Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 04:30
Static task
static1
Behavioral task
behavioral1
Sample
86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe
Resource
win10v2004-20240426-en
General
-
Target
86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe
-
Size
1.8MB
-
MD5
83a4172891b308c57bb11745b77c6413
-
SHA1
82acdcdae8d9ed1bab00ec3e865541ebe9e1df69
-
SHA256
86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397
-
SHA512
ec65de3d32edd8ea06a51d8b9630b84d03ba1a70545f432222759524a67b848d2f1d572059676d4e6a5132350eaf43123092b085b9bfca5363d3affe59ee7839
-
SSDEEP
49152:G6dnw3DgInp9oXvi6mE4nN2+dZ8Dy0H4:11w3D9DoXORNtdkxH
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
Processes:
axplont.exeexplortu.execa6606d453.exeexplortu.exee735db492c.exeaxplont.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exe86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ca6606d453.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e735db492c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ca6606d453.exeexplortu.exe86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exeaxplont.exeaxplont.exeaxplont.exeexplortu.exeexplortu.exeexplortu.exee735db492c.exeaxplont.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ca6606d453.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ca6606d453.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e735db492c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e735db492c.exe -
Executes dropped EXE 10 IoCs
Processes:
explortu.exee735db492c.exeaxplont.execa6606d453.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 3864 explortu.exe 1916 e735db492c.exe 868 axplont.exe 1920 ca6606d453.exe 1084 axplont.exe 2324 explortu.exe 4356 axplont.exe 416 explortu.exe 2896 axplont.exe 4064 explortu.exe -
Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeexplortu.exee735db492c.execa6606d453.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine e735db492c.exe Key opened \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine ca6606d453.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\ca6606d453.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\ca6606d453.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
Processes:
86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exeexplortu.exee735db492c.exeaxplont.execa6606d453.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4468 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe 3864 explortu.exe 1916 e735db492c.exe 868 axplont.exe 1920 ca6606d453.exe 1084 axplont.exe 2324 explortu.exe 4356 axplont.exe 416 explortu.exe 2896 axplont.exe 4064 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
e735db492c.exe86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exedescription ioc process File created C:\Windows\Tasks\axplont.job e735db492c.exe File created C:\Windows\Tasks\explortu.job 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exeexplortu.exee735db492c.exeaxplont.execa6606d453.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 4468 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe 4468 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe 3864 explortu.exe 3864 explortu.exe 1916 e735db492c.exe 1916 e735db492c.exe 868 axplont.exe 868 axplont.exe 1920 ca6606d453.exe 1920 ca6606d453.exe 1084 axplont.exe 1084 axplont.exe 2324 explortu.exe 2324 explortu.exe 4356 axplont.exe 4356 axplont.exe 416 explortu.exe 416 explortu.exe 2896 axplont.exe 2896 axplont.exe 4064 explortu.exe 4064 explortu.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
e735db492c.exepid process 1916 e735db492c.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exeexplortu.exee735db492c.exedescription pid process target process PID 4468 wrote to memory of 3864 4468 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe explortu.exe PID 4468 wrote to memory of 3864 4468 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe explortu.exe PID 4468 wrote to memory of 3864 4468 86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe explortu.exe PID 3864 wrote to memory of 2888 3864 explortu.exe explortu.exe PID 3864 wrote to memory of 2888 3864 explortu.exe explortu.exe PID 3864 wrote to memory of 2888 3864 explortu.exe explortu.exe PID 3864 wrote to memory of 1916 3864 explortu.exe e735db492c.exe PID 3864 wrote to memory of 1916 3864 explortu.exe e735db492c.exe PID 3864 wrote to memory of 1916 3864 explortu.exe e735db492c.exe PID 1916 wrote to memory of 868 1916 e735db492c.exe axplont.exe PID 1916 wrote to memory of 868 1916 e735db492c.exe axplont.exe PID 1916 wrote to memory of 868 1916 e735db492c.exe axplont.exe PID 3864 wrote to memory of 1920 3864 explortu.exe ca6606d453.exe PID 3864 wrote to memory of 1920 3864 explortu.exe ca6606d453.exe PID 3864 wrote to memory of 1920 3864 explortu.exe ca6606d453.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe"C:\Users\Admin\AppData\Local\Temp\86113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\e735db492c.exe"C:\Users\Admin\1000004002\e735db492c.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\ca6606d453.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\ca6606d453.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\e735db492c.exeFilesize
1.8MB
MD50bec09b1c1da813d14043c3b7346028a
SHA15e98889bd5370990fe88a36a782befec6f08cd94
SHA2563edef83d8d85e81a67c3d581f3617874cbc133002618b9483e3e10da97ca9edd
SHA512b83adf55b90b8102681578c11e2ae23e95c359205781aeb94380bb3477010dde39c0552c59c8c9a2b4e30181274e5548e63c08251c00557c2d26c54c25105517
-
C:\Users\Admin\AppData\Local\Temp\1000005001\ca6606d453.exeFilesize
2.3MB
MD54b33b5ab5512fdc6af1e6cd034ec6c49
SHA175336131e759e6406df0eb041f3db55f771172de
SHA25686b69c0940863c4432bf62be9ef8be173e09b374ce3297abd145a8159ccdea5a
SHA5121fae97add24531f83c5a9fdc99fca17f9f18915ac71067aa18ec27f5658bf6ae29dc8bc01437cbfe0693ae6fceecb08f290f13ceb51b719212df385e64caf543
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD583a4172891b308c57bb11745b77c6413
SHA182acdcdae8d9ed1bab00ec3e865541ebe9e1df69
SHA25686113573183316c6651feb5d3739a6dbe3d4a248b26777501f33c813ddd2a397
SHA512ec65de3d32edd8ea06a51d8b9630b84d03ba1a70545f432222759524a67b848d2f1d572059676d4e6a5132350eaf43123092b085b9bfca5363d3affe59ee7839
-
memory/416-105-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/416-107-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/868-124-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-114-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-99-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-121-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-94-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-109-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-133-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-96-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-85-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-53-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-86-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-90-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-117-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-82-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/868-111-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/1084-75-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/1084-79-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/1916-52-0x0000000000AE0000-0x0000000000F9B000-memory.dmpFilesize
4.7MB
-
memory/1916-39-0x0000000000AE0000-0x0000000000F9B000-memory.dmpFilesize
4.7MB
-
memory/1920-89-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-119-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-112-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-134-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-97-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-116-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-101-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-88-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-72-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-83-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-92-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-110-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-95-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-122-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/1920-125-0x00000000005D0000-0x0000000000BA1000-memory.dmpFilesize
5.8MB
-
memory/2324-78-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/2324-80-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/2896-127-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/2896-130-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/3864-73-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-118-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-100-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-132-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-98-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-108-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-93-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-91-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-87-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-84-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-113-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-81-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-115-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-77-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-18-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-123-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-21-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-120-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-20-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/3864-19-0x0000000000101000-0x000000000012F000-memory.dmpFilesize
184KB
-
memory/4064-129-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/4064-131-0x0000000000100000-0x00000000005BD000-memory.dmpFilesize
4.7MB
-
memory/4356-103-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/4356-106-0x00000000004D0000-0x000000000098B000-memory.dmpFilesize
4.7MB
-
memory/4468-17-0x0000000000750000-0x0000000000C0D000-memory.dmpFilesize
4.7MB
-
memory/4468-0-0x0000000000750000-0x0000000000C0D000-memory.dmpFilesize
4.7MB
-
memory/4468-5-0x0000000000750000-0x0000000000C0D000-memory.dmpFilesize
4.7MB
-
memory/4468-3-0x0000000000750000-0x0000000000C0D000-memory.dmpFilesize
4.7MB
-
memory/4468-2-0x0000000000751000-0x000000000077F000-memory.dmpFilesize
184KB
-
memory/4468-1-0x0000000076ED6000-0x0000000076ED8000-memory.dmpFilesize
8KB