Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 08:21
Static task
static1
Behavioral task
behavioral1
Sample
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
General
-
Target
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe
-
Size
226KB
-
MD5
5325d9eabaad0ae40d2c586e6bae6467
-
SHA1
1b3a32c10ea3034f1229faa5fc4b6c9fc7b687b0
-
SHA256
aceac1915f214f9d075751092dd8c4ea3ebde5da355ebeffce5ddee6c3e4fe48
-
SHA512
452fa48a4b1622eb9d32460917918efb0e4dd8ef0304ee435650c5df6ccd85e3c1b94d5bebf0d84b821f210d628ad75b9e6a1eb1cdca266c089696c937c11104
-
SSDEEP
3072:MAe+3aJpgWXTBucMzjrRe5bklV1CZXYXFQzg1Yl0xiR/EU1KsIdoWxMBWNQ3ZJJ0:PB+pgUubguVcrcm0u/10/dRgdzs/j73
Malware Config
Extracted
C:\Users\Admin\Desktop\_S585_README_.hta
http://p27dokhpz2n7nvgr.onion.to/E53F-64E6-4444-008C-1433
http://p27dokhpz2n7nvgr.onion/E53F-64E6-4444-008C-1433
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 1156 1420 mshta.exe 1160 1420 mshta.exe 1162 1420 mshta.exe 1164 1420 mshta.exe 1166 1420 mshta.exe -
Contacts a large (582) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1332 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exepid process 1804 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp1FE0.bmp" 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exedescription pid process target process PID 1804 set thread context of 2140 1804 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe -
Drops file in Program Files directory 20 IoCs
Processes:
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exedescription ioc process File opened for modification \??\c:\program files (x86)\outlook 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\powerpoint 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\the bat! 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\thunderbird 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files\ 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\ 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\excel 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\office 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\onenote 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\steam 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\word 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\bitcoin 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\microsoft\office 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe -
Drops file in Windows directory 1 IoCs
Processes:
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exedescription ioc process File opened for modification \??\c:\windows\ 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2096 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exepid process 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exepid process 1804 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe Token: SeDebugPrivilege 2096 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2556 DllHost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.execmd.exedescription pid process target process PID 1804 wrote to memory of 2140 1804 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe PID 1804 wrote to memory of 2140 1804 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe PID 1804 wrote to memory of 2140 1804 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe PID 1804 wrote to memory of 2140 1804 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe PID 1804 wrote to memory of 2140 1804 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe PID 2140 wrote to memory of 1420 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe mshta.exe PID 2140 wrote to memory of 1420 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe mshta.exe PID 2140 wrote to memory of 1420 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe mshta.exe PID 2140 wrote to memory of 1420 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe mshta.exe PID 2140 wrote to memory of 1332 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe cmd.exe PID 2140 wrote to memory of 1332 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe cmd.exe PID 2140 wrote to memory of 1332 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe cmd.exe PID 2140 wrote to memory of 1332 2140 2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe cmd.exe PID 1332 wrote to memory of 2096 1332 cmd.exe taskkill.exe PID 1332 wrote to memory of 2096 1332 cmd.exe taskkill.exe PID 1332 wrote to memory of 2096 1332 cmd.exe taskkill.exe PID 1332 wrote to memory of 1628 1332 cmd.exe PING.EXE PID 1332 wrote to memory of 1628 1332 cmd.exe PING.EXE PID 1332 wrote to memory of 1628 1332 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe"C:\Users\Admin\AppData\Local\Temp\2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe"C:\Users\Admin\AppData\Local\Temp\2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe"2⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_S585_README_.hta"3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Modifies system certificate store
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "2017-01-01-pseudoDarkleech-Rig-V-payload-Cerber-radA2306.tmp.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab389F.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar38B2.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\Desktop\_S585_README_.htaFilesize
65KB
MD57847093efe85e1eccbb657fca0aed2c1
SHA17e8e6ab6daa2c90980b046d0d8e1d8a4b86d1997
SHA256e08f4a0195935d78494d52e2edc599f78568c8344de8f4134f1df8630ae30108
SHA512552a16fbc43ebc1048bb379f11b405d696854c496e7ecd9b6800d7241ac02c41a7d2e31322ffd8befc73c95cc52678ad518737c307cd2ef2064892b2bd9cdb43
-
C:\Users\Admin\Desktop\_S585_README_.jpgFilesize
150KB
MD51b6d6e374dd96ec20687077443084263
SHA174a48df3a4e505a38fa2b98afb5029f0781c82bf
SHA2565a2890c97f643236a8afe2fc5fd6f207c1a13870e22185c4eb537bfa66184fa1
SHA5121b963afa21e49422f04dbd2ba27b3102639afe765574a3f710835d7dff19d6d1cec004c0cf19ea315176eb7d155e8a94db8dd765ce0d162f8a2d6b5aa2f67b63
-
\Users\Admin\AppData\Local\Temp\nstA5F.tmp\System.dllFilesize
11KB
MD5a4dd044bcd94e9b3370ccf095b31f896
SHA117c78201323ab2095bc53184aa8267c9187d5173
SHA2562e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
SHA51287335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
-
memory/1804-13-0x0000000002710000-0x000000000273D000-memory.dmpFilesize
180KB
-
memory/1804-17-0x0000000002710000-0x000000000273D000-memory.dmpFilesize
180KB
-
memory/2140-30-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-138-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-29-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-25-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-100-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-24-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-115-0x0000000004140000-0x0000000004142000-memory.dmpFilesize
8KB
-
memory/2140-351-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-15-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-19-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-26-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2140-18-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2556-117-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2556-349-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2556-116-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB