Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 07:40
Static task
static1
Behavioral task
behavioral1
Sample
2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe
Resource
win10v2004-20240508-en
General
-
Target
2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe
-
Size
1.8MB
-
MD5
0600379e0b43eca022435a1b6d2e9391
-
SHA1
2dc38dd0d363b958f5fc959dca2b0a5cca79dbb5
-
SHA256
2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4
-
SHA512
2d9de6bace93d53cfbe3b79ac4312c829fc32f17dc9bc5a9f17d560e8848b607b5d5a7c2f446a576b2a7189105e42d469e85dd6a6672d436c82e3edd372a9545
-
SSDEEP
49152:xWe+x52aAyz4uU++JkTGd+GSRwvwh1RLm:xV+SjuU++JWGoGxw3RLm
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
Processes:
axplont.exeaxplont.exeexplortu.exe36d3fb4ee7.exe6fecaa723a.exeaxplont.exeexplortu.exeexplortu.exeexplortu.exe2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exeaxplont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 36d3fb4ee7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6fecaa723a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6fecaa723a.exeaxplont.exeaxplont.exeaxplont.exeexplortu.exe2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exeexplortu.exe36d3fb4ee7.exeexplortu.exeaxplont.exeexplortu.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6fecaa723a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 36d3fb4ee7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 36d3fb4ee7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6fecaa723a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exeexplortu.exe36d3fb4ee7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation explortu.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 36d3fb4ee7.exe -
Executes dropped EXE 10 IoCs
Processes:
explortu.exe36d3fb4ee7.exeaxplont.exe6fecaa723a.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exepid process 60 explortu.exe 3312 36d3fb4ee7.exe 3496 axplont.exe 392 6fecaa723a.exe 4732 explortu.exe 4552 axplont.exe 4544 axplont.exe 1480 explortu.exe 1436 explortu.exe 848 axplont.exe -
Identifies Wine through registry keys 2 TTPs 10 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
axplont.exe2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exeexplortu.exe36d3fb4ee7.exeaxplont.exeaxplont.exeaxplont.exeexplortu.exeexplortu.exeexplortu.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine 36d3fb4ee7.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explortu.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000005001\6fecaa723a.exe themida behavioral1/memory/392-72-0x0000000000AD0000-0x000000000112F000-memory.dmp themida behavioral1/memory/392-73-0x0000000000AD0000-0x000000000112F000-memory.dmp themida behavioral1/memory/392-75-0x0000000000AD0000-0x000000000112F000-memory.dmp themida behavioral1/memory/392-74-0x0000000000AD0000-0x000000000112F000-memory.dmp themida behavioral1/memory/392-76-0x0000000000AD0000-0x000000000112F000-memory.dmp themida behavioral1/memory/392-78-0x0000000000AD0000-0x000000000112F000-memory.dmp themida behavioral1/memory/392-79-0x0000000000AD0000-0x000000000112F000-memory.dmp themida behavioral1/memory/392-77-0x0000000000AD0000-0x000000000112F000-memory.dmp themida behavioral1/memory/392-89-0x0000000000AD0000-0x000000000112F000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6fecaa723a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\6fecaa723a.exe" explortu.exe -
Processes:
6fecaa723a.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6fecaa723a.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exeexplortu.exe36d3fb4ee7.exeaxplont.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exepid process 4540 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe 60 explortu.exe 3312 36d3fb4ee7.exe 3496 axplont.exe 4552 axplont.exe 4732 explortu.exe 1480 explortu.exe 4544 axplont.exe 1436 explortu.exe 848 axplont.exe -
Drops file in Windows directory 2 IoCs
Processes:
2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe36d3fb4ee7.exedescription ioc process File created C:\Windows\Tasks\explortu.job 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe File created C:\Windows\Tasks\axplont.job 36d3fb4ee7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exeexplortu.exe36d3fb4ee7.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exepid process 4540 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe 4540 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe 60 explortu.exe 60 explortu.exe 3312 36d3fb4ee7.exe 3312 36d3fb4ee7.exe 3496 axplont.exe 3496 axplont.exe 4552 axplont.exe 4552 axplont.exe 4732 explortu.exe 4732 explortu.exe 4544 axplont.exe 4544 axplont.exe 1480 explortu.exe 1480 explortu.exe 1436 explortu.exe 1436 explortu.exe 848 axplont.exe 848 axplont.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
36d3fb4ee7.exepid process 3312 36d3fb4ee7.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exeexplortu.exe36d3fb4ee7.exedescription pid process target process PID 4540 wrote to memory of 60 4540 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe explortu.exe PID 4540 wrote to memory of 60 4540 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe explortu.exe PID 4540 wrote to memory of 60 4540 2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe explortu.exe PID 60 wrote to memory of 5000 60 explortu.exe explortu.exe PID 60 wrote to memory of 5000 60 explortu.exe explortu.exe PID 60 wrote to memory of 5000 60 explortu.exe explortu.exe PID 60 wrote to memory of 3312 60 explortu.exe 36d3fb4ee7.exe PID 60 wrote to memory of 3312 60 explortu.exe 36d3fb4ee7.exe PID 60 wrote to memory of 3312 60 explortu.exe 36d3fb4ee7.exe PID 3312 wrote to memory of 3496 3312 36d3fb4ee7.exe axplont.exe PID 3312 wrote to memory of 3496 3312 36d3fb4ee7.exe axplont.exe PID 3312 wrote to memory of 3496 3312 36d3fb4ee7.exe axplont.exe PID 60 wrote to memory of 392 60 explortu.exe 6fecaa723a.exe PID 60 wrote to memory of 392 60 explortu.exe 6fecaa723a.exe PID 60 wrote to memory of 392 60 explortu.exe 6fecaa723a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe"C:\Users\Admin\AppData\Local\Temp\2a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\36d3fb4ee7.exe"C:\Users\Admin\1000004002\36d3fb4ee7.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\6fecaa723a.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\6fecaa723a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\36d3fb4ee7.exeFilesize
1.8MB
MD5fe4e61e13c0b9d8f179b18608530cc21
SHA1fae41b564cca41ad4140584622fe23627944c24d
SHA25635cadd2f3c589e6bc0dd06b1bb5ae9d62fa5d108142aa81006dae50b7945e25f
SHA51268f8ba9f8e627099e6c2b4fbe0ba3edee11a240a5c999cb7f17431354ade072dc32e9581c65d56a33f44fd790e5336d70107e42fc284d7f51315cad71f2b01ff
-
C:\Users\Admin\AppData\Local\Temp\1000005001\6fecaa723a.exeFilesize
2.0MB
MD5cea34b445e6306e6863c10100cc93948
SHA1d64b6074cc20de96c2afc6f5071510ec55023a0f
SHA2561dedd8a775a1fcaf26d8c1e1e4f2a6cba45809e2b5e36fbb0056f572ee04b286
SHA5122a9cde8739c22afef43516c2a67e9c95646f813aaa36ffcca2548fa69baeacc0504e7659e0d20ef434413607061c4700680010bb1933ca2e4c3d7bb0bb40b594
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD50600379e0b43eca022435a1b6d2e9391
SHA12dc38dd0d363b958f5fc959dca2b0a5cca79dbb5
SHA2562a297763a18a51c9d48e3deb80cffdafaa73f36f440b0d72f87d0eab364d2ec4
SHA5122d9de6bace93d53cfbe3b79ac4312c829fc32f17dc9bc5a9f17d560e8848b607b5d5a7c2f446a576b2a7189105e42d469e85dd6a6672d436c82e3edd372a9545
-
memory/60-118-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-133-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-101-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-91-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-18-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-90-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-19-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-21-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-107-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-80-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-130-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-143-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-127-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-124-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-104-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-92-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-95-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-98-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-20-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/60-121-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/392-73-0x0000000000AD0000-0x000000000112F000-memory.dmpFilesize
6.4MB
-
memory/392-77-0x0000000000AD0000-0x000000000112F000-memory.dmpFilesize
6.4MB
-
memory/392-79-0x0000000000AD0000-0x000000000112F000-memory.dmpFilesize
6.4MB
-
memory/392-78-0x0000000000AD0000-0x000000000112F000-memory.dmpFilesize
6.4MB
-
memory/392-75-0x0000000000AD0000-0x000000000112F000-memory.dmpFilesize
6.4MB
-
memory/392-72-0x0000000000AD0000-0x000000000112F000-memory.dmpFilesize
6.4MB
-
memory/392-89-0x0000000000AD0000-0x000000000112F000-memory.dmpFilesize
6.4MB
-
memory/392-76-0x0000000000AD0000-0x000000000112F000-memory.dmpFilesize
6.4MB
-
memory/392-74-0x0000000000AD0000-0x000000000112F000-memory.dmpFilesize
6.4MB
-
memory/848-137-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/848-140-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/1436-136-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/1436-139-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/1480-111-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/1480-114-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/3312-68-0x0000000000E00000-0x00000000012CC000-memory.dmpFilesize
4.8MB
-
memory/3312-40-0x0000000000E00000-0x00000000012CC000-memory.dmpFilesize
4.8MB
-
memory/3312-39-0x0000000000E00000-0x00000000012CC000-memory.dmpFilesize
4.8MB
-
memory/3496-122-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-96-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-69-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-125-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-99-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-141-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-93-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-131-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-116-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-102-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-119-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-128-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-88-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/3496-105-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/4540-1-0x0000000077CF4000-0x0000000077CF6000-memory.dmpFilesize
8KB
-
memory/4540-0-0x0000000000FE0000-0x000000000148C000-memory.dmpFilesize
4.7MB
-
memory/4540-17-0x0000000000FE0000-0x000000000148C000-memory.dmpFilesize
4.7MB
-
memory/4540-5-0x0000000000FE0000-0x000000000148C000-memory.dmpFilesize
4.7MB
-
memory/4540-3-0x0000000000FE0000-0x000000000148C000-memory.dmpFilesize
4.7MB
-
memory/4540-2-0x0000000000FE1000-0x000000000100F000-memory.dmpFilesize
184KB
-
memory/4544-115-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/4544-110-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/4552-84-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/4552-86-0x0000000000890000-0x0000000000D5C000-memory.dmpFilesize
4.8MB
-
memory/4732-83-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB
-
memory/4732-87-0x0000000000F90000-0x000000000143C000-memory.dmpFilesize
4.7MB