Analysis
-
max time kernel
146s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 10:13
Static task
static1
Behavioral task
behavioral1
Sample
91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe
Resource
win10v2004-20240508-en
General
-
Target
91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe
-
Size
1.8MB
-
MD5
05d98b7fc0b456457b26f0cf9f27175d
-
SHA1
d38fea34d3b06f07ebab5b7229ee056bf70a5efe
-
SHA256
91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7
-
SHA512
34a89e18867b02ed788d9e99a630a4c2790e8c87593dcdf4b3ef1c1cf95ec6c3e66c7911dd73aeee2c339111a318402fe7bc637702dde7197a76fe75358cb4ca
-
SSDEEP
49152:rD3eFH93aMbbZx/X/aEFOD14Kf+uWyW/80Bgqydrmcf:mH1aMb9NPkD14KWuWY0Bgqydrmcf
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
Processes:
axplont.exea48d3a0f1f.exe91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exeffaf44f106.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeexplortu.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a48d3a0f1f.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ffaf44f106.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exeffaf44f106.exeexplortu.exeexplortu.exeaxplont.exeaxplont.exeaxplont.exea48d3a0f1f.exeexplortu.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ffaf44f106.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ffaf44f106.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a48d3a0f1f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a48d3a0f1f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exeexplortu.exeffaf44f106.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation explortu.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ffaf44f106.exe -
Executes dropped EXE 8 IoCs
Processes:
explortu.exeffaf44f106.exeaxplont.exea48d3a0f1f.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exepid process 1900 explortu.exe 3248 ffaf44f106.exe 228 axplont.exe 4876 a48d3a0f1f.exe 4768 explortu.exe 1284 axplont.exe 4828 explortu.exe 904 axplont.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
axplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exe91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exeexplortu.exeffaf44f106.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine ffaf44f106.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000005001\a48d3a0f1f.exe themida behavioral1/memory/4876-75-0x0000000000770000-0x0000000000DE4000-memory.dmp themida behavioral1/memory/4876-76-0x0000000000770000-0x0000000000DE4000-memory.dmp themida behavioral1/memory/4876-77-0x0000000000770000-0x0000000000DE4000-memory.dmp themida behavioral1/memory/4876-74-0x0000000000770000-0x0000000000DE4000-memory.dmp themida behavioral1/memory/4876-78-0x0000000000770000-0x0000000000DE4000-memory.dmp themida behavioral1/memory/4876-81-0x0000000000770000-0x0000000000DE4000-memory.dmp themida behavioral1/memory/4876-80-0x0000000000770000-0x0000000000DE4000-memory.dmp themida behavioral1/memory/4876-79-0x0000000000770000-0x0000000000DE4000-memory.dmp themida behavioral1/memory/4876-86-0x0000000000770000-0x0000000000DE4000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a48d3a0f1f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\a48d3a0f1f.exe" explortu.exe -
Processes:
a48d3a0f1f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a48d3a0f1f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
Processes:
91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exeexplortu.exeffaf44f106.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4596 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe 1900 explortu.exe 3248 ffaf44f106.exe 228 axplont.exe 1284 axplont.exe 4768 explortu.exe 904 axplont.exe 4828 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exeffaf44f106.exedescription ioc process File created C:\Windows\Tasks\explortu.job 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe File created C:\Windows\Tasks\axplont.job ffaf44f106.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exeexplortu.exeffaf44f106.exeaxplont.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exepid process 4596 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe 4596 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe 1900 explortu.exe 1900 explortu.exe 3248 ffaf44f106.exe 3248 ffaf44f106.exe 228 axplont.exe 228 axplont.exe 1284 axplont.exe 1284 axplont.exe 4768 explortu.exe 4768 explortu.exe 4828 explortu.exe 4828 explortu.exe 904 axplont.exe 904 axplont.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
ffaf44f106.exepid process 3248 ffaf44f106.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exeexplortu.exeffaf44f106.exedescription pid process target process PID 4596 wrote to memory of 1900 4596 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe explortu.exe PID 4596 wrote to memory of 1900 4596 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe explortu.exe PID 4596 wrote to memory of 1900 4596 91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe explortu.exe PID 1900 wrote to memory of 3240 1900 explortu.exe explortu.exe PID 1900 wrote to memory of 3240 1900 explortu.exe explortu.exe PID 1900 wrote to memory of 3240 1900 explortu.exe explortu.exe PID 1900 wrote to memory of 3248 1900 explortu.exe ffaf44f106.exe PID 1900 wrote to memory of 3248 1900 explortu.exe ffaf44f106.exe PID 1900 wrote to memory of 3248 1900 explortu.exe ffaf44f106.exe PID 3248 wrote to memory of 228 3248 ffaf44f106.exe axplont.exe PID 3248 wrote to memory of 228 3248 ffaf44f106.exe axplont.exe PID 3248 wrote to memory of 228 3248 ffaf44f106.exe axplont.exe PID 1900 wrote to memory of 4876 1900 explortu.exe a48d3a0f1f.exe PID 1900 wrote to memory of 4876 1900 explortu.exe a48d3a0f1f.exe PID 1900 wrote to memory of 4876 1900 explortu.exe a48d3a0f1f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe"C:\Users\Admin\AppData\Local\Temp\91c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\ffaf44f106.exe"C:\Users\Admin\1000004002\ffaf44f106.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\a48d3a0f1f.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\a48d3a0f1f.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\ffaf44f106.exeFilesize
1.8MB
MD57e03538dc25285b705604b2ace4492f0
SHA12a0a13d5eb4d394c6e18443602879aa428211a50
SHA256d890e54e56f84854d4daace1ea55ad979191dd02c682dba496a405372dff1882
SHA5123ae4641fa4410664041bf7d61565a0959faf42c8e16f8639fb6b65f8e7e2ea679fd28246be905289584fb68ff19266be7f86ddb8e681b4dc929ebc1017b7763c
-
C:\Users\Admin\AppData\Local\Temp\1000005001\a48d3a0f1f.exeFilesize
2.1MB
MD5eac40b0f2ff92f87f0805fd66d2616ff
SHA1bd5e547b35bb402294d824114a4f1462e4048fe6
SHA2563596bd6a9c09e6000268927e0e4361dc75496aaa08776e01bc93a4b820614433
SHA5120c06c198bf75fd0a7af990351e93d49df46fe67159cf2b2a0424c449de95a9031ef804a1f5f9cf82ecf98a92312933a4d54f2bf38b009b57f4a656feae196b62
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD505d98b7fc0b456457b26f0cf9f27175d
SHA1d38fea34d3b06f07ebab5b7229ee056bf70a5efe
SHA25691c6a3d9a458e15c67237718bc4c74cf7d8a38ac828b9ad010f2d1b0a25a36a7
SHA51234a89e18867b02ed788d9e99a630a4c2790e8c87593dcdf4b3ef1c1cf95ec6c3e66c7911dd73aeee2c339111a318402fe7bc637702dde7197a76fe75358cb4ca
-
memory/228-111-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-114-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-137-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-131-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-88-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-128-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-125-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-134-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-99-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-85-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-108-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-105-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-54-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/228-102-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/904-119-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/904-123-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/1284-95-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/1284-92-0x00000000003D0000-0x00000000008A2000-memory.dmpFilesize
4.8MB
-
memory/1900-113-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-107-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-136-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-87-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-133-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-82-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-83-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-84-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-130-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-20-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-127-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-18-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-19-0x0000000000AA1000-0x0000000000ACF000-memory.dmpFilesize
184KB
-
memory/1900-124-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-21-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-39-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-98-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-73-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-101-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-110-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/1900-104-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/3248-53-0x00000000002D0000-0x00000000007A2000-memory.dmpFilesize
4.8MB
-
memory/3248-40-0x00000000002D0000-0x00000000007A2000-memory.dmpFilesize
4.8MB
-
memory/4596-2-0x0000000000321000-0x000000000034F000-memory.dmpFilesize
184KB
-
memory/4596-1-0x00000000770C4000-0x00000000770C6000-memory.dmpFilesize
8KB
-
memory/4596-0-0x0000000000320000-0x00000000007D2000-memory.dmpFilesize
4.7MB
-
memory/4596-5-0x0000000000320000-0x00000000007D2000-memory.dmpFilesize
4.7MB
-
memory/4596-3-0x0000000000320000-0x00000000007D2000-memory.dmpFilesize
4.7MB
-
memory/4596-17-0x0000000000320000-0x00000000007D2000-memory.dmpFilesize
4.7MB
-
memory/4768-97-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/4768-93-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/4828-122-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/4828-118-0x0000000000AA0000-0x0000000000F52000-memory.dmpFilesize
4.7MB
-
memory/4876-75-0x0000000000770000-0x0000000000DE4000-memory.dmpFilesize
6.5MB
-
memory/4876-76-0x0000000000770000-0x0000000000DE4000-memory.dmpFilesize
6.5MB
-
memory/4876-77-0x0000000000770000-0x0000000000DE4000-memory.dmpFilesize
6.5MB
-
memory/4876-86-0x0000000000770000-0x0000000000DE4000-memory.dmpFilesize
6.5MB
-
memory/4876-74-0x0000000000770000-0x0000000000DE4000-memory.dmpFilesize
6.5MB
-
memory/4876-79-0x0000000000770000-0x0000000000DE4000-memory.dmpFilesize
6.5MB
-
memory/4876-80-0x0000000000770000-0x0000000000DE4000-memory.dmpFilesize
6.5MB
-
memory/4876-81-0x0000000000770000-0x0000000000DE4000-memory.dmpFilesize
6.5MB
-
memory/4876-78-0x0000000000770000-0x0000000000DE4000-memory.dmpFilesize
6.5MB