Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
7f898440d5ac3774e6276842eebf3455baf9b6421c022009f60214418df7ff5c.dll
Resource
win7-20240221-en
General
-
Target
7f898440d5ac3774e6276842eebf3455baf9b6421c022009f60214418df7ff5c.dll
-
Size
120KB
-
MD5
1cb57e9011adee639e4dceed2db5f5d8
-
SHA1
9f8efb90419174a3bd43fdf113d752e2ddd3ad9a
-
SHA256
7f898440d5ac3774e6276842eebf3455baf9b6421c022009f60214418df7ff5c
-
SHA512
4efddbff561870918f853ecbb131021708c3686c470be06dbb6d3bf6e147be87275779698ac0a729d7fcb843eaaf3c5a29f7101f859dfa1e35d0dbc551c6e777
-
SSDEEP
3072:/dOQMnvHz9JGBmg4xMdRL0Hfn8iAlsbVw:/D8JG94x0RLU8CW
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
f768cb5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f768cb5.exe -
Processes:
f768cb5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768cb5.exe -
Processes:
f768cb5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768cb5.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2872-11-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-14-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-15-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-18-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-22-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-27-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-43-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-51-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-58-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-59-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-60-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-61-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-62-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-63-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-64-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-78-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-79-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-80-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-82-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-98-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-103-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-105-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2872-140-0x00000000006A0000-0x000000000175A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral1/memory/2872-10-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2872-11-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-14-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-15-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-18-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-22-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2340-46-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2872-27-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-43-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-51-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-58-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-59-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-60-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-61-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-62-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-63-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-64-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/3052-77-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2872-78-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-79-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-80-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-82-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-98-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-103-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-105-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/2872-139-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2872-140-0x00000000006A0000-0x000000000175A000-memory.dmp UPX behavioral1/memory/3052-144-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f768cb5.exef7692ae.exef76a7a5.exepid process 2872 f768cb5.exe 2340 f7692ae.exe 3052 f76a7a5.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2152 rundll32.exe 2152 rundll32.exe 2152 rundll32.exe 2152 rundll32.exe 2152 rundll32.exe 2152 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2872-11-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-14-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-15-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-18-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-22-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-27-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-43-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-51-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-58-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-59-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-60-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-61-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-62-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-63-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-64-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-78-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-79-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-80-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-82-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-98-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-103-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-105-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2872-140-0x00000000006A0000-0x000000000175A000-memory.dmp upx -
Processes:
f768cb5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768cb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768cb5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f768cb5.exe -
Processes:
f768cb5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768cb5.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f768cb5.exedescription ioc process File opened (read-only) \??\G: f768cb5.exe File opened (read-only) \??\M: f768cb5.exe File opened (read-only) \??\N: f768cb5.exe File opened (read-only) \??\O: f768cb5.exe File opened (read-only) \??\L: f768cb5.exe File opened (read-only) \??\E: f768cb5.exe File opened (read-only) \??\H: f768cb5.exe File opened (read-only) \??\I: f768cb5.exe File opened (read-only) \??\J: f768cb5.exe File opened (read-only) \??\K: f768cb5.exe -
Drops file in Windows directory 2 IoCs
Processes:
f768cb5.exedescription ioc process File created C:\Windows\f768dfd f768cb5.exe File opened for modification C:\Windows\SYSTEM.INI f768cb5.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f768cb5.exepid process 2872 f768cb5.exe 2872 f768cb5.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f768cb5.exedescription pid process Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe Token: SeDebugPrivilege 2872 f768cb5.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef768cb5.exedescription pid process target process PID 2300 wrote to memory of 2152 2300 rundll32.exe rundll32.exe PID 2300 wrote to memory of 2152 2300 rundll32.exe rundll32.exe PID 2300 wrote to memory of 2152 2300 rundll32.exe rundll32.exe PID 2300 wrote to memory of 2152 2300 rundll32.exe rundll32.exe PID 2300 wrote to memory of 2152 2300 rundll32.exe rundll32.exe PID 2300 wrote to memory of 2152 2300 rundll32.exe rundll32.exe PID 2300 wrote to memory of 2152 2300 rundll32.exe rundll32.exe PID 2152 wrote to memory of 2872 2152 rundll32.exe f768cb5.exe PID 2152 wrote to memory of 2872 2152 rundll32.exe f768cb5.exe PID 2152 wrote to memory of 2872 2152 rundll32.exe f768cb5.exe PID 2152 wrote to memory of 2872 2152 rundll32.exe f768cb5.exe PID 2872 wrote to memory of 1256 2872 f768cb5.exe taskhost.exe PID 2872 wrote to memory of 1348 2872 f768cb5.exe Dwm.exe PID 2872 wrote to memory of 1408 2872 f768cb5.exe Explorer.EXE PID 2872 wrote to memory of 1120 2872 f768cb5.exe DllHost.exe PID 2872 wrote to memory of 2300 2872 f768cb5.exe rundll32.exe PID 2872 wrote to memory of 2152 2872 f768cb5.exe rundll32.exe PID 2872 wrote to memory of 2152 2872 f768cb5.exe rundll32.exe PID 2152 wrote to memory of 2340 2152 rundll32.exe f7692ae.exe PID 2152 wrote to memory of 2340 2152 rundll32.exe f7692ae.exe PID 2152 wrote to memory of 2340 2152 rundll32.exe f7692ae.exe PID 2152 wrote to memory of 2340 2152 rundll32.exe f7692ae.exe PID 2152 wrote to memory of 3052 2152 rundll32.exe f76a7a5.exe PID 2152 wrote to memory of 3052 2152 rundll32.exe f76a7a5.exe PID 2152 wrote to memory of 3052 2152 rundll32.exe f76a7a5.exe PID 2152 wrote to memory of 3052 2152 rundll32.exe f76a7a5.exe PID 2872 wrote to memory of 1256 2872 f768cb5.exe taskhost.exe PID 2872 wrote to memory of 1348 2872 f768cb5.exe Dwm.exe PID 2872 wrote to memory of 1408 2872 f768cb5.exe Explorer.EXE PID 2872 wrote to memory of 2340 2872 f768cb5.exe f7692ae.exe PID 2872 wrote to memory of 2340 2872 f768cb5.exe f7692ae.exe PID 2872 wrote to memory of 3052 2872 f768cb5.exe f76a7a5.exe PID 2872 wrote to memory of 3052 2872 f768cb5.exe f76a7a5.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
f768cb5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768cb5.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1256
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1348
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1408
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7f898440d5ac3774e6276842eebf3455baf9b6421c022009f60214418df7ff5c.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7f898440d5ac3774e6276842eebf3455baf9b6421c022009f60214418df7ff5c.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\f768cb5.exeC:\Users\Admin\AppData\Local\Temp\f768cb5.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\f7692ae.exeC:\Users\Admin\AppData\Local\Temp\f7692ae.exe4⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\f76a7a5.exeC:\Users\Admin\AppData\Local\Temp\f76a7a5.exe4⤵
- Executes dropped EXE
PID:3052
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1120
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f768cb5.exeFilesize
97KB
MD50bf23bdb7fb6d2c05e5ce88fa833c649
SHA1864616908b77a43bacf6fa0bfaab7031852608a9
SHA256dc71527fbe43fc9af65512f29662cc208539f0dd46e7f0d5036a84742a13299d
SHA51258a053c82236c6268f6f55cc7bd8546a28c2d1c060f7226c90b8be6c2c676d8cfb03e449a152e42b7e081362e8ef9f351342642a1a2584dd170ef7e14d2ef168
-
memory/1256-16-0x0000000001E60000-0x0000000001E62000-memory.dmpFilesize
8KB
-
memory/2152-26-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/2152-12-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2152-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2152-72-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2152-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2152-41-0x0000000000430000-0x0000000000442000-memory.dmpFilesize
72KB
-
memory/2152-44-0x0000000000430000-0x0000000000442000-memory.dmpFilesize
72KB
-
memory/2152-31-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/2152-25-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2152-29-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2340-92-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2340-46-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2340-96-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2340-91-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2872-51-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-139-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2872-27-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-43-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-50-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2872-22-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-78-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-58-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-59-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-60-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-61-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-62-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-63-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-64-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-11-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-14-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-57-0x0000000000320000-0x0000000000322000-memory.dmpFilesize
8KB
-
memory/2872-79-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-80-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-82-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2872-15-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-18-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-140-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-98-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-116-0x0000000000320000-0x0000000000322000-memory.dmpFilesize
8KB
-
memory/2872-103-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2872-105-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/3052-101-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/3052-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3052-100-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/3052-144-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB