Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 20:01
Static task
static1
Behavioral task
behavioral1
Sample
392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033.dll
Resource
win7-20240215-en
General
-
Target
392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033.dll
-
Size
120KB
-
MD5
1f36085ce2c80a804bfd3cf99b4492a3
-
SHA1
740b3e28317ab6847e76af8b904a46696097d30e
-
SHA256
392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033
-
SHA512
c138bb562c02947701a623ffab767a681de8c9b5162442cb6e9e5888b01427ce2870050db2117614206e883ddde2743a4a10abef982c243a40b1f1e6d41a8179
-
SSDEEP
1536:wHILkvILFVLoYOFehsDQlx+j/t3msFyR2YkkxkpDVa9RSy3OUwb0OJNU7B6l3u:+xInL+FeG0lx+jpkR2xc4Q9PNwbAB6l
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
f760aca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f760aca.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f760aca.exe -
Processes:
f760aca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760aca.exe -
Processes:
f760aca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760aca.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 30 IoCs
Processes:
resource yara_rule behavioral1/memory/2472-13-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-15-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-16-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-18-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-21-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-26-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-23-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-35-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-47-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-30-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-54-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-55-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-56-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-57-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-58-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-72-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-76-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-77-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-79-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-81-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-83-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-85-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-87-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-90-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-91-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-94-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-95-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-101-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-102-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2472-104-0x00000000006E0000-0x000000000179A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2472-10-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2472-13-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-15-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-16-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-18-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-21-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-26-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-23-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-35-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2616-46-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2472-47-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-30-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-54-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-55-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-56-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-57-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-58-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-72-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/1324-75-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2472-76-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-77-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-79-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-81-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-83-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-85-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-87-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-90-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-91-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-94-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-95-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-101-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-102-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2472-104-0x00000000006E0000-0x000000000179A000-memory.dmp UPX behavioral1/memory/2616-118-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f760aca.exef760fd9.exef762694.exepid process 2472 f760aca.exe 2616 f760fd9.exe 1324 f762694.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2564 rundll32.exe 2564 rundll32.exe 2564 rundll32.exe 2564 rundll32.exe 2564 rundll32.exe 2564 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2472-13-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-15-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-16-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-18-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-21-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-26-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-23-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-35-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-47-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-30-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-54-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-55-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-56-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-57-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-58-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-72-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-76-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-77-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-79-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-81-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-83-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-85-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-87-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-90-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-91-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-94-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-95-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-101-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-102-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2472-104-0x00000000006E0000-0x000000000179A000-memory.dmp upx -
Processes:
f760aca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760aca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760aca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f760aca.exe -
Processes:
f760aca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760aca.exe -
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f760aca.exedescription ioc process File opened (read-only) \??\I: f760aca.exe File opened (read-only) \??\K: f760aca.exe File opened (read-only) \??\N: f760aca.exe File opened (read-only) \??\G: f760aca.exe File opened (read-only) \??\H: f760aca.exe File opened (read-only) \??\L: f760aca.exe File opened (read-only) \??\M: f760aca.exe File opened (read-only) \??\O: f760aca.exe File opened (read-only) \??\P: f760aca.exe File opened (read-only) \??\E: f760aca.exe File opened (read-only) \??\J: f760aca.exe -
Drops file in Windows directory 2 IoCs
Processes:
f760aca.exedescription ioc process File created C:\Windows\f760b76 f760aca.exe File opened for modification C:\Windows\SYSTEM.INI f760aca.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f760aca.exepid process 2472 f760aca.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
f760aca.exedescription pid process Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe Token: SeDebugPrivilege 2472 f760aca.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
rundll32.exerundll32.exef760aca.exedescription pid process target process PID 2660 wrote to memory of 2564 2660 rundll32.exe rundll32.exe PID 2660 wrote to memory of 2564 2660 rundll32.exe rundll32.exe PID 2660 wrote to memory of 2564 2660 rundll32.exe rundll32.exe PID 2660 wrote to memory of 2564 2660 rundll32.exe rundll32.exe PID 2660 wrote to memory of 2564 2660 rundll32.exe rundll32.exe PID 2660 wrote to memory of 2564 2660 rundll32.exe rundll32.exe PID 2660 wrote to memory of 2564 2660 rundll32.exe rundll32.exe PID 2564 wrote to memory of 2472 2564 rundll32.exe f760aca.exe PID 2564 wrote to memory of 2472 2564 rundll32.exe f760aca.exe PID 2564 wrote to memory of 2472 2564 rundll32.exe f760aca.exe PID 2564 wrote to memory of 2472 2564 rundll32.exe f760aca.exe PID 2472 wrote to memory of 1044 2472 f760aca.exe Dwm.exe PID 2472 wrote to memory of 1072 2472 f760aca.exe taskhost.exe PID 2472 wrote to memory of 1116 2472 f760aca.exe Explorer.EXE PID 2472 wrote to memory of 2128 2472 f760aca.exe DllHost.exe PID 2472 wrote to memory of 2660 2472 f760aca.exe rundll32.exe PID 2472 wrote to memory of 2564 2472 f760aca.exe rundll32.exe PID 2472 wrote to memory of 2564 2472 f760aca.exe rundll32.exe PID 2564 wrote to memory of 2616 2564 rundll32.exe f760fd9.exe PID 2564 wrote to memory of 2616 2564 rundll32.exe f760fd9.exe PID 2564 wrote to memory of 2616 2564 rundll32.exe f760fd9.exe PID 2564 wrote to memory of 2616 2564 rundll32.exe f760fd9.exe PID 2564 wrote to memory of 1324 2564 rundll32.exe f762694.exe PID 2564 wrote to memory of 1324 2564 rundll32.exe f762694.exe PID 2564 wrote to memory of 1324 2564 rundll32.exe f762694.exe PID 2564 wrote to memory of 1324 2564 rundll32.exe f762694.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
f760aca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760aca.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f760aca.exeC:\Users\Admin\AppData\Local\Temp\f760aca.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f760fd9.exeC:\Users\Admin\AppData\Local\Temp\f760fd9.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f762694.exeC:\Users\Admin\AppData\Local\Temp\f762694.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\f760aca.exeFilesize
97KB
MD56a1ce240e4d8cf642b1c51db59b3a900
SHA149d911b68395bf55d83f8af03d9d2e2841545dfa
SHA25685cfb56e9ec5d79b7369ebea0ae8eada99a51084b40e86412e94aeba1254e7fa
SHA5125a38ac5c17ad6a35777bc859580c5f08bfe3d161c10d455ea34caabb26b5df2c757206ba571f8c4bf0c04686546ae86abc15bc433a9f2d4d99f0ee151293ab99
-
memory/1044-17-0x0000000000130000-0x0000000000132000-memory.dmpFilesize
8KB
-
memory/1324-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2472-77-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-79-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-104-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-57-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-102-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-16-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-18-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-21-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-101-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-26-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-56-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-95-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-58-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-35-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-94-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-47-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-30-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-91-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-54-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-55-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-23-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-15-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-90-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-87-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-72-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-85-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2472-83-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-81-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-76-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2472-13-0x00000000006E0000-0x000000000179A000-memory.dmpFilesize
16.7MB
-
memory/2564-34-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/2564-67-0x0000000000690000-0x0000000000692000-memory.dmpFilesize
8KB
-
memory/2564-70-0x0000000000760000-0x0000000000772000-memory.dmpFilesize
72KB
-
memory/2564-74-0x0000000000760000-0x0000000000772000-memory.dmpFilesize
72KB
-
memory/2564-73-0x0000000000330000-0x0000000000332000-memory.dmpFilesize
8KB
-
memory/2564-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2564-33-0x0000000000690000-0x0000000000692000-memory.dmpFilesize
8KB
-
memory/2564-29-0x0000000000690000-0x0000000000692000-memory.dmpFilesize
8KB
-
memory/2564-31-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/2564-11-0x0000000000330000-0x0000000000342000-memory.dmpFilesize
72KB
-
memory/2564-4-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2616-46-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2616-118-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB