Resubmissions
17-04-2024 14:30
240417-rt43faca49 1017-04-2024 14:30
240417-rt4fxade5v 1017-04-2024 14:29
240417-rtyknaca44 1017-04-2024 14:29
240417-rtsz6sde3z 1017-04-2024 14:29
240417-rtspeade3y 1031-07-2022 05:21
220731-f17w5aade2 10Analysis
-
max time kernel
1799s -
max time network
1516s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
17-04-2024 14:30
General
-
Target
94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
-
Size
1.5MB
-
MD5
6599f79e40a26186261b58aa89194e5b
-
SHA1
0a44b71f930447d545de0f10b6f9c70d513acacc
-
SHA256
94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
-
SHA512
9e4c8b704bdf6f69df693c40c323f069ac7b9900ab8486d7e5a8423670aa1ee686ccfb6c4026f903d0928145efeee04b0b4cded0000f918862208baba9913748
-
SSDEEP
24576:4i9CFkYBMSUkGUbDkAv0f3BIykhWmRkLhKRahLo1ChjllyzD8k20ZItIhi4Gx:4ieMSU0bD7Q3Bfkh9k1VtKChpIzD/Std
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 12 IoCs
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies registry class 37 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 45 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exeC:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe2⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\System32\xfsFilesize
265KB
MD590c4396aa90bcff93925da80c40eec7d
SHA12e18c728ecea016a4a3cd162ecd5eb78afa03fd8
SHA256fa1337a2f7dc2f2feb59ff839347f61b21c21c6c59da97be8adbe8f294e2f3b2
SHA512be717dfd0d60f790b13b0bf7ecb0ce668e2a42384f140d3b77ab856c1c835f8f73c55f8660c552b265b5dfbfb202d3a3ee4b7f5d3f5b7832f2675d7e6aa34fd7
-
C:\ProgramData\Windows\csrss.exeFilesize
1.5MB
MD56599f79e40a26186261b58aa89194e5b
SHA10a44b71f930447d545de0f10b6f9c70d513acacc
SHA25694b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
SHA5129e4c8b704bdf6f69df693c40c323f069ac7b9900ab8486d7e5a8423670aa1ee686ccfb6c4026f903d0928145efeee04b0b4cded0000f918862208baba9913748
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.dbFilesize
1024KB
MD5be195af7f57b48e3e12cdf357c6169a2
SHA15d8b0be8c34e991ed25519a99ec64838bd2f2056
SHA2567fe307ad61856ee8dd10cb90b2930d21605f757acebeb60d2c67e09542d0aa4c
SHA51204a7254ae7c42483ebae07c4d4b089e9ad2d35166e40b31f4412dbbd7eef5bf3e8bdd6608da3b723323d53d29165a585e3dd947b175e84c32863a10646ae067c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.dbFilesize
1024KB
MD511ae612cb19da75ad54549a9690db99a
SHA1b44f9fc4ce5684300868a1611f64f71ea514865f
SHA256751bb02ddffafce04230550655eb738d861ee4787fe7971a3757516fee41773a
SHA5120abb1ff83e5e3c28a58a9b6bc6f98987573679be8c82a96b27db490c11a3e0f1f47aef4ef65d41d8bd3c4d53ec48bfa61787998dc25534c1f2276a733853ee78
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.dbFilesize
1024KB
MD51cdc0ffd2c431a35cc6e71cc7957691a
SHA1e1ad189050008e41b5a96db0db7db9cb48fbe623
SHA2560d119fb83a6f22252a4c27de88734bc062441813fb7f7603357c73cf81aad1dc
SHA512635fd7a12f724f4b91cf249989c47f6a9494e0fa838b048d38264dd590c0fc5ec9ba470bbbca86f2db63427e9d5a1ed65b5164c0dbb5720c24071f3c9e108e02
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
7KB
MD5fcd9c071663797458ddd588e3955490b
SHA14699a3e531e03953718496ae04a70355710d756a
SHA256876e87ae2d94ec57b5080030439ab5bb55b3a41ea2224430a25e1f31aadef6e1
SHA5123523423e469524a69cc3c2a20dc82a4c5e301cb957052d1e519a60e1d4d6a818f361a758549e5fe95e78caffbe338cab0721c5a522ad4fceef985061beab1b1e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
7KB
MD506593527b81dcd543714adfcc7291dab
SHA17d57a0138c7bd8e4a930f7db4836b317bda1b203
SHA256ec4ddc686321e3de541c44e7cf07042ce86043794b910b7abdec5da13e41e6d6
SHA5124ed775556e4bdc4c6d7c0eecb6defcbd4fad0afe790cd65faa0c76a6aea2fac2f7c7eff6c1b2d3bca73a0016e74e1105f354c5846c66a29915df34934e067359
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.dbFilesize
24B
MD5419a089e66b9e18ada06c459b000cb4d
SHA1ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a
SHA256c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424
SHA512bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.dbFilesize
1024KB
MD595b6ac70696afe7a8e55ec735dd16400
SHA15702f4a25f64f393bb2bb60df4a3bf2b74f4e292
SHA2560959d359562b69758e43602c8915bbe11383f0d842574f44425f287295103c24
SHA5123270a28b35cbd8348af4e76cbf305a1d8a2787db91fcd542a19c91833e6432e89ea1dfb59744aecc744761b7eb975f7c31c92d401869623d7a4a1da6b5c8a5e6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.dbFilesize
1024KB
MD57cc03322ed8facd1a22484971864abca
SHA13d0467197ebba4c6e29aff7ca488d0f38fc1e4df
SHA25637ab05149f1ee0370b5770f856dbebf41ae4d597d9ad3379f7fa8ffa8a21398a
SHA512583ad7394d1593b087e240753f48b8b29baded004693fc75f499dff865bcfc533569a4188c4997e019c8b7fb1e7ee68aa47197031afbaf05aa9d2e3fec5eed38
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.dbFilesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
7KB
MD55e654a5b94d8bd3712cc361adf122482
SHA11f89fee499995d781342e92250eed407e33f14a2
SHA25693013c9daba885c1283a51c5f0ea20436407770237f8b90ebd95ab60ccf26366
SHA5124827ce70cd580120360b10bee39cdd91116f1c37cb6801e92fbad78beb7c4f0bfdfde4ced7e01891f92b5c54731e5862f17d74e58a0ff87d8dd354a2bf21d32f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
7KB
MD51bce34fb5390500f9d4fb384a5232188
SHA135a1e99ead99d2dd1a8d1f62ab71050ee70e33de
SHA2566a65b566a92fb4bdfb1c1707c79e8575c3e8a3d60ed219a07c1bf4bb40d51911
SHA512b8261427badb74b9b359aab804c6c4aa8b477c408f66a10f0298994c22331643929ab3d16ba6b733738e453e1d78bba1ebcc91a04d54c72c636fe15d83e2cbd0
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.datFilesize
6KB
MD5d5d3faf43b19015e8921755d52911ce6
SHA14102ebcafd6c49f261620d317c87f11714010ff1
SHA256d9906bd55f73e473e5b819d421f26421e5f4c8811f95003f970dee30ae964c3c
SHA5127d6a715267cf43155592b1bb9e077e6989c2f8c1996c8224ac117b74a701e59f7296cdfdd76b019029fc8971531a87aa48d2b8cbeeb4a31bc745fc71cd8d0054
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.datFilesize
10KB
MD55902e0994d3b8e5eefe6c49430157a93
SHA16e3c3b605ee6145befa98e607b71bfddb91b5f4e
SHA25607f31cc4386167f2f01fcee8345d7a2b99fa347c1a4dc7c470ce1d411d058694
SHA512e02dc5829f7fe2a1a1bd5a682e386c6c8a5e709b94204ca4f2191100457facc1d02c5e36fba81be955ace78e1291b357a0c76c4ddb1e9933a1fab7a46147f698
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133578603745668128.txtFilesize
2KB
MD565d939ef67bf440d30c8dee4eebe4890
SHA15aa8c724f2e458d7c7c6fe7bd6daf0f48b13fc40
SHA256e7abcd543a39be760c610fb1cd8a101abfffc6002e47aaf7dea39b31f94a3531
SHA5128237d8dcab2898614b13f052ca540e6f094b7eb4653a110b572967b3fd34c5d29982cb1ada9a4e38702d08cf736c684ae8269aeac55f0fcbcc2d5b04dfbb50e7
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.datFilesize
2KB
MD5eec497b5b1b5d7809cf37cbacd787108
SHA1fb8708dd2fc4bc67548a366f618c41dc45dee3fb
SHA2566cec6efc1c0d59bd8208bcaf08e176537aad59f38a68534fe4142905429733e6
SHA5128cc18a441e8b92eb86c1c21eabe4f994f4b42f57e71afdb503c6a391b6c031d154b394ffcada28718cb0c26209fe25d5281d4ec4d3ee0d7a785b981108e72f36
-
C:\Users\Admin\AppData\Roaming\9ED057A69ED057A6.bmpFilesize
2.6MB
MD5993cc909a89f0fb7fe90acc3703c2105
SHA1f422cdcb426718b235a19080b0daf71c9b448768
SHA2564aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8
SHA5125ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762
-
memory/2356-56-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-65-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-30-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-31-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-32-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-33-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-36-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-37-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-38-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-39-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-40-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-41-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-42-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-43-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-44-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-45-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-46-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-47-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-48-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-49-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-50-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-51-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-52-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-53-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-54-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-55-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-20-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-57-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-58-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-59-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-60-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-61-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-62-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-63-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-64-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-29-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-66-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-67-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-68-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-69-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-70-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-71-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-72-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-73-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-74-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-75-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-76-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-77-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-78-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-79-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-28-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-22-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-18-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-26-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2356-27-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/2484-0-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-2-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-6-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-5-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-8-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-3-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-7-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-1-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-4-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-9-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-10-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-11-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-14-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-17-0x0000000003370000-0x00000000033A4000-memory.dmpFilesize
208KB
-
memory/2484-19-0x0000000000400000-0x000000000062A000-memory.dmpFilesize
2.2MB
-
memory/2484-21-0x0000000003370000-0x00000000033A4000-memory.dmpFilesize
208KB
