Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 21:59
Static task
static1
Behavioral task
behavioral1
Sample
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe
Resource
win11-20240508-en
General
-
Target
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe
-
Size
1.8MB
-
MD5
13612b92a534f262cae89a24ea5285d2
-
SHA1
06953df475afce77e1f639a2a1199793b013f837
-
SHA256
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1
-
SHA512
fed9c6e903962e4eec08053a5100c3d4aaba6b03f3cdf0dbb6614fa69797c897293e0daec1bdc2730c048f21f5d5da9b3c2e4dcd99842b259951a8e530f7da26
-
SSDEEP
49152:sZO7D5bsi+IsUSfuNYYo6OmqgHRY9b23SjMvjeqNcQsFE:xFsi+IrKAYD2zBiqNc3E
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
Processes:
9762291ffc.exeaxplont.exe3b134943d0.exeaxplont.exeaxplont.exe0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exeexplortu.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9762291ffc.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3b134943d0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exeexplortu.exe9762291ffc.exeaxplont.exeaxplont.exeaxplont.exe3b134943d0.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9762291ffc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3b134943d0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3b134943d0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9762291ffc.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exeexplortu.exe9762291ffc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation explortu.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 9762291ffc.exe -
Executes dropped EXE 7 IoCs
Processes:
explortu.exeexplortu.exe9762291ffc.exeaxplont.exe3b134943d0.exeaxplont.exeaxplont.exepid process 4164 explortu.exe 3412 explortu.exe 1864 9762291ffc.exe 4396 axplont.exe 3016 3b134943d0.exe 1864 axplont.exe 1924 axplont.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
axplont.exe0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exeexplortu.exe9762291ffc.exeaxplont.exe3b134943d0.exeaxplont.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine 9762291ffc.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine 3b134943d0.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine axplont.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3b134943d0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\3b134943d0.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exeexplortu.exe9762291ffc.exeaxplont.exe3b134943d0.exeaxplont.exeaxplont.exepid process 5040 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe 4164 explortu.exe 1864 9762291ffc.exe 4396 axplont.exe 3016 3b134943d0.exe 1864 axplont.exe 1924 axplont.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
explortu.exedescription pid process target process PID 4164 set thread context of 3412 4164 explortu.exe explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe9762291ffc.exedescription ioc process File created C:\Windows\Tasks\explortu.job 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe File created C:\Windows\Tasks\axplont.job 9762291ffc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exeexplortu.exe9762291ffc.exeaxplont.exe3b134943d0.exeaxplont.exeaxplont.exepid process 5040 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe 5040 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe 4164 explortu.exe 4164 explortu.exe 1864 9762291ffc.exe 1864 9762291ffc.exe 4396 axplont.exe 4396 axplont.exe 3016 3b134943d0.exe 3016 3b134943d0.exe 1864 axplont.exe 1864 axplont.exe 1924 axplont.exe 1924 axplont.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe9762291ffc.exepid process 5040 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe 1864 9762291ffc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exeexplortu.exe9762291ffc.exedescription pid process target process PID 5040 wrote to memory of 4164 5040 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe explortu.exe PID 5040 wrote to memory of 4164 5040 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe explortu.exe PID 5040 wrote to memory of 4164 5040 0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 3412 4164 explortu.exe explortu.exe PID 4164 wrote to memory of 1864 4164 explortu.exe 9762291ffc.exe PID 4164 wrote to memory of 1864 4164 explortu.exe 9762291ffc.exe PID 4164 wrote to memory of 1864 4164 explortu.exe 9762291ffc.exe PID 1864 wrote to memory of 4396 1864 9762291ffc.exe axplont.exe PID 1864 wrote to memory of 4396 1864 9762291ffc.exe axplont.exe PID 1864 wrote to memory of 4396 1864 9762291ffc.exe axplont.exe PID 4164 wrote to memory of 3016 4164 explortu.exe 3b134943d0.exe PID 4164 wrote to memory of 3016 4164 explortu.exe 3b134943d0.exe PID 4164 wrote to memory of 3016 4164 explortu.exe 3b134943d0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe"C:\Users\Admin\AppData\Local\Temp\0aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\1000004002\9762291ffc.exe"C:\Users\Admin\1000004002\9762291ffc.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\1000005001\3b134943d0.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\3b134943d0.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3016
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\9762291ffc.exeFilesize
1.8MB
MD5db8dd150083e23e7a048e877bc611116
SHA14b11cdbe88ff0e4f8bf3233583aab8634646f073
SHA256e350d5339421ffb7b70c38a7f0242160aeb9fc0a7698ac8f9e06853c0cb8f26b
SHA51222b550126199207a3302bfb66d7f43ca4f295cbba33891d37d9024ae080944f788053bfd0427c43d2f913169ac724df6051f059231f345cb60f56046ba4bfc03
-
C:\Users\Admin\AppData\Local\Temp\1000005001\3b134943d0.exeFilesize
2.3MB
MD55d3c909b7253e635da96f476486b2207
SHA115fd1b68ff0ac0f2ec1bf69c571a4d4bd79db597
SHA256ece492d03fcad448b12a51e2c0fc60504c2559dc920b79d5b6acd79fde1373bf
SHA5129eb379d69c0153e819d2bee9b685e10e54ac9924da93920dc4834b88e76a74ff864bb3b207f6cc3ac5aa49a52a640636b78da5eb163c544f8b4e9c21eed03a64
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD513612b92a534f262cae89a24ea5285d2
SHA106953df475afce77e1f639a2a1199793b013f837
SHA2560aea674a0aed98d9591b1d80def90f1a1a39682812c014fa5de1dbe3efe498d1
SHA512fed9c6e903962e4eec08053a5100c3d4aaba6b03f3cdf0dbb6614fa69797c897293e0daec1bdc2730c048f21f5d5da9b3c2e4dcd99842b259951a8e530f7da26
-
memory/1864-96-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/1864-97-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/1864-54-0x0000000000AE0000-0x0000000000F82000-memory.dmpFilesize
4.6MB
-
memory/1864-41-0x0000000000AE0000-0x0000000000F82000-memory.dmpFilesize
4.6MB
-
memory/1924-118-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/1924-117-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/3016-115-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-121-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-81-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-85-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-106-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-109-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-100-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-112-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-84-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-103-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-75-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-95-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-124-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-91-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3016-88-0x0000000000960000-0x0000000000F3D000-memory.dmpFilesize
5.9MB
-
memory/3412-25-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/3412-23-0x0000000000400000-0x00000000009C9000-memory.dmpFilesize
5.8MB
-
memory/4164-89-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-104-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-122-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-80-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-86-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-119-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-18-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-113-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-110-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-78-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-19-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-92-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-77-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-76-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-107-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-98-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-20-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-55-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-82-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-101-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4164-21-0x0000000000BE0000-0x0000000001094000-memory.dmpFilesize
4.7MB
-
memory/4396-79-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-83-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-99-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-56-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-108-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-93-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-90-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-102-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-111-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-105-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-123-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-114-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-120-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/4396-87-0x00000000007F0000-0x0000000000C92000-memory.dmpFilesize
4.6MB
-
memory/5040-3-0x0000000000CA0000-0x0000000001154000-memory.dmpFilesize
4.7MB
-
memory/5040-4-0x0000000000CA0000-0x0000000001154000-memory.dmpFilesize
4.7MB
-
memory/5040-2-0x0000000000CA1000-0x0000000000CCF000-memory.dmpFilesize
184KB
-
memory/5040-0-0x0000000000CA0000-0x0000000001154000-memory.dmpFilesize
4.7MB
-
memory/5040-17-0x0000000000CA0000-0x0000000001154000-memory.dmpFilesize
4.7MB
-
memory/5040-1-0x0000000077954000-0x0000000077956000-memory.dmpFilesize
8KB