Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2024 05:55
Static task
static1
Behavioral task
behavioral1
Sample
Cerber5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Cerber5.exe
Resource
win10v2004-20231215-en
General
-
Target
Cerber5.exe
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___BE03TG_.txt
cerber
http://xpcx6erilkjced3j.onion/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.1n5mod.top/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.19kdeh.top/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.1mpsnr.top/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.18ey8e.top/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.17gcun.top/3A12-33FD-03F2-0098-B746
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1103) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 4656 netsh.exe 876 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Cerber5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation Cerber5.exe -
Drops startup file 1 IoCs
Processes:
Cerber5.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ Cerber5.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Cerber5.exedescription ioc process File opened (read-only) \??\w: Cerber5.exe File opened (read-only) \??\z: Cerber5.exe File opened (read-only) \??\g: Cerber5.exe File opened (read-only) \??\l: Cerber5.exe File opened (read-only) \??\n: Cerber5.exe File opened (read-only) \??\t: Cerber5.exe File opened (read-only) \??\u: Cerber5.exe File opened (read-only) \??\h: Cerber5.exe File opened (read-only) \??\i: Cerber5.exe File opened (read-only) \??\p: Cerber5.exe File opened (read-only) \??\y: Cerber5.exe File opened (read-only) \??\x: Cerber5.exe File opened (read-only) \??\a: Cerber5.exe File opened (read-only) \??\m: Cerber5.exe File opened (read-only) \??\o: Cerber5.exe File opened (read-only) \??\r: Cerber5.exe File opened (read-only) \??\v: Cerber5.exe File opened (read-only) \??\s: Cerber5.exe File opened (read-only) \??\b: Cerber5.exe File opened (read-only) \??\e: Cerber5.exe File opened (read-only) \??\j: Cerber5.exe File opened (read-only) \??\k: Cerber5.exe File opened (read-only) \??\q: Cerber5.exe -
Drops file in System32 directory 38 IoCs
Processes:
Cerber5.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook Cerber5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
Cerber5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpB805.bmp" Cerber5.exe -
Drops file in Program Files directory 20 IoCs
Processes:
Cerber5.exedescription ioc process File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\office Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote Cerber5.exe File opened for modification \??\c:\program files (x86)\onenote Cerber5.exe File opened for modification \??\c:\program files (x86)\outlook Cerber5.exe File opened for modification \??\c:\program files (x86)\powerpoint Cerber5.exe File opened for modification \??\c:\program files (x86)\ Cerber5.exe File opened for modification \??\c:\program files (x86)\bitcoin Cerber5.exe File opened for modification \??\c:\program files (x86)\steam Cerber5.exe File opened for modification \??\c:\program files (x86)\the bat! Cerber5.exe File opened for modification \??\c:\program files\ Cerber5.exe File opened for modification \??\c:\program files (x86)\excel Cerber5.exe File opened for modification \??\c:\program files (x86)\word Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft sql server Cerber5.exe File opened for modification \??\c:\program files (x86)\thunderbird Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\word Cerber5.exe File opened for modification \??\c:\program files (x86)\office Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\excel Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook Cerber5.exe -
Drops file in Windows directory 64 IoCs
Processes:
Cerber5.exedescription ioc process File opened for modification \??\c:\windows\ Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint Cerber5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4228 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
Cerber5.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings Cerber5.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 4684 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Cerber5.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2108 Cerber5.exe Token: SeCreatePagefilePrivilege 2108 Cerber5.exe Token: SeDebugPrivilege 4228 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Cerber5.execmd.exedescription pid process target process PID 2108 wrote to memory of 4656 2108 Cerber5.exe netsh.exe PID 2108 wrote to memory of 4656 2108 Cerber5.exe netsh.exe PID 2108 wrote to memory of 4656 2108 Cerber5.exe netsh.exe PID 2108 wrote to memory of 876 2108 Cerber5.exe netsh.exe PID 2108 wrote to memory of 876 2108 Cerber5.exe netsh.exe PID 2108 wrote to memory of 876 2108 Cerber5.exe netsh.exe PID 2108 wrote to memory of 4796 2108 Cerber5.exe mshta.exe PID 2108 wrote to memory of 4796 2108 Cerber5.exe mshta.exe PID 2108 wrote to memory of 4796 2108 Cerber5.exe mshta.exe PID 2108 wrote to memory of 4684 2108 Cerber5.exe NOTEPAD.EXE PID 2108 wrote to memory of 4684 2108 Cerber5.exe NOTEPAD.EXE PID 2108 wrote to memory of 4684 2108 Cerber5.exe NOTEPAD.EXE PID 2108 wrote to memory of 3372 2108 Cerber5.exe cmd.exe PID 2108 wrote to memory of 3372 2108 Cerber5.exe cmd.exe PID 2108 wrote to memory of 3372 2108 Cerber5.exe cmd.exe PID 3372 wrote to memory of 4228 3372 cmd.exe taskkill.exe PID 3372 wrote to memory of 4228 3372 cmd.exe taskkill.exe PID 3372 wrote to memory of 4228 3372 cmd.exe taskkill.exe PID 3372 wrote to memory of 2448 3372 cmd.exe PING.EXE PID 3372 wrote to memory of 2448 3372 cmd.exe PING.EXE PID 3372 wrote to memory of 2448 3372 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cerber5.exe"C:\Users\Admin\AppData\Local\Temp\Cerber5.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___JHILO_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___DFP5J_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "C" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "C"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___PW77_.htaFilesize
76KB
MD5f1ed6f9dd36af0ad77dc8981ab32c059
SHA11a1ea4acef82ccbe38787f350bdb9084ea113382
SHA256efa30a01200781f92cda6d6a853ff5ac6b849aeabc6a6b27fc2e46c54be78a85
SHA512b728dbd990c1a0e926dfe5517a74dad9dabfb724d047927f60717f4456bf2912970280bf4e588900ef5027245b97feebba13836e9668b6066ec9f734d0f3608a
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___BE03TG_.txtFilesize
1KB
MD5aef7f160291674237b87c8606b818617
SHA10ba181a6f8183efce993934b0937789595ddc2a7
SHA256bb98cb08666fbeee8d88ca887e63c23ad1c7f9877ff1caa0401edc118c5f7cd0
SHA512ed61079cc861c77393d7a49d6c48bcd7d33a600b0fd74cef2cde78c9be4f3a64c7fb1f4094866e21e2fb45ec7ad41ed64a067acee53b5f76b0d536470bfe57b1
-
memory/2108-0-0x00000000014B0000-0x00000000014E1000-memory.dmpFilesize
196KB
-
memory/2108-1-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2108-2-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2108-6-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2108-14-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2108-390-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2108-411-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2108-415-0x0000000000440000-0x000000000044E000-memory.dmpFilesize
56KB