Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 02:07
Static task
static1
Behavioral task
behavioral1
Sample
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe
-
Size
2.5MB
-
MD5
84c494b41aa13428d40e0bfed9a0fc30
-
SHA1
bb411616bdf103b5e69b1c3dc7366b0d0ab4ec57
-
SHA256
39d08570f12ee1ade69e872d4b64c07e229c2e71cffff492e419c6c451d82ece
-
SHA512
18d7fe06400318c24e921cfcf282310297ae2bc0a13ea1ec0276d737dd4a427e5cb735002d503b3016f5aa493db64326627b4255e85f034ec8e295f43a8faebe
-
SSDEEP
49152:D0iC/rk62xWNol+5gOsLddaMXSFHXwy0t96c2Y+1f0CfQWl:6rZ23Abs5DCFHXwV+f1/Qg
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe -
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe -
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
update.exepid process 2444 update.exe -
Loads dropped DLL 5 IoCs
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exeupdate.exepid process 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe 2444 update.exe 2444 update.exe 2444 update.exe 2444 update.exe -
Processes:
resource yara_rule behavioral1/memory/2188-5-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-11-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-14-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-9-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-17-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-16-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-15-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-13-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-12-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-10-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-79-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-78-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-80-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-81-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-82-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-84-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-85-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-89-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-94-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-91-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-95-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-97-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-111-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-112-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-113-0x00000000026A0000-0x000000000375A000-memory.dmp upx behavioral1/memory/2188-140-0x00000000026A0000-0x000000000375A000-memory.dmp upx -
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe -
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\G: 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe File opened (read-only) \??\H: 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe File opened (read-only) \??\I: 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe File opened (read-only) \??\J: 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe File opened (read-only) \??\K: 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe File opened (read-only) \??\L: 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe File opened (read-only) \??\M: 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe File opened (read-only) \??\E: 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe -
Drops file in Windows directory 4 IoCs
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exeupdate.exedescription ioc process File created C:\Windows\f762e60 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe File opened for modification C:\Windows\setupapi.log update.exe File opened for modification \??\c:\windows\KB893803v2.log update.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exepid process 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Token: SeDebugPrivilege 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exedescription pid process target process PID 2188 wrote to memory of 1100 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe taskhost.exe PID 2188 wrote to memory of 1184 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Dwm.exe PID 2188 wrote to memory of 1208 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Explorer.EXE PID 2188 wrote to memory of 1728 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe DllHost.exe PID 2188 wrote to memory of 2444 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe update.exe PID 2188 wrote to memory of 2444 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe update.exe PID 2188 wrote to memory of 2444 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe update.exe PID 2188 wrote to memory of 2444 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe update.exe PID 2188 wrote to memory of 2444 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe update.exe PID 2188 wrote to memory of 2444 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe update.exe PID 2188 wrote to memory of 2444 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe update.exe PID 2188 wrote to memory of 1100 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe taskhost.exe PID 2188 wrote to memory of 1184 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Dwm.exe PID 2188 wrote to memory of 1208 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe Explorer.EXE PID 2188 wrote to memory of 2444 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe update.exe PID 2188 wrote to memory of 2444 2188 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe update.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
\??\c:\3a915c13e36a2590358919\UPDATE\update.exec:\3a915c13e36a2590358919\UPDATE\update.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0F762FE6_Rar\84c494b41aa13428d40e0bfed9a0fc30_NeikiAnalytics.exeFilesize
2.5MB
MD5ffd49c51dde6fde37c9949bc6de0ef46
SHA1608678149fddbbce29c7c706bd5e765b9bf524ff
SHA2562a6c1f66899b28039f44becc17331be6be614e746c767cc8f628e32f1bdeda78
SHA5122098255505a0ac5af201d4e7b8dba0beafe300c6099e49174f1f6d7710af4ad4730dace9157b3b50567ac28585fadf61ba6158997e9a77d8953b28834ee0dcf9
-
\3a915c13e36a2590358919\update\update.exeFilesize
701KB
MD53b5eaaedb8a9d3f98debbdb0cfd214d5
SHA1c9e09f6f6026f928d3d6d9056af868df83bd44ef
SHA2562e2e9f1ea41d8673bcf69c8c97fc16c22932e2b7807fc87c556516261ea33d99
SHA51226dbaefdedf9ba0094714f65d78b7c68fefc6afbd937cb0322ac698cbf3d104c4ccfbfb671314d6ea98bce2b0c090e2d4a19441d1abc2acb6b143e05818c2b75
-
\??\c:\3a915c13e36a2590358919\UPDATE\UPDSPAPI.dllFilesize
363KB
MD5ebdb17c673b090a949f17c9e6486aaf3
SHA12231731f56f803662e0f1d537b22cba7625ef433
SHA256f484cf06e20996e1887b4304b33444f3ee1c03fb912f5ec8d5327c4074a97abb
SHA512b05b2e548c507c2bce556acd43174c2a2743d46ba816896e97a475089237020208c710e25aa204aee40be36cc3c8480da0dc6c383cadf2c619268b48f5e8fe40
-
\??\c:\3a915c13e36a2590358919\update\update_win2k.infFilesize
26KB
MD54c6a798a95a882a006b0ce07cbe3a7bc
SHA121db93cb321d99b3998948dca1bd612e8d807623
SHA2567b3285c291d9d9a9891cb831c2af3b26bcd52d33a5fcf78aa9f91c534a9b292a
SHA5128e12fc965e7ae736fa4e75f8244ad52754a2f9e77a856a80a1eb4846e05d60b9b44faafade78ee7a581ba38b9e66636765cf1f8040e34cae845586ae9dd42004
-
\??\c:\3a915c13e36a2590358919\update\updatebr.infFilesize
287B
MD57338506092eba55bd27963ad322cfeae
SHA10d80de1a2e27128d27bc12c5f9f7a938ef8cb817
SHA256c5b64cce66182b9f35b670be6620dabd2f42ee3c8892eb9ef69bc75b52e5ee81
SHA512bd4632d18b78b5742d428e6acb6a6b6196649cf323f7f4f4eb8d12cdbf4e9a358c93637ea2556cef83fa8e188e1ef1696743b6a25cd0feea5520bf924aa24eca
-
memory/1100-23-0x0000000000410000-0x0000000000412000-memory.dmpFilesize
8KB
-
memory/2188-155-0x0000000001000000-0x000000000129A000-memory.dmpFilesize
2.6MB
-
memory/2188-15-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-16-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-7-0x0000000001000000-0x000000000129A000-memory.dmpFilesize
2.6MB
-
memory/2188-13-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-12-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-14-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-38-0x0000000001000000-0x000000000129A000-memory.dmpFilesize
2.6MB
-
memory/2188-35-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB
-
memory/2188-34-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2188-32-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2188-31-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB
-
memory/2188-9-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-10-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-6-0x0000000001002000-0x0000000001003000-memory.dmpFilesize
4KB
-
memory/2188-11-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-5-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-1-0x0000000000960000-0x0000000000BFA000-memory.dmpFilesize
2.6MB
-
memory/2188-0-0x0000000001000000-0x000000000129A000-memory.dmpFilesize
2.6MB
-
memory/2188-140-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-78-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-79-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-80-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-81-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-82-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-84-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-85-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-89-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-94-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-91-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-95-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-97-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-17-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-137-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB
-
memory/2188-113-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-111-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2188-112-0x00000000026A0000-0x000000000375A000-memory.dmpFilesize
16.7MB
-
memory/2444-109-0x0000000001000000-0x000000000112C000-memory.dmpFilesize
1.2MB
-
memory/2444-116-0x0000000000450000-0x0000000000452000-memory.dmpFilesize
8KB
-
memory/2444-119-0x0000000001000000-0x000000000112C000-memory.dmpFilesize
1.2MB
-
memory/2444-107-0x0000000000460000-0x0000000000461000-memory.dmpFilesize
4KB
-
memory/2444-108-0x0000000000450000-0x0000000000452000-memory.dmpFilesize
8KB
-
memory/2444-75-0x0000000000220000-0x000000000027C000-memory.dmpFilesize
368KB