Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 19:55
Static task
static1
Behavioral task
behavioral1
Sample
b017edfff794a123a6192709800fa2c396b922aa0a1a1066618254e53e912cfb.dll
Resource
win7-20240221-en
General
-
Target
b017edfff794a123a6192709800fa2c396b922aa0a1a1066618254e53e912cfb.dll
-
Size
120KB
-
MD5
5d825a2aa70b57b3a664db53d6996c5f
-
SHA1
06ecfd8d611989855ab4905cf72ada3a1a9051f9
-
SHA256
b017edfff794a123a6192709800fa2c396b922aa0a1a1066618254e53e912cfb
-
SHA512
8022008d49704aa959d7c3470813a7b9ccd011376a0f5678cbf4bd3a2e9599d473edeb166760763a169f3af2b74ef6cf4c4d3894686eeb582ef3c1f92142f605
-
SSDEEP
1536:kVshIgAiWmE86VxEQdg7wmdHd3if8WrBG3nAzo1YSYPZ+yA5GM77mOHROHbZm9oi:9Ig1WGHQdgFdH2B4nAzOYPgkOHcbY9t
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
f76a8ae.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a8ae.exe -
Processes:
f76a8ae.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a8ae.exe -
Processes:
f76a8ae.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a8ae.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2172-12-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-14-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-15-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-18-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-23-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-43-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-49-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-27-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-58-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-59-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-60-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-61-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-62-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-63-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-78-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-81-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-82-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-83-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-85-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-106-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-108-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2172-144-0x00000000005D0000-0x000000000168A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2384-150-0x0000000000920000-0x00000000019DA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral1/memory/2172-10-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2172-12-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-14-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-15-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-18-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-23-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-43-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/1744-46-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2172-49-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-27-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-58-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-59-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-60-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-61-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-62-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2384-79-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2172-63-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-78-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-81-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-82-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-83-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-85-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-106-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-108-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2172-143-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2172-144-0x00000000005D0000-0x000000000168A000-memory.dmp UPX behavioral1/memory/2384-150-0x0000000000920000-0x00000000019DA000-memory.dmp UPX behavioral1/memory/2384-149-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f76a8ae.exef76b02d.exef76c236.exepid process 2172 f76a8ae.exe 1744 f76b02d.exe 2384 f76c236.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2172-12-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-14-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-15-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-18-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-23-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-43-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-49-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-27-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-58-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-59-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-60-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-61-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-62-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-63-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-78-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-81-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-82-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-83-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-85-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-106-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-108-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2172-144-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2384-150-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f76a8ae.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a8ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a8ae.exe -
Processes:
f76a8ae.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a8ae.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f76a8ae.exedescription ioc process File opened (read-only) \??\G: f76a8ae.exe File opened (read-only) \??\J: f76a8ae.exe File opened (read-only) \??\M: f76a8ae.exe File opened (read-only) \??\O: f76a8ae.exe File opened (read-only) \??\L: f76a8ae.exe File opened (read-only) \??\N: f76a8ae.exe File opened (read-only) \??\E: f76a8ae.exe File opened (read-only) \??\H: f76a8ae.exe File opened (read-only) \??\I: f76a8ae.exe File opened (read-only) \??\K: f76a8ae.exe -
Drops file in Windows directory 2 IoCs
Processes:
f76a8ae.exedescription ioc process File created C:\Windows\f76a9d6 f76a8ae.exe File opened for modification C:\Windows\SYSTEM.INI f76a8ae.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f76a8ae.exepid process 2172 f76a8ae.exe 2172 f76a8ae.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f76a8ae.exedescription pid process Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe Token: SeDebugPrivilege 2172 f76a8ae.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef76a8ae.exedescription pid process target process PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1772 wrote to memory of 2172 1772 rundll32.exe f76a8ae.exe PID 1772 wrote to memory of 2172 1772 rundll32.exe f76a8ae.exe PID 1772 wrote to memory of 2172 1772 rundll32.exe f76a8ae.exe PID 1772 wrote to memory of 2172 1772 rundll32.exe f76a8ae.exe PID 2172 wrote to memory of 1180 2172 f76a8ae.exe taskhost.exe PID 2172 wrote to memory of 1312 2172 f76a8ae.exe Dwm.exe PID 2172 wrote to memory of 1368 2172 f76a8ae.exe Explorer.EXE PID 2172 wrote to memory of 460 2172 f76a8ae.exe DllHost.exe PID 2172 wrote to memory of 1152 2172 f76a8ae.exe rundll32.exe PID 2172 wrote to memory of 1772 2172 f76a8ae.exe rundll32.exe PID 2172 wrote to memory of 1772 2172 f76a8ae.exe rundll32.exe PID 1772 wrote to memory of 1744 1772 rundll32.exe f76b02d.exe PID 1772 wrote to memory of 1744 1772 rundll32.exe f76b02d.exe PID 1772 wrote to memory of 1744 1772 rundll32.exe f76b02d.exe PID 1772 wrote to memory of 1744 1772 rundll32.exe f76b02d.exe PID 1772 wrote to memory of 2384 1772 rundll32.exe f76c236.exe PID 1772 wrote to memory of 2384 1772 rundll32.exe f76c236.exe PID 1772 wrote to memory of 2384 1772 rundll32.exe f76c236.exe PID 1772 wrote to memory of 2384 1772 rundll32.exe f76c236.exe PID 2172 wrote to memory of 1180 2172 f76a8ae.exe taskhost.exe PID 2172 wrote to memory of 1312 2172 f76a8ae.exe Dwm.exe PID 2172 wrote to memory of 1368 2172 f76a8ae.exe Explorer.EXE PID 2172 wrote to memory of 1744 2172 f76a8ae.exe f76b02d.exe PID 2172 wrote to memory of 1744 2172 f76a8ae.exe f76b02d.exe PID 2172 wrote to memory of 2384 2172 f76a8ae.exe f76c236.exe PID 2172 wrote to memory of 2384 2172 f76a8ae.exe f76c236.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
f76a8ae.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a8ae.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b017edfff794a123a6192709800fa2c396b922aa0a1a1066618254e53e912cfb.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b017edfff794a123a6192709800fa2c396b922aa0a1a1066618254e53e912cfb.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f76a8ae.exeC:\Users\Admin\AppData\Local\Temp\f76a8ae.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76b02d.exeC:\Users\Admin\AppData\Local\Temp\f76b02d.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f76c236.exeC:\Users\Admin\AppData\Local\Temp\f76c236.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f76a8ae.exeFilesize
97KB
MD54dd8147ad96ba785517c6a0b399828b7
SHA11b36523f04d35630f82a4c428684e74762548ed0
SHA25699db49fa8353610cd95e701335586f30a6459c1c3e95af585e89aaae381533c3
SHA512ae9f7e5a30d7707101d0097bfec6604a3ff541ae8700e96b38da303e19aa9c7304357bd1af37899bfb9504671b6566e5eea9f4f0c90c158d8eef3d0bb55a777d
-
memory/1180-16-0x0000000001B40000-0x0000000001B42000-memory.dmpFilesize
8KB
-
memory/1744-96-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1744-46-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1744-94-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/1772-77-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB
-
memory/1772-76-0x00000000002A0000-0x00000000002B2000-memory.dmpFilesize
72KB
-
memory/1772-8-0x00000000001E0000-0x00000000001F2000-memory.dmpFilesize
72KB
-
memory/1772-11-0x00000000001E0000-0x00000000001F2000-memory.dmpFilesize
72KB
-
memory/1772-71-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/1772-25-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/1772-74-0x00000000002A0000-0x00000000002B2000-memory.dmpFilesize
72KB
-
memory/1772-26-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1772-29-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/1772-31-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1772-44-0x00000000002A0000-0x00000000002B2000-memory.dmpFilesize
72KB
-
memory/1772-40-0x00000000002A0000-0x00000000002B2000-memory.dmpFilesize
72KB
-
memory/1772-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2172-59-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-81-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-57-0x00000000004C0000-0x00000000004C2000-memory.dmpFilesize
8KB
-
memory/2172-51-0x0000000001750000-0x0000000001751000-memory.dmpFilesize
4KB
-
memory/2172-27-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-58-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-43-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-60-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-61-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-62-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-23-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-18-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-15-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-14-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-144-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-63-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-78-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-49-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-82-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-83-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-85-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-12-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-143-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2172-105-0x00000000004C0000-0x00000000004C2000-memory.dmpFilesize
8KB
-
memory/2172-108-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2172-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2172-106-0x00000000005D0000-0x000000000168A000-memory.dmpFilesize
16.7MB
-
memory/2384-102-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2384-104-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2384-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2384-150-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2384-149-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2384-151-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB