Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 10:32
Static task
static1
Behavioral task
behavioral1
Sample
df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe
Resource
win10v2004-20240426-en
General
-
Target
df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe
-
Size
1.8MB
-
MD5
c0ce18e1cda613d12a562cfea0d94538
-
SHA1
663989e7b97a7af155817db8a62684047ae0faf7
-
SHA256
df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342
-
SHA512
ac19e6da78bfa208e206d24236bbcff565684aa4d7d39b4fd1a6fb2e8c303428856c2305a06f095a8550b8fcf35dc1d1aa499893e1d722102b9fb18d7351b3cd
-
SSDEEP
49152:CJfOtMRLFipgL5iJWK4cgBuYfke8IlAGF:mLG45igHBh8eA
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
Processes:
axplont.exedf4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe35fdda840d.exe07ddde0474.exeexplortu.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 35fdda840d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 07ddde0474.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplont.exeexplortu.exeexplortu.exe07ddde0474.exeexplortu.exeaxplont.exeexplortu.exe35fdda840d.exeaxplont.exedf4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exeaxplont.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 07ddde0474.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 35fdda840d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 07ddde0474.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 35fdda840d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exeexplortu.exe35fdda840d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation explortu.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 35fdda840d.exe -
Executes dropped EXE 10 IoCs
Processes:
explortu.exe35fdda840d.exeaxplont.exe07ddde0474.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exepid process 1948 explortu.exe 4616 35fdda840d.exe 1364 axplont.exe 4944 07ddde0474.exe 2648 explortu.exe 4484 axplont.exe 4808 axplont.exe 3832 explortu.exe 2308 axplont.exe 2732 explortu.exe -
Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exeexplortu.exe35fdda840d.exe07ddde0474.exeexplortu.exeexplortu.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeaxplont.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine 35fdda840d.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine 07ddde0474.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine axplont.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\07ddde0474.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\07ddde0474.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
Processes:
df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exeexplortu.exe35fdda840d.exeaxplont.exe07ddde0474.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exepid process 2036 df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe 1948 explortu.exe 4616 35fdda840d.exe 1364 axplont.exe 4944 07ddde0474.exe 2648 explortu.exe 4484 axplont.exe 3832 explortu.exe 4808 axplont.exe 2732 explortu.exe 2308 axplont.exe -
Drops file in Windows directory 2 IoCs
Processes:
df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe35fdda840d.exedescription ioc process File created C:\Windows\Tasks\explortu.job df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe File created C:\Windows\Tasks\axplont.job 35fdda840d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exeexplortu.exe35fdda840d.exeaxplont.exe07ddde0474.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exepid process 2036 df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe 2036 df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe 1948 explortu.exe 1948 explortu.exe 4616 35fdda840d.exe 4616 35fdda840d.exe 1364 axplont.exe 1364 axplont.exe 4944 07ddde0474.exe 4944 07ddde0474.exe 2648 explortu.exe 2648 explortu.exe 4484 axplont.exe 4484 axplont.exe 3832 explortu.exe 3832 explortu.exe 4808 axplont.exe 4808 axplont.exe 2732 explortu.exe 2732 explortu.exe 2308 axplont.exe 2308 axplont.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exeexplortu.exe35fdda840d.exedescription pid process target process PID 2036 wrote to memory of 1948 2036 df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe explortu.exe PID 2036 wrote to memory of 1948 2036 df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe explortu.exe PID 2036 wrote to memory of 1948 2036 df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe explortu.exe PID 1948 wrote to memory of 2128 1948 explortu.exe explortu.exe PID 1948 wrote to memory of 2128 1948 explortu.exe explortu.exe PID 1948 wrote to memory of 2128 1948 explortu.exe explortu.exe PID 1948 wrote to memory of 4616 1948 explortu.exe 35fdda840d.exe PID 1948 wrote to memory of 4616 1948 explortu.exe 35fdda840d.exe PID 1948 wrote to memory of 4616 1948 explortu.exe 35fdda840d.exe PID 4616 wrote to memory of 1364 4616 35fdda840d.exe axplont.exe PID 4616 wrote to memory of 1364 4616 35fdda840d.exe axplont.exe PID 4616 wrote to memory of 1364 4616 35fdda840d.exe axplont.exe PID 1948 wrote to memory of 4944 1948 explortu.exe 07ddde0474.exe PID 1948 wrote to memory of 4944 1948 explortu.exe 07ddde0474.exe PID 1948 wrote to memory of 4944 1948 explortu.exe 07ddde0474.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe"C:\Users\Admin\AppData\Local\Temp\df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵PID:2128
-
C:\Users\Admin\1000004002\35fdda840d.exe"C:\Users\Admin\1000004002\35fdda840d.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1000005001\07ddde0474.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\07ddde0474.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2648
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4808
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3832
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\35fdda840d.exeFilesize
1.8MB
MD5a26f7b43f9d61a8eca7f1b9f01376a69
SHA1d55e6881cdd1370860fc01a7433632adc5c8f581
SHA256d7ecc9eea38705440a52b71befc4dd623430cecc3a57007a0700d86fccf9e395
SHA512f22ea8e0eb38829e7dafbc7e3c197ae3c93ca593584976918bca27ad4668acf90a3dafac773626e97a89eb257c07e4365da7cc65e9d13d4a7cb006c88a5d55cc
-
C:\Users\Admin\AppData\Local\Temp\1000005001\07ddde0474.exeFilesize
2.4MB
MD53f61d8867c726bd34057d470a2902463
SHA100bb68a770d48f4b48b96c60c7508e95eb6240ce
SHA256c5e09b4799672c53f35701084ef554f8f4cccb84b4a900108d6517d5db42ed93
SHA512f6cbb139ae50f32d77efe1551008c69ac07984ea3a86d76a558b614960343c6478f75a7b97e12d01eb10c5ea5e9fb5607fa06f8cf9d77f6ba956e69261936c83
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD5c0ce18e1cda613d12a562cfea0d94538
SHA1663989e7b97a7af155817db8a62684047ae0faf7
SHA256df4c1fe2134e385e551577c9f92f8096b9fc84cbe21e19ea8838414661f9a342
SHA512ac19e6da78bfa208e206d24236bbcff565684aa4d7d39b4fd1a6fb2e8c303428856c2305a06f095a8550b8fcf35dc1d1aa499893e1d722102b9fb18d7351b3cd
-
memory/1364-112-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-100-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-124-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-118-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-115-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-75-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-103-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-121-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-127-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-97-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-94-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-91-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-54-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-136-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-87-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1364-86-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/1948-93-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-120-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-129-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-78-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-79-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-126-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-123-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-77-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-18-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-74-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-117-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-114-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-19-0x0000000000E81000-0x0000000000EAF000-memory.dmpFilesize
184KB
-
memory/1948-90-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-105-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-20-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-102-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-21-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-99-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/1948-96-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/2036-3-0x0000000000B00000-0x0000000000F9D000-memory.dmpFilesize
4.6MB
-
memory/2036-1-0x0000000077C04000-0x0000000077C06000-memory.dmpFilesize
8KB
-
memory/2036-5-0x0000000000B00000-0x0000000000F9D000-memory.dmpFilesize
4.6MB
-
memory/2036-0-0x0000000000B00000-0x0000000000F9D000-memory.dmpFilesize
4.6MB
-
memory/2036-17-0x0000000000B00000-0x0000000000F9D000-memory.dmpFilesize
4.6MB
-
memory/2036-2-0x0000000000B01000-0x0000000000B2F000-memory.dmpFilesize
184KB
-
memory/2308-135-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/2308-132-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/2648-84-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/2648-82-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/2732-134-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/2732-133-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/3832-110-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/3832-109-0x0000000000E80000-0x000000000131D000-memory.dmpFilesize
4.6MB
-
memory/4484-83-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/4484-85-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/4616-39-0x0000000000AA0000-0x0000000000F5B000-memory.dmpFilesize
4.7MB
-
memory/4616-53-0x0000000000AA0000-0x0000000000F5B000-memory.dmpFilesize
4.7MB
-
memory/4616-40-0x0000000000AA0000-0x0000000000F5B000-memory.dmpFilesize
4.7MB
-
memory/4808-108-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/4808-111-0x0000000000AB0000-0x0000000000F6B000-memory.dmpFilesize
4.7MB
-
memory/4944-89-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-128-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-122-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-119-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-113-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-125-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-116-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-73-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-88-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-76-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-104-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-92-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-101-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-95-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB
-
memory/4944-98-0x0000000000E30000-0x0000000001441000-memory.dmpFilesize
6.1MB