrote to memory of 4088 2364 explortu.exe 0d7ac7becb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe"C:\Users\Admin\AppData\Local\Temp\0eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\17077649b8.exe"C:\Users\Admin\1000004002\17077649b8.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\0d7ac7becb.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\0d7ac7becb.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\17077649b8.exeFilesize
1.8MB
MD58ceb952cf1466064ce6bc52aaeecd274
SHA1ef92e3336cb30fdd8f1d8256b9fa2eb50ef2f61f
SHA25601c5e8e80a8a4086c91cad427ef82bddacb069e24e59beea3acc5f7ed4be6b3b
SHA5125e7ed2a7ec226e70cb85374111a86f2dd07eb3662305798e9f32296f0270d7437237f003c687b1c0b56c022d6b25802580f6c7f8777b892ba5aeb7561da913ad
-
C:\Users\Admin\AppData\Local\Temp\1000005001\0d7ac7becb.exeFilesize
2.2MB
MD5db67279a0f4c9c6149b79698a37bd62b
SHA1d4edd977d6145b4869402a27b2a0b288cc6b8ecc
SHA25636eb5ff6d300a523026286bdb1364302f358f1195571b4a76b5c884686c106fe
SHA512bc54c433a42ce905f7f701a632d6135fe5367f725a57109db1e9c413b3a2baf04c1ee3b5037c3c213754e55a6383a88013587345bcb992bc890f5cd554c71f7a
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD5960e350d0826e0dfb4deb06203ef9de8
SHA1c90314ec63d474ef31db8a3abf1223d313c04006
SHA2560eb659a4d6ae1274cccbd2857f08c85951265764685c5dbd946729682896e162
SHA5126ac6eaedf1708f2473578c8159c5fbd265aaefb9bf926d21b2d863f167de6cb0826290d60e1319dbfda9912bf54d15af2792c862eff2da9673266871b39bcb10
-
memory/492-110-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/492-109-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/1340-135-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/1340-132-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/1396-114-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-101-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-139-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-93-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-136-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-91-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-95-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-126-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-123-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-120-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-65-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-117-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-111-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-87-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/1396-98-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/2096-25-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2096-23-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2096-24-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-116-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-113-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-84-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-85-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-86-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-141-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-88-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-20-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-90-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-21-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-138-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-94-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-128-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-97-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-125-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-100-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-122-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-103-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-16-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-119-0x0000000000410000-0x00000000008C3000-memory.dmpFilesize
4.7MB
-
memory/2364-19-0x0000000000411000-0x000000000043F000-memory.dmpFilesize
184KB
-
memory/2452-3-0x0000000000AE0000-0x0000000000F93000-memory.dmpFilesize
4.7MB
-
memory/2452-1-0x0000000077876000-0x0000000077878000-memory.dmpFilesize
8KB
-
memory/2452-2-0x0000000000AE1000-0x0000000000B0F000-memory.dmpFilesize
184KB
-
memory/2452-0-0x0000000000AE0000-0x0000000000F93000-memory.dmpFilesize
4.7MB
-
memory/2452-5-0x0000000000AE0000-0x0000000000F93000-memory.dmpFilesize
4.7MB
-
memory/2452-18-0x0000000000AE0000-0x0000000000F93000-memory.dmpFilesize
4.7MB
-
memory/2624-107-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/2624-105-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/3848-133-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/3848-130-0x0000000000C10000-0x00000000010B7000-memory.dmpFilesize
4.7MB
-
memory/4088-79-0x0000000000E10000-0x0000000001495000-memory.dmpFilesize
6.5MB
-
memory/4088-76-0x0000000000E10000-0x0000000001495000-memory.dmpFilesize
6.5MB
-
memory/4088-80-0x0000000000E10000-0x0000000001495000-memory.dmpFilesize
6.5MB
-
memory/4088-77-0x0000000000E10000-0x0000000001495000-memory.dmpFilesize
6.5MB
-
memory/4088-78-0x0000000000E10000-0x0000000001495000-memory.dmpFilesize
6.5MB
-
memory/4088-81-0x0000000000E10000-0x0000000001495000-memory.dmpFilesize
6.5MB
-
memory/4088-82-0x0000000000E10000-0x0000000001495000-memory.dmpFilesize
6.5MB
-
memory/4088-89-0x0000000000E10000-0x0000000001495000-memory.dmpFilesize
6.5MB
-
memory/4088-83-0x0000000000E10000-0x0000000001495000-memory.dmpFilesize
6.5MB
-
memory/4628-64-0x0000000000010000-0x00000000004B7000-memory.dmpFilesize
4.7MB
-
memory/4628-43-0x0000000000010000-0x00000000004B7000-memory.dmpFilesize
4.7MB