Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-05-2024 12:45
Static task
static1
Behavioral task
behavioral1
Sample
cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe
Resource
win10v2004-20240226-en
General
-
Target
cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe
-
Size
1.8MB
-
MD5
094b73661371248a9f6dce45d34c12cb
-
SHA1
2b25339b8454f9e7e1241603a54fca0997799d4e
-
SHA256
cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d
-
SHA512
5f0c24d8fc7e19c8c21eeaaf945b827390f3bc170dc1b691a12cec7679982d0987f5b83f047f00564e41791417151e2809306b8ee7cb28e90990e38d7c55f507
-
SSDEEP
49152:jQfec74YUgeof1P2WjSH7VCn/BT52MaiPB2sN1vcxz:yzrUgem1PzuZCPzPBl1vc
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
Processes:
explortu.exeexplortu.exeexplortu.exe6add99a857.exeaxplont.exebe2f687d35.exeaxplont.exeexplortu.exeaxplont.execbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6add99a857.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ be2f687d35.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explortu.exeexplortu.exe6add99a857.exeaxplont.exeaxplont.exeexplortu.exeaxplont.exeexplortu.execbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exebe2f687d35.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6add99a857.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6add99a857.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion be2f687d35.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion be2f687d35.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe -
Executes dropped EXE 9 IoCs
Processes:
explortu.exeexplortu.exe6add99a857.exeaxplont.exebe2f687d35.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exepid process 3440 explortu.exe 3808 explortu.exe 4116 6add99a857.exe 1180 axplont.exe 400 be2f687d35.exe 1204 axplont.exe 4040 explortu.exe 708 explortu.exe 1788 axplont.exe -
Identifies Wine through registry keys 2 TTPs 10 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exeexplortu.exeexplortu.exeexplortu.exe6add99a857.exeaxplont.exebe2f687d35.exeaxplont.exeexplortu.exeaxplont.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine 6add99a857.exe Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine be2f687d35.exe Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Wine axplont.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explortu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\be2f687d35.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\be2f687d35.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exeexplortu.exeexplortu.exe6add99a857.exeaxplont.exebe2f687d35.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exepid process 3364 cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe 3440 explortu.exe 3808 explortu.exe 4116 6add99a857.exe 1180 axplont.exe 400 be2f687d35.exe 1204 axplont.exe 4040 explortu.exe 708 explortu.exe 1788 axplont.exe -
Drops file in Windows directory 2 IoCs
Processes:
cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe6add99a857.exedescription ioc process File created C:\Windows\Tasks\explortu.job cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe File created C:\Windows\Tasks\axplont.job 6add99a857.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exeexplortu.exeexplortu.exe6add99a857.exeaxplont.exebe2f687d35.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exepid process 3364 cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe 3364 cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe 3440 explortu.exe 3440 explortu.exe 3808 explortu.exe 3808 explortu.exe 4116 6add99a857.exe 4116 6add99a857.exe 1180 axplont.exe 1180 axplont.exe 400 be2f687d35.exe 400 be2f687d35.exe 1204 axplont.exe 1204 axplont.exe 4040 explortu.exe 4040 explortu.exe 708 explortu.exe 708 explortu.exe 1788 axplont.exe 1788 axplont.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exeexplortu.exe6add99a857.exedescription pid process target process PID 3364 wrote to memory of 3440 3364 cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe explortu.exe PID 3364 wrote to memory of 3440 3364 cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe explortu.exe PID 3364 wrote to memory of 3440 3364 cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe explortu.exe PID 3440 wrote to memory of 1648 3440 explortu.exe explortu.exe PID 3440 wrote to memory of 1648 3440 explortu.exe explortu.exe PID 3440 wrote to memory of 1648 3440 explortu.exe explortu.exe PID 3440 wrote to memory of 4116 3440 explortu.exe 6add99a857.exe PID 3440 wrote to memory of 4116 3440 explortu.exe 6add99a857.exe PID 3440 wrote to memory of 4116 3440 explortu.exe 6add99a857.exe PID 4116 wrote to memory of 1180 4116 6add99a857.exe axplont.exe PID 4116 wrote to memory of 1180 4116 6add99a857.exe axplont.exe PID 4116 wrote to memory of 1180 4116 6add99a857.exe axplont.exe PID 3440 wrote to memory of 400 3440 explortu.exe be2f687d35.exe PID 3440 wrote to memory of 400 3440 explortu.exe be2f687d35.exe PID 3440 wrote to memory of 400 3440 explortu.exe be2f687d35.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe"C:\Users\Admin\AppData\Local\Temp\cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
C:\Users\Admin\1000004002\6add99a857.exe"C:\Users\Admin\1000004002\6add99a857.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000005001\be2f687d35.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\be2f687d35.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000004002\6add99a857.exeFilesize
1.8MB
MD5c165996ca2a03c5c04a1af3415011f3f
SHA1ed0d3c849cc0319fa5e595464988b1791f98ed73
SHA2562fba8eea1a026e381ab112213f6fe09173ea37b39e9e65bdbf2b5d995dfbfa8c
SHA5120035a59dec68f398edd338d819b79dea1ca5acf6d7658ac2b40b1340324d82c49cc88c75c88d81fa1352937ea4fded1277c741cf09abf70020190af92fc88a08
-
C:\Users\Admin\AppData\Local\Temp\1000005001\be2f687d35.exeFilesize
2.3MB
MD57154f7f38c806cfdcf8a593a1a9d29da
SHA17594597c61090519126c598b29dc3d3c0886c3a9
SHA2563361fe4b6f365b1df2b53472e005ab365ad94be87888f659bdfda3af24dcdf12
SHA512b5acca76aa38024e54a8f78922c160d3c43e53924c26aab81a2627260104ccfedbaf301fcee385d59a15a1bfd3d05b3ac0d3016d8d8b178b23f34e8f2304c6e8
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeFilesize
1.8MB
MD5094b73661371248a9f6dce45d34c12cb
SHA12b25339b8454f9e7e1241603a54fca0997799d4e
SHA256cbe69a8e56727a9b84d25c1850b47bc1b3de1242976456e767a650e1513df83d
SHA5125f0c24d8fc7e19c8c21eeaaf945b827390f3bc170dc1b691a12cec7679982d0987f5b83f047f00564e41791417151e2809306b8ee7cb28e90990e38d7c55f507
-
memory/400-97-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-109-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-78-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-121-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-118-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-115-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-112-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-83-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-106-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-131-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-93-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-134-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-90-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/400-86-0x0000000000380000-0x0000000000967000-memory.dmpFilesize
5.9MB
-
memory/708-124-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/708-128-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/1180-95-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-114-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-108-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-133-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-81-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-117-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-130-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-105-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-85-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-87-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-111-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-92-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-89-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-120-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1180-59-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1204-99-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1204-103-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1788-129-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/1788-126-0x0000000000CA0000-0x0000000001167000-memory.dmpFilesize
4.8MB
-
memory/3364-0-0x0000000000E20000-0x00000000012E3000-memory.dmpFilesize
4.8MB
-
memory/3364-17-0x0000000000E20000-0x00000000012E3000-memory.dmpFilesize
4.8MB
-
memory/3364-5-0x0000000000E20000-0x00000000012E3000-memory.dmpFilesize
4.8MB
-
memory/3364-3-0x0000000000E20000-0x00000000012E3000-memory.dmpFilesize
4.8MB
-
memory/3364-2-0x0000000000E21000-0x0000000000E4F000-memory.dmpFilesize
184KB
-
memory/3364-1-0x0000000077D36000-0x0000000077D38000-memory.dmpFilesize
8KB
-
memory/3440-91-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-18-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-107-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-135-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-21-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-110-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-79-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-20-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-113-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-80-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-19-0x0000000000471000-0x000000000049F000-memory.dmpFilesize
184KB
-
memory/3440-116-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-96-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-22-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-119-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-94-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-132-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-122-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-82-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-88-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3440-84-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3808-39-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3808-27-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/3808-26-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/4040-101-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/4040-104-0x0000000000470000-0x0000000000933000-memory.dmpFilesize
4.8MB
-
memory/4116-45-0x0000000000D80000-0x0000000001247000-memory.dmpFilesize
4.8MB
-
memory/4116-58-0x0000000000D80000-0x0000000001247000-memory.dmpFilesize
4.8MB