Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-05-2024 01:41
Static task
static1
Behavioral task
behavioral1
Sample
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe
Resource
win10v2004-20240426-en
General
-
Target
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe
-
Size
1.8MB
-
MD5
f95938fcc8b1f0a823606f05455cfb01
-
SHA1
988529fdcabe71e26adef2bff1266486b26b3bb0
-
SHA256
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e
-
SHA512
26db0ac9d52cdb296e1a8bee835f2a800ea9aa9bbc421f5d627b1a687bb447881b50697d23851d3144f3955cef73aba940cb1ad06944636402e431719634924a
-
SSDEEP
49152:9DReee9U+XGcQdA3T86/a4sBm3W3/lL4D:91eh9PGcqkMBha
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
Processes:
axplont.exeexplortu.exeexplortu.exeaxplont.exef566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeexplortu.exe868150de05.exeexplortu.exeaxplont.exec1c675e190.exeaxplont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 868150de05.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c1c675e190.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplont.exeexplortu.exeexplortu.exeexplortu.exeexplortu.exe868150de05.exec1c675e190.exeaxplont.exeaxplont.exeaxplont.exef566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 868150de05.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c1c675e190.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c1c675e190.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 868150de05.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe -
Executes dropped EXE 10 IoCs
Processes:
explortu.exe868150de05.exeaxplont.exec1c675e190.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 2172 explortu.exe 3320 868150de05.exe 2640 axplont.exe 3408 c1c675e190.exe 764 axplont.exe 1972 explortu.exe 3740 axplont.exe 2800 explortu.exe 1944 axplont.exe 3704 explortu.exe -
Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
axplont.exeexplortu.exeexplortu.exe868150de05.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exef566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeaxplont.exec1c675e190.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine 868150de05.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Wine c1c675e190.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\c1c675e190.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\c1c675e190.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeexplortu.exe868150de05.exeaxplont.exec1c675e190.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 1788 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe 2172 explortu.exe 3320 868150de05.exe 2640 axplont.exe 3408 c1c675e190.exe 764 axplont.exe 1972 explortu.exe 3740 axplont.exe 2800 explortu.exe 1944 axplont.exe 3704 explortu.exe -
Drops file in Windows directory 2 IoCs
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe868150de05.exedescription ioc process File created C:\Windows\Tasks\explortu.job f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe File created C:\Windows\Tasks\axplont.job 868150de05.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeexplortu.exe868150de05.exeaxplont.exec1c675e190.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 1788 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe 1788 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe 2172 explortu.exe 2172 explortu.exe 3320 868150de05.exe 3320 868150de05.exe 2640 axplont.exe 2640 axplont.exe 3408 c1c675e190.exe 3408 c1c675e190.exe 764 axplont.exe 764 axplont.exe 1972 explortu.exe 1972 explortu.exe 3740 axplont.exe 3740 axplont.exe 2800 explortu.exe 2800 explortu.exe 1944 axplont.exe 1944 axplont.exe 3704 explortu.exe 3704 explortu.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
868150de05.exepid process 3320 868150de05.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exeexplortu.exe868150de05.exedescription pid process target process PID 1788 wrote to memory of 2172 1788 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe explortu.exe PID 1788 wrote to memory of 2172 1788 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe explortu.exe PID 1788 wrote to memory of 2172 1788 f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe explortu.exe PID 2172 wrote to memory of 4436 2172 explortu.exe explortu.exe PID 2172 wrote to memory of 4436 2172 explortu.exe explortu.exe PID 2172 wrote to memory of 4436 2172 explortu.exe explortu.exe PID 2172 wrote to memory of 3320 2172 explortu.exe 868150de05.exe PID 2172 wrote to memory of 3320 2172 explortu.exe 868150de05.exe PID 2172 wrote to memory of 3320 2172 explortu.exe 868150de05.exe PID 3320 wrote to memory of 2640 3320 868150de05.exe axplont.exe PID 3320 wrote to memory of 2640 3320 868150de05.exe axplont.exe PID 3320 wrote to memory of 2640 3320 868150de05.exe axplont.exe PID 2172 wrote to memory of 3408 2172 explortu.exe c1c675e190.exe PID 2172 wrote to memory of 3408 2172 explortu.exe c1c675e190.exe PID 2172 wrote to memory of 3408 2172 explortu.exe c1c675e190.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe"C:\Users\Admin\AppData\Local\Temp\f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\868150de05.exe"C:\Users\Admin\1000004002\868150de05.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\c1c675e190.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\c1c675e190.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\868150de05.exeFilesize
1.8MB
MD55d6d56228a521ee752a238ea18074f56
SHA126140280dbe2f52eb65e3b91b88e6060f5c1275f
SHA256bf2d25a995a7bdc2f458bd3347a4f128b4c99285283b8434663f7a1f47d93703
SHA512396293c2281b3d757b3071fe5f708c057b2026c90a0012a9418f4e4ab548f5d753e7a42af3944d00820056500b61b73f5b25fa2f51ad75db1ad4f098cd71dfc0
-
C:\Users\Admin\AppData\Local\Temp\1000005001\c1c675e190.exeFilesize
2.3MB
MD51d7070198b11f8f874cb131e8661f744
SHA158d190cd05534276f3e8798ea4ff48c4f99a71d3
SHA2569721a3aec263d78d2ba7d6739818dca2dea59cb63797a37abbbba6d210857aa5
SHA5127e45e0a0fcfdfc30d690af35f0db65074153b85cb938590e9aff230239900c2ad9caf47dd7c42e0208163e46d75ba067d194a59c93b571381cebe373d30af537
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD5f95938fcc8b1f0a823606f05455cfb01
SHA1988529fdcabe71e26adef2bff1266486b26b3bb0
SHA256f566164f185e276c6d12dbe5ddceb9c538f3ac0e565415affc432328303d2d5e
SHA51226db0ac9d52cdb296e1a8bee835f2a800ea9aa9bbc421f5d627b1a687bb447881b50697d23851d3144f3955cef73aba940cb1ad06944636402e431719634924a
-
memory/764-75-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/764-78-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/1788-3-0x00000000004A0000-0x0000000000956000-memory.dmpFilesize
4.7MB
-
memory/1788-15-0x00000000004A0000-0x0000000000956000-memory.dmpFilesize
4.7MB
-
memory/1788-0-0x00000000004A0000-0x0000000000956000-memory.dmpFilesize
4.7MB
-
memory/1788-5-0x00000000004A0000-0x0000000000956000-memory.dmpFilesize
4.7MB
-
memory/1788-2-0x00000000004A1000-0x00000000004CF000-memory.dmpFilesize
184KB
-
memory/1788-1-0x0000000077B76000-0x0000000077B78000-memory.dmpFilesize
8KB
-
memory/1944-130-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/1944-127-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/1972-79-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/1972-77-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-19-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-82-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-135-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-74-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-21-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-20-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-18-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-80-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-121-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-126-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-83-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-118-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-116-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-113-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-87-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-110-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-102-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-98-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-91-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2172-94-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2640-93-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-123-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-133-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-96-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-53-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-90-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-99-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-81-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-120-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-117-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-85-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-114-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-86-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-108-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2640-111-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/2800-105-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/2800-107-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/3320-39-0x0000000000A60000-0x0000000000F12000-memory.dmpFilesize
4.7MB
-
memory/3320-52-0x0000000000A60000-0x0000000000F12000-memory.dmpFilesize
4.7MB
-
memory/3408-89-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-92-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-109-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-134-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-84-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-119-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-88-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-100-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-122-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-115-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-124-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-72-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-97-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-95-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3408-112-0x0000000000B60000-0x0000000001162000-memory.dmpFilesize
6.0MB
-
memory/3704-132-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/3704-129-0x00000000000B0000-0x0000000000566000-memory.dmpFilesize
4.7MB
-
memory/3740-103-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB
-
memory/3740-106-0x00000000007D0000-0x0000000000C82000-memory.dmpFilesize
4.7MB