Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 03:31
Static task
static1
Behavioral task
behavioral1
Sample
99d3b9d3f97f1e0af1dd1d1e4ae5bdb0_NeikiAnalytics.dll
Resource
win7-20240220-en
General
-
Target
99d3b9d3f97f1e0af1dd1d1e4ae5bdb0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
99d3b9d3f97f1e0af1dd1d1e4ae5bdb0
-
SHA1
0d249d14cd44f1c7ddfe2fa62da876b1cf8061c5
-
SHA256
a72c4699fc3b7eac096dfc49cd89f7319838ff268fc554da231126fad77bdedb
-
SHA512
c74c72d35203024f18b643e9e6e40995fa7b5a2c48115ef1f679bd451713d425502159f14ee405004b50ea6d82718a8ac22435899414869552f59d73592d8b80
-
SSDEEP
1536:lrCTagNIaz7khu0y6YfQ7BU+BNxiX9VVMg7bln/8n79D9mGtAysjSPWj:le1R7khuvfQBtkVG6bF/4DntejgWj
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f762ae7.exef760f4c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f760f4c.exe -
Processes:
f760f4c.exef762ae7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762ae7.exe -
Processes:
f762ae7.exef760f4c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762ae7.exe -
Executes dropped EXE 3 IoCs
Processes:
f760f4c.exef7610f2.exef762ae7.exepid process 1508 f760f4c.exe 2564 f7610f2.exe 2060 f762ae7.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1508-17-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-14-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-21-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-20-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-18-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-16-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-15-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-23-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-22-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-19-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-63-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-62-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-64-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-66-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-65-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-68-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-69-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-84-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-85-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-88-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-89-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-90-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1508-152-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2060-170-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/2060-205-0x0000000000900000-0x00000000019BA000-memory.dmp upx -
Processes:
f760f4c.exef762ae7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762ae7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760f4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762ae7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760f4c.exe -
Processes:
f760f4c.exef762ae7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762ae7.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f760f4c.exef762ae7.exedescription ioc process File opened (read-only) \??\E: f760f4c.exe File opened (read-only) \??\J: f760f4c.exe File opened (read-only) \??\Q: f760f4c.exe File opened (read-only) \??\L: f760f4c.exe File opened (read-only) \??\N: f760f4c.exe File opened (read-only) \??\P: f760f4c.exe File opened (read-only) \??\S: f760f4c.exe File opened (read-only) \??\E: f762ae7.exe File opened (read-only) \??\G: f760f4c.exe File opened (read-only) \??\I: f760f4c.exe File opened (read-only) \??\O: f760f4c.exe File opened (read-only) \??\R: f760f4c.exe File opened (read-only) \??\T: f760f4c.exe File opened (read-only) \??\H: f760f4c.exe File opened (read-only) \??\K: f760f4c.exe File opened (read-only) \??\M: f760f4c.exe -
Drops file in Windows directory 3 IoCs
Processes:
f760f4c.exef762ae7.exedescription ioc process File created C:\Windows\f760f8b f760f4c.exe File opened for modification C:\Windows\SYSTEM.INI f760f4c.exe File created C:\Windows\f766133 f762ae7.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f760f4c.exef762ae7.exepid process 1508 f760f4c.exe 1508 f760f4c.exe 2060 f762ae7.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f760f4c.exef762ae7.exedescription pid process Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 1508 f760f4c.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe Token: SeDebugPrivilege 2060 f762ae7.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef760f4c.exef762ae7.exedescription pid process target process PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 1204 wrote to memory of 1508 1204 rundll32.exe f760f4c.exe PID 1204 wrote to memory of 1508 1204 rundll32.exe f760f4c.exe PID 1204 wrote to memory of 1508 1204 rundll32.exe f760f4c.exe PID 1204 wrote to memory of 1508 1204 rundll32.exe f760f4c.exe PID 1508 wrote to memory of 1120 1508 f760f4c.exe taskhost.exe PID 1508 wrote to memory of 1180 1508 f760f4c.exe Dwm.exe PID 1508 wrote to memory of 1224 1508 f760f4c.exe Explorer.EXE PID 1508 wrote to memory of 1008 1508 f760f4c.exe DllHost.exe PID 1508 wrote to memory of 2368 1508 f760f4c.exe rundll32.exe PID 1508 wrote to memory of 1204 1508 f760f4c.exe rundll32.exe PID 1508 wrote to memory of 1204 1508 f760f4c.exe rundll32.exe PID 1204 wrote to memory of 2564 1204 rundll32.exe f7610f2.exe PID 1204 wrote to memory of 2564 1204 rundll32.exe f7610f2.exe PID 1204 wrote to memory of 2564 1204 rundll32.exe f7610f2.exe PID 1204 wrote to memory of 2564 1204 rundll32.exe f7610f2.exe PID 1204 wrote to memory of 2060 1204 rundll32.exe f762ae7.exe PID 1204 wrote to memory of 2060 1204 rundll32.exe f762ae7.exe PID 1204 wrote to memory of 2060 1204 rundll32.exe f762ae7.exe PID 1204 wrote to memory of 2060 1204 rundll32.exe f762ae7.exe PID 1508 wrote to memory of 1120 1508 f760f4c.exe taskhost.exe PID 1508 wrote to memory of 1180 1508 f760f4c.exe Dwm.exe PID 1508 wrote to memory of 1224 1508 f760f4c.exe Explorer.EXE PID 1508 wrote to memory of 2564 1508 f760f4c.exe f7610f2.exe PID 1508 wrote to memory of 2564 1508 f760f4c.exe f7610f2.exe PID 1508 wrote to memory of 2060 1508 f760f4c.exe f762ae7.exe PID 1508 wrote to memory of 2060 1508 f760f4c.exe f762ae7.exe PID 2060 wrote to memory of 1120 2060 f762ae7.exe taskhost.exe PID 2060 wrote to memory of 1180 2060 f762ae7.exe Dwm.exe PID 2060 wrote to memory of 1224 2060 f762ae7.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f760f4c.exef762ae7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760f4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762ae7.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\99d3b9d3f97f1e0af1dd1d1e4ae5bdb0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\99d3b9d3f97f1e0af1dd1d1e4ae5bdb0_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f760f4c.exeC:\Users\Admin\AppData\Local\Temp\f760f4c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f7610f2.exeC:\Users\Admin\AppData\Local\Temp\f7610f2.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f762ae7.exeC:\Users\Admin\AppData\Local\Temp\f762ae7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5ec065997b770f85fd20c8679e35e8894
SHA144dc3c43dcdb5da5f5fd4eca48ab91fa6fbb69e5
SHA2563994de6d60586a578bb3bd0193b1ddf8d4b374b34d662b97d8d5fb9fed1ef6cc
SHA5125bbc16e7bebd7cd1bc2acced61913bf765fa0e6114444d45638e9a22a544f0ddffc3ab75a1cde5d9e87a789a3b2c874cef9525bcedc52985e2d4373a5aee8299
-
\Users\Admin\AppData\Local\Temp\f760f4c.exeFilesize
97KB
MD54015d01e867de192cd7121f087a0ad2c
SHA16e09432af4d03ec692035f6f478e6544bdac3df3
SHA25611603d0e4b078954eeda79c407f8c0981737c7d6663115c98feb051a68385e8c
SHA512398c693aa9052781bb71dec4d2290dbbd70b5dcae0b144e6e15c50d40bf612c38d951e94d0c1c13e6984499bf6861198ca084a185d21c97e9b629b7c2f096f9d
-
memory/1120-24-0x0000000000410000-0x0000000000412000-memory.dmpFilesize
8KB
-
memory/1204-37-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1204-39-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1204-47-0x00000000001E0000-0x00000000001F2000-memory.dmpFilesize
72KB
-
memory/1204-33-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1204-9-0x00000000000C0000-0x00000000000D2000-memory.dmpFilesize
72KB
-
memory/1204-81-0x00000000000C0000-0x00000000000C2000-memory.dmpFilesize
8KB
-
memory/1204-77-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1204-10-0x00000000000C0000-0x00000000000D2000-memory.dmpFilesize
72KB
-
memory/1204-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1204-36-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1204-34-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1508-62-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-65-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-18-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-16-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-15-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-23-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-22-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-19-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-60-0x00000000004A0000-0x00000000004A2000-memory.dmpFilesize
8KB
-
memory/1508-59-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/1508-61-0x00000000004A0000-0x00000000004A2000-memory.dmpFilesize
8KB
-
memory/1508-63-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-21-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-64-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-66-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-129-0x00000000004A0000-0x00000000004A2000-memory.dmpFilesize
8KB
-
memory/1508-68-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-69-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-14-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-20-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-17-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-84-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-85-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-88-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-89-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-90-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1508-152-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/1508-153-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2060-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2060-109-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2060-110-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2060-170-0x0000000000900000-0x00000000019BA000-memory.dmpFilesize
16.7MB
-
memory/2060-204-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2060-205-0x0000000000900000-0x00000000019BA000-memory.dmpFilesize
16.7MB
-
memory/2564-108-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2564-99-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2564-100-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2564-48-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB