Resubmissions
29-01-2023 18:20
230129-wy2v4aab6s 10Analysis
-
max time kernel
1792s -
max time network
1556s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
14-04-2024 12:11
General
-
Target
629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe
-
Size
1.2MB
-
MD5
969305f9f01a46e8eee82885d9bde2bd
-
SHA1
a5cf52711faec6b7ec152ac074496a7a6e825765
-
SHA256
629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70
-
SHA512
a916a1ef2bc9c77e9cb3476def54747dcf9c6819c9dd436d8e7ec4f9c3046ce850db7727fc97f820aba070015e06975540f5cacbf6e7341a3ffb787560590ba2
-
SSDEEP
24576:U0Xy5spQBcumH3iA537SEHKa3RoMF/tM7duvJkdV4KL:U0iupecuYSAt2E53WMF/+duvJIV4S
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 12 IoCs
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies registry class 58 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 45 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe"C:\Users\Admin\AppData\Local\Temp\629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\System32\xfsFilesize
193KB
MD5b027a290ca8fd5e9196ab2dd5db46427
SHA141c88f5005317f65481e2f121344a9b0af733a03
SHA25619b7175670966f0ec95febf4e8b5c49b530ed9fd7631523d2dc4501781e6761e
SHA51230b7efa575da226c84917e38d0bad4a9640662a29e3fdc41adc6c999157fe1d7fbd816941b2751c1915f7d831bf52e182aeaac8eb1cb5d8508e974719badfdaf
-
C:\ProgramData\Windows\csrss.exeFilesize
1.2MB
MD5969305f9f01a46e8eee82885d9bde2bd
SHA1a5cf52711faec6b7ec152ac074496a7a6e825765
SHA256629491cb1f88530240f9260810ab2abe16b8152900bffae4068a6565a2ac7a70
SHA512a916a1ef2bc9c77e9cb3476def54747dcf9c6819c9dd436d8e7ec4f9c3046ce850db7727fc97f820aba070015e06975540f5cacbf6e7341a3ffb787560590ba2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.dbFilesize
1024KB
MD5904d4819f44c674b22f654c6fded86d2
SHA112ba00ebb35364790bd5081186d86f73f136d4bd
SHA256505bf118f44fc36780af6415be4b7bfe8c3aa0eb0c2865ab640eaf540fa667f0
SHA5121e242885e70aab51ea132aaec18127f547c0f377f4a72b02dbf100af3ed45b04161d1bb328927af09b89826201daf18fe47dbf18586bb72719e9bd0a85612b11
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.dbFilesize
1024KB
MD532de370bdfc009cf22aee891e117ccde
SHA17ca8fd83f27485e461640fb31fd1fcae8498fa1e
SHA2566250edbd1cd63d87502a17625d9d6d28517711c0a82e36c866d82c62b8f19e61
SHA512c01ddf12332436b779a56ce9c7f88649241e46f3d680f6d447df13fb9a00389c9c6a11dea488cf75ac3930584a0f09b81f31e1df47f093c5076145c98b687c99
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.dbFilesize
1024KB
MD5ed124122c16eac29dd4ade55e4fc018b
SHA19bf196fd5c9016f288204670ab467c7df1beb1a5
SHA256d7a88819e62d3750ac3fb6f5abc4740d0ddf29de1945fd76627256112565c049
SHA512814b4dc8cb5ebd62d54a9154c718bbfab8e81d5f40317d2743a2e0aada9c3f2edb7601c19f3d767417a40bafcd74de291e71954f35d3b23b1380e8f5239dbfc2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
7KB
MD583ef8c0f2146b55c4b71143c97f80db5
SHA1c542ee3860a1f351d41fdc8b564093b03d1d333f
SHA25608cf4cf53f874671b193bde236c9a51cf1ad25a42581372dd5023155991d608b
SHA5125c6d23491c640ab73c0c4883ea5759d9f14543c561f075255b024e119c2062b34a292a7e9a68587e552c61a5af2a50fdd43cac13b47fa04f2785e0eb96a85a28
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
7KB
MD57aceb50f10c6f16b5ff03581d36c0666
SHA1fcc3b723a1c4683d302769cc925be1954933b58f
SHA25652f9837e7db722658a33a663fee505f8e4067adb45f59ac811cd89af58871efd
SHA51207e08da193c0d84d272a4cbaa7407bca7fcb4afe4005bd8ff93580e3d958ba31dbeaf2d584cdd8010b660dc4cd5f5918535c7aeaf9fea37916061bc477a2f01e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.dbFilesize
24B
MD5419a089e66b9e18ada06c459b000cb4d
SHA1ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a
SHA256c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424
SHA512bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.dbFilesize
1024KB
MD5c55db5f4d1b9139fc0b0a658943fb534
SHA10f73c92826a15c6d207e91bb8bf91bc545903e85
SHA25631f9d6ad5fb63d94c4f14cc4defd96b1cf6e95bb386878e7f9ed789679c6dc2e
SHA5120265d2818c40651868bb15badeb5d4166c27ddb31b4ef24c0d976569fcea9bdc14109a4e3edef18d2c0e17d2fd81e1fd65c022ca453ed9a9ad1978c6212b5981
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.dbFilesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
7KB
MD594ba4a2911c47faf1ff3d119cc33235e
SHA12e23fe3205ae0f413632ed4d70714e569d74135e
SHA256e7caf249abb90245e5e6d9e5716c6359c65808326fc3a0578156f973f94ca56d
SHA512797efe5f8fc6e10ec19a1819a7a9d41d21e0e0aa95094acd10051c47bef3f56285348efd4921bbb40990a2e8a4ca5be5844f55f12bc37ee3914a6e1b17a99a9e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
7KB
MD5a790f1677a81eff7cbceff249fc590ee
SHA1445d3205d72623773e9be27387e16dfe416ca6e2
SHA2563e49b1394af69f9b0fe2d1b436b707327c39133d1d5e5d5600343da42ce8ffa5
SHA512e9241b6783376488004fbb382a100da689f2dfa30b71be251acd60250e6b0367ec1c9c6b5c0714fa943af064127730c386e59b6ce9cef17dec179888f08b18a5
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.datFilesize
6KB
MD5292034617cd36b277ecbebf75f6f51bc
SHA15c8b9b101a55cdff3d2ba1b96013b1aa278af71b
SHA2562175f2f5ff32d4ca7496faf6f4eea49e73b7b935e68c08a0d7e82a9e2239cda6
SHA512e6198a547ea322684ede292552541586c5ff29d84bf626dbbdde445f380558c0459697905e7e7e4f42119d35110c25ab8bd82137b2a30a2cdd70934971b84988
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.datFilesize
10KB
MD517cdbfb366f2038bd60edbaefea7f2a6
SHA15edf3e32f3b137c35fa7be3cbe93d7b1501f0c63
SHA256f9a35ba678da0c5210929381bb0ee1a02c1d794f66fc8336090291f8de3f3f78
SHA512037203d3e78ea40e8f19f16b48acd1e523638976b45f7ac45c1a3206da96b1f51944d88e6bbc27abfda237545576103fd0f8dbb54e772ba8f21bbaf32dd44126
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133575738723867117.txtFilesize
2KB
MD565d939ef67bf440d30c8dee4eebe4890
SHA15aa8c724f2e458d7c7c6fe7bd6daf0f48b13fc40
SHA256e7abcd543a39be760c610fb1cd8a101abfffc6002e47aaf7dea39b31f94a3531
SHA5128237d8dcab2898614b13f052ca540e6f094b7eb4653a110b572967b3fd34c5d29982cb1ada9a4e38702d08cf736c684ae8269aeac55f0fcbcc2d5b04dfbb50e7
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133575738821722264.txtFilesize
67KB
MD509fa2c626f558226cfdbcfdcab8b5248
SHA1de125841635f74c4b225859e163c80eb9832ad5d
SHA2567763b4a38f77350aa9b514115b30f03f4e842e32278e013989d9addcfa5eae5d
SHA5128330e4c5db28ce0bc05194cb3ab72adf9ed0fcb65ec82ba46aefeb9e3d3d92cfd9cd3c0f993e0f486d437998549a1d5a97aa67c91137dba5a8a6d2aa0eb4ab33
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.datFilesize
2KB
MD5ce18ce56e99b0becdac1acf971555307
SHA1a5b25803f7806d2a3f239803684bd70f65e5420c
SHA256798187064fe76693b6d43336013ce439514fd2626290ead457e99c89dbb3607b
SHA512e93a9ad9904bfd69c5d2a84be883326b648baed7e5b828bdbe7a1b897410eaafd2f9332c3de18d4f1ea2ab50a05aa424169f347ae495cc8b3510a26fe5c010a9
-
C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\OC9I7LFD\www.bing[1].xmlFilesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
C:\Users\Admin\AppData\Roaming\80C8ACDF80C8ACDF.bmpFilesize
2.6MB
MD5993cc909a89f0fb7fe90acc3703c2105
SHA1f422cdcb426718b235a19080b0daf71c9b448768
SHA2564aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8
SHA5125ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762
-
memory/920-42-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-52-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-21-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-22-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-23-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-24-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-25-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-26-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-27-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-28-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-29-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-30-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-31-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-32-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-33-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-34-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-35-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-36-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-37-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-38-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-39-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-40-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-41-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-17-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-43-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-44-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-45-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-46-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-47-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-48-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-49-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-50-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-51-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-20-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-53-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-54-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-55-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-56-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-57-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-58-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-59-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-60-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-61-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-62-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-63-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-64-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-65-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-66-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-16-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-15-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-14-0x0000000002490000-0x0000000002565000-memory.dmpFilesize
852KB
-
memory/920-13-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-12-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-11-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-7-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-5-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-6-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-4-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-3-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-2-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-1-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-0-0x0000000002490000-0x0000000002565000-memory.dmpFilesize
852KB
-
memory/920-67-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-68-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-69-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-70-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/920-71-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
