Analysis
-
max time kernel
27s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 22:10
Static task
static1
Behavioral task
behavioral1
Sample
4089861fadad9f3884fad19a89522a20_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
4089861fadad9f3884fad19a89522a20_NeikiAnalytics.dll
-
Size
120KB
-
MD5
4089861fadad9f3884fad19a89522a20
-
SHA1
228ad52f5b9c9d0d24fd202abbcfad9fca37e1bc
-
SHA256
01b461364972d5d7016a6b5c956aa00469b3598f9dd0ef833e68901812eacbaf
-
SHA512
0bda4787f849a271f6e57fc453601d894f5bcb063b218b9f938a5182bb66e612383628899ed1c0643b295693c29fed95c9e841617ec97794839b07179021bfd8
-
SSDEEP
3072:8os8RtJwLJVMYRHxL0ve+zLC93gztoix9:k8RtmbMSxLme+zLC93gztoix
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f761d50.exef7638eb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761d50.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761d50.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7638eb.exe -
Processes:
f761d50.exef7638eb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7638eb.exe -
Processes:
f761d50.exef7638eb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7638eb.exe -
Executes dropped EXE 3 IoCs
Processes:
f761d50.exef761f05.exef7638eb.exepid process 2404 f761d50.exe 2592 f761f05.exe 2976 f7638eb.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2248 rundll32.exe 2248 rundll32.exe 2248 rundll32.exe 2248 rundll32.exe 2248 rundll32.exe 2248 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2404-12-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-14-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-16-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-18-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-20-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-22-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-21-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-19-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-17-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-15-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-58-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-59-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-60-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-61-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-62-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-64-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-65-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-79-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-82-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-83-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-102-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-103-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-105-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-120-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2404-146-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2976-162-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/2976-201-0x0000000000900000-0x00000000019BA000-memory.dmp upx -
Processes:
f7638eb.exef761d50.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7638eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7638eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7638eb.exe -
Processes:
f7638eb.exef761d50.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7638eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d50.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f761d50.exef7638eb.exedescription ioc process File opened (read-only) \??\E: f761d50.exe File opened (read-only) \??\L: f761d50.exe File opened (read-only) \??\N: f761d50.exe File opened (read-only) \??\Q: f761d50.exe File opened (read-only) \??\R: f761d50.exe File opened (read-only) \??\E: f7638eb.exe File opened (read-only) \??\H: f761d50.exe File opened (read-only) \??\M: f761d50.exe File opened (read-only) \??\O: f761d50.exe File opened (read-only) \??\P: f761d50.exe File opened (read-only) \??\G: f761d50.exe File opened (read-only) \??\I: f761d50.exe File opened (read-only) \??\J: f761d50.exe File opened (read-only) \??\K: f761d50.exe File opened (read-only) \??\S: f761d50.exe -
Drops file in Windows directory 3 IoCs
Processes:
f761d50.exef7638eb.exedescription ioc process File created C:\Windows\f761d8f f761d50.exe File opened for modification C:\Windows\SYSTEM.INI f761d50.exe File created C:\Windows\f766e2e f7638eb.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f761d50.exef7638eb.exepid process 2404 f761d50.exe 2404 f761d50.exe 2976 f7638eb.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f761d50.exef7638eb.exedescription pid process Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2404 f761d50.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe Token: SeDebugPrivilege 2976 f7638eb.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef761d50.exef7638eb.exedescription pid process target process PID 2220 wrote to memory of 2248 2220 rundll32.exe rundll32.exe PID 2220 wrote to memory of 2248 2220 rundll32.exe rundll32.exe PID 2220 wrote to memory of 2248 2220 rundll32.exe rundll32.exe PID 2220 wrote to memory of 2248 2220 rundll32.exe rundll32.exe PID 2220 wrote to memory of 2248 2220 rundll32.exe rundll32.exe PID 2220 wrote to memory of 2248 2220 rundll32.exe rundll32.exe PID 2220 wrote to memory of 2248 2220 rundll32.exe rundll32.exe PID 2248 wrote to memory of 2404 2248 rundll32.exe f761d50.exe PID 2248 wrote to memory of 2404 2248 rundll32.exe f761d50.exe PID 2248 wrote to memory of 2404 2248 rundll32.exe f761d50.exe PID 2248 wrote to memory of 2404 2248 rundll32.exe f761d50.exe PID 2404 wrote to memory of 1112 2404 f761d50.exe taskhost.exe PID 2404 wrote to memory of 1172 2404 f761d50.exe Dwm.exe PID 2404 wrote to memory of 1204 2404 f761d50.exe Explorer.EXE PID 2404 wrote to memory of 1708 2404 f761d50.exe DllHost.exe PID 2404 wrote to memory of 2220 2404 f761d50.exe rundll32.exe PID 2404 wrote to memory of 2248 2404 f761d50.exe rundll32.exe PID 2404 wrote to memory of 2248 2404 f761d50.exe rundll32.exe PID 2248 wrote to memory of 2592 2248 rundll32.exe f761f05.exe PID 2248 wrote to memory of 2592 2248 rundll32.exe f761f05.exe PID 2248 wrote to memory of 2592 2248 rundll32.exe f761f05.exe PID 2248 wrote to memory of 2592 2248 rundll32.exe f761f05.exe PID 2248 wrote to memory of 2976 2248 rundll32.exe f7638eb.exe PID 2248 wrote to memory of 2976 2248 rundll32.exe f7638eb.exe PID 2248 wrote to memory of 2976 2248 rundll32.exe f7638eb.exe PID 2248 wrote to memory of 2976 2248 rundll32.exe f7638eb.exe PID 2404 wrote to memory of 1112 2404 f761d50.exe taskhost.exe PID 2404 wrote to memory of 1172 2404 f761d50.exe Dwm.exe PID 2404 wrote to memory of 1204 2404 f761d50.exe Explorer.EXE PID 2404 wrote to memory of 2592 2404 f761d50.exe f761f05.exe PID 2404 wrote to memory of 2592 2404 f761d50.exe f761f05.exe PID 2404 wrote to memory of 2976 2404 f761d50.exe f7638eb.exe PID 2404 wrote to memory of 2976 2404 f761d50.exe f7638eb.exe PID 2976 wrote to memory of 1112 2976 f7638eb.exe taskhost.exe PID 2976 wrote to memory of 1172 2976 f7638eb.exe Dwm.exe PID 2976 wrote to memory of 1204 2976 f7638eb.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f761d50.exef7638eb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7638eb.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4089861fadad9f3884fad19a89522a20_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4089861fadad9f3884fad19a89522a20_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\f761d50.exeC:\Users\Admin\AppData\Local\Temp\f761d50.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\f761f05.exeC:\Users\Admin\AppData\Local\Temp\f761f05.exe4⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\f7638eb.exeC:\Users\Admin\AppData\Local\Temp\f7638eb.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2976
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1708
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f761d50.exeFilesize
97KB
MD50ec988267cafc72e9c49fba6403b205c
SHA156eda4a0f2d975588958093c9b867efa04d099d6
SHA25696a6c9649e7c429a4a8c863243f119ed51464717655b1f12eebf3a6452a6e342
SHA512d50c6bf8ab1071412082991239e43df1f563ca95a15cb0b70fc79b1d9f9f25ce391b700c5ca329f9a8903cb8867200ee537c0275a5fd1b998eb47d0a08739681
-
C:\Windows\SYSTEM.INIFilesize
257B
MD51288acf43513f3b3f75e4cebe7feee66
SHA18589e47b5bbe64adb143c7263a17ef4d4c445211
SHA2564f1b53e48f89aa241068e4fddda136da761fbb54639a1c6c6c86d74dd131ce0b
SHA5122cab0489558da79cfa260e39d57a9280e95d6bf064e656af5ddc4f13d96cae2682cfe5075d84817aedfdaad9a047648abec8c1e6f2b0a2d60590587261cc6a3f
-
memory/1112-28-0x0000000002070000-0x0000000002072000-memory.dmpFilesize
8KB
-
memory/2248-3-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2248-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2248-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2248-38-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2248-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2248-35-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2248-36-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2248-56-0x00000000003E0000-0x00000000003F2000-memory.dmpFilesize
72KB
-
memory/2248-37-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2248-53-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2248-55-0x00000000003E0000-0x00000000003F2000-memory.dmpFilesize
72KB
-
memory/2404-58-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-79-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-54-0x0000000001810000-0x0000000001812000-memory.dmpFilesize
8KB
-
memory/2404-44-0x0000000003090000-0x0000000003091000-memory.dmpFilesize
4KB
-
memory/2404-20-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-18-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-22-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-21-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-19-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-17-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-15-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-16-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-14-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-59-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-60-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-61-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-62-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-64-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-65-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-145-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2404-12-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-46-0x0000000001810000-0x0000000001812000-memory.dmpFilesize
8KB
-
memory/2404-82-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-83-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-146-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2404-120-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-105-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-103-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2404-102-0x00000000005F0000-0x00000000016AA000-memory.dmpFilesize
16.7MB
-
memory/2592-92-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2592-93-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2592-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2592-100-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2976-98-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2976-101-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2976-99-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2976-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2976-162-0x0000000000900000-0x00000000019BA000-memory.dmpFilesize
16.7MB
-
memory/2976-201-0x0000000000900000-0x00000000019BA000-memory.dmpFilesize
16.7MB
-
memory/2976-200-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB