Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-05-2024 17:44
Static task
static1
Behavioral task
behavioral1
Sample
49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe
Resource
win10v2004-20240426-en
General
-
Target
49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe
-
Size
1.8MB
-
MD5
d4a50634604254244138df11b9a442a3
-
SHA1
9801ba99e3944dc1e2192dc4454ac70daa1bcca0
-
SHA256
49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c
-
SHA512
461a604fa9a34175d0afdf931816cebfa4f652c3fc49f27eed67e6c9c52f92520eac8f159be211e4a4b999582f6e8f8b8b19db29b1653eea53af55c8dd8144fc
-
SSDEEP
49152:7JiiM1vPEdMnhyhTcLYXKo42YP9/zDUwf0mUKI:7JiiaPEanhyhTIorg9/3Uwf8
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
Processes:
49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exeexplortu.exe6a37620680.exeaxplont.exe38d09f8502.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6a37620680.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 38d09f8502.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exeexplortu.exe38d09f8502.exeaxplont.exeaxplont.exeaxplont.exeexplortu.exe6a37620680.exeexplortu.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 38d09f8502.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6a37620680.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 38d09f8502.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6a37620680.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe -
Executes dropped EXE 8 IoCs
Processes:
explortu.exe6a37620680.exeaxplont.exe38d09f8502.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exepid process 2900 explortu.exe 4228 6a37620680.exe 580 axplont.exe 940 38d09f8502.exe 3940 explortu.exe 2832 axplont.exe 1608 explortu.exe 1804 axplont.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explortu.exeaxplont.exe38d09f8502.exeexplortu.exeaxplont.exeexplortu.exe49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe6a37620680.exeaxplont.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine 38d09f8502.exe Key opened \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe Key opened \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine 6a37620680.exe Key opened \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine axplont.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\38d09f8502.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\38d09f8502.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exeexplortu.exe6a37620680.exeaxplont.exe38d09f8502.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exepid process 4864 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe 2900 explortu.exe 4228 6a37620680.exe 580 axplont.exe 940 38d09f8502.exe 2832 axplont.exe 3940 explortu.exe 1608 explortu.exe 1804 axplont.exe -
Drops file in Windows directory 2 IoCs
Processes:
49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe6a37620680.exedescription ioc process File created C:\Windows\Tasks\explortu.job 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe File created C:\Windows\Tasks\axplont.job 6a37620680.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exeexplortu.exe6a37620680.exeaxplont.exe38d09f8502.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exepid process 4864 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe 4864 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe 2900 explortu.exe 2900 explortu.exe 4228 6a37620680.exe 4228 6a37620680.exe 580 axplont.exe 580 axplont.exe 940 38d09f8502.exe 940 38d09f8502.exe 2832 axplont.exe 2832 axplont.exe 3940 explortu.exe 3940 explortu.exe 1608 explortu.exe 1608 explortu.exe 1804 axplont.exe 1804 axplont.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exeexplortu.exe6a37620680.exedescription pid process target process PID 4864 wrote to memory of 2900 4864 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe explortu.exe PID 4864 wrote to memory of 2900 4864 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe explortu.exe PID 4864 wrote to memory of 2900 4864 49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe explortu.exe PID 2900 wrote to memory of 4880 2900 explortu.exe explortu.exe PID 2900 wrote to memory of 4880 2900 explortu.exe explortu.exe PID 2900 wrote to memory of 4880 2900 explortu.exe explortu.exe PID 2900 wrote to memory of 4228 2900 explortu.exe 6a37620680.exe PID 2900 wrote to memory of 4228 2900 explortu.exe 6a37620680.exe PID 2900 wrote to memory of 4228 2900 explortu.exe 6a37620680.exe PID 4228 wrote to memory of 580 4228 6a37620680.exe axplont.exe PID 4228 wrote to memory of 580 4228 6a37620680.exe axplont.exe PID 4228 wrote to memory of 580 4228 6a37620680.exe axplont.exe PID 2900 wrote to memory of 940 2900 explortu.exe 38d09f8502.exe PID 2900 wrote to memory of 940 2900 explortu.exe 38d09f8502.exe PID 2900 wrote to memory of 940 2900 explortu.exe 38d09f8502.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe"C:\Users\Admin\AppData\Local\Temp\49019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\6a37620680.exe"C:\Users\Admin\1000004002\6a37620680.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\38d09f8502.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\38d09f8502.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\6a37620680.exeFilesize
1.8MB
MD57e3a4a83cc32016fe3d74fe9c804219f
SHA1f6937d56701bea77eaa1ce2353448ecd651e86ba
SHA256e0ec46141365654e248d0801bf356e9ebc792fca8121b66cc073a0f5aecd0c64
SHA512987a306ff2babf919c1905e1a456b76faf99e449ea2cfe7a330158f150e250fa6899ee6fd950744f0b5db2dfbcd422af2b0e79078f9016a9fced6f490256f782
-
C:\Users\Admin\AppData\Local\Temp\1000005001\38d09f8502.exeFilesize
2.3MB
MD5b4ad467351f371e9beaaaadd83fabc6f
SHA13e8a9cbe34963ce1c69e3336a44815e31ecc1889
SHA25661beb8251c5d0a2a4090b72d41c3449c486bfbe6729e0424bf9315f173308d8b
SHA512e8d5d5cc8224d0abbdea29f817895210fe8de3bbf0b196cbf9c3aee7772511d629e9fc382acf2163381ced9c5bdd41598e13006f3936193a0cdbbc0c9c595e47
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD5d4a50634604254244138df11b9a442a3
SHA19801ba99e3944dc1e2192dc4454ac70daa1bcca0
SHA25649019e3faa466c73411c9e2bac58d72897aa00dd0c6abdf066a4a20b0422636c
SHA512461a604fa9a34175d0afdf931816cebfa4f652c3fc49f27eed67e6c9c52f92520eac8f159be211e4a4b999582f6e8f8b8b19db29b1653eea53af55c8dd8144fc
-
memory/580-106-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-100-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-126-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-120-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-117-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-75-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-103-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-123-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-129-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-97-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-94-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-54-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-91-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-132-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/580-80-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/940-95-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-81-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-130-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-128-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-78-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-124-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-73-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-107-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-121-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-101-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-118-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-104-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-92-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/940-98-0x0000000000A90000-0x000000000108C000-memory.dmpFilesize
6.0MB
-
memory/1608-115-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/1608-111-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/1804-116-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/1804-112-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/2832-90-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/2832-86-0x00000000000A0000-0x0000000000561000-memory.dmpFilesize
4.8MB
-
memory/2900-119-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-18-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-21-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-131-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-102-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-20-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-96-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-105-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-19-0x0000000000881000-0x00000000008AF000-memory.dmpFilesize
184KB
-
memory/2900-76-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-108-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-77-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-93-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-127-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-125-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-99-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-79-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-74-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-122-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/2900-82-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/3940-85-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/3940-89-0x0000000000880000-0x0000000000D2A000-memory.dmpFilesize
4.7MB
-
memory/4228-53-0x0000000000420000-0x00000000008E1000-memory.dmpFilesize
4.8MB
-
memory/4228-40-0x0000000000420000-0x00000000008E1000-memory.dmpFilesize
4.8MB
-
memory/4228-39-0x0000000000420000-0x00000000008E1000-memory.dmpFilesize
4.8MB
-
memory/4864-17-0x0000000000F90000-0x000000000143A000-memory.dmpFilesize
4.7MB
-
memory/4864-4-0x0000000000F90000-0x000000000143A000-memory.dmpFilesize
4.7MB
-
memory/4864-3-0x0000000000F90000-0x000000000143A000-memory.dmpFilesize
4.7MB
-
memory/4864-2-0x0000000000F91000-0x0000000000FBF000-memory.dmpFilesize
184KB
-
memory/4864-0-0x0000000000F90000-0x000000000143A000-memory.dmpFilesize
4.7MB
-
memory/4864-1-0x00000000770E6000-0x00000000770E8000-memory.dmpFilesize
8KB