Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 02:51
Static task
static1
Behavioral task
behavioral1
Sample
8ff67929e46a15f64fc0e27cdfba6920_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
8ff67929e46a15f64fc0e27cdfba6920_NeikiAnalytics.dll
-
Size
120KB
-
MD5
8ff67929e46a15f64fc0e27cdfba6920
-
SHA1
312b802657d5214e37a63c7d5d5305d15432b3da
-
SHA256
bfdf454da76a7a7d3e7fa6743867668c7862b53fff6f67f3adc82fcd14406d98
-
SHA512
ae35ddb9809d19af839636b9bf08b67fade445456c6946c5676cc6741595fe5280749e39513e0f48f433c97da0c149255c49eb143b037dd3b178af7a75c5b06c
-
SSDEEP
3072:kXLY9+q+jwOMe9Xk4imY/b38blC+Kvmh7S:kYb2My8/b8bleOh7S
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f7611fb.exef763765.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763765.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763765.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763765.exe -
Processes:
f7611fb.exef763765.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763765.exe -
Processes:
f7611fb.exef763765.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763765.exe -
Executes dropped EXE 3 IoCs
Processes:
f7611fb.exef761390.exef763765.exepid process 2064 f7611fb.exe 3000 f761390.exe 1348 f763765.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2168 rundll32.exe 2168 rundll32.exe 2168 rundll32.exe 2168 rundll32.exe 2168 rundll32.exe 2168 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2064-18-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-15-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-14-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-19-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-17-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-23-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-22-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-20-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-16-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-21-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-64-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-65-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-66-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-67-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-68-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-70-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-85-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-104-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-108-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-110-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2064-147-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1348-172-0x0000000000970000-0x0000000001A2A000-memory.dmp upx behavioral1/memory/1348-207-0x0000000000970000-0x0000000001A2A000-memory.dmp upx -
Processes:
f7611fb.exef763765.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7611fb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763765.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7611fb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763765.exe -
Processes:
f7611fb.exef763765.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763765.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7611fb.exef763765.exedescription ioc process File opened (read-only) \??\G: f7611fb.exe File opened (read-only) \??\K: f7611fb.exe File opened (read-only) \??\L: f7611fb.exe File opened (read-only) \??\E: f763765.exe File opened (read-only) \??\J: f7611fb.exe File opened (read-only) \??\O: f7611fb.exe File opened (read-only) \??\P: f7611fb.exe File opened (read-only) \??\G: f763765.exe File opened (read-only) \??\M: f7611fb.exe File opened (read-only) \??\H: f763765.exe File opened (read-only) \??\I: f763765.exe File opened (read-only) \??\E: f7611fb.exe File opened (read-only) \??\H: f7611fb.exe File opened (read-only) \??\I: f7611fb.exe File opened (read-only) \??\N: f7611fb.exe -
Drops file in Windows directory 3 IoCs
Processes:
f7611fb.exef763765.exedescription ioc process File created C:\Windows\f761249 f7611fb.exe File opened for modification C:\Windows\SYSTEM.INI f7611fb.exe File created C:\Windows\f7662e8 f763765.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f7611fb.exef763765.exepid process 2064 f7611fb.exe 2064 f7611fb.exe 1348 f763765.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f7611fb.exef763765.exedescription pid process Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 2064 f7611fb.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe Token: SeDebugPrivilege 1348 f763765.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef7611fb.exef763765.exedescription pid process target process PID 1728 wrote to memory of 2168 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 2168 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 2168 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 2168 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 2168 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 2168 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 2168 1728 rundll32.exe rundll32.exe PID 2168 wrote to memory of 2064 2168 rundll32.exe f7611fb.exe PID 2168 wrote to memory of 2064 2168 rundll32.exe f7611fb.exe PID 2168 wrote to memory of 2064 2168 rundll32.exe f7611fb.exe PID 2168 wrote to memory of 2064 2168 rundll32.exe f7611fb.exe PID 2064 wrote to memory of 1052 2064 f7611fb.exe taskhost.exe PID 2064 wrote to memory of 1124 2064 f7611fb.exe Dwm.exe PID 2064 wrote to memory of 1180 2064 f7611fb.exe Explorer.EXE PID 2064 wrote to memory of 1740 2064 f7611fb.exe DllHost.exe PID 2064 wrote to memory of 1728 2064 f7611fb.exe rundll32.exe PID 2064 wrote to memory of 2168 2064 f7611fb.exe rundll32.exe PID 2064 wrote to memory of 2168 2064 f7611fb.exe rundll32.exe PID 2168 wrote to memory of 3000 2168 rundll32.exe f761390.exe PID 2168 wrote to memory of 3000 2168 rundll32.exe f761390.exe PID 2168 wrote to memory of 3000 2168 rundll32.exe f761390.exe PID 2168 wrote to memory of 3000 2168 rundll32.exe f761390.exe PID 2168 wrote to memory of 1348 2168 rundll32.exe f763765.exe PID 2168 wrote to memory of 1348 2168 rundll32.exe f763765.exe PID 2168 wrote to memory of 1348 2168 rundll32.exe f763765.exe PID 2168 wrote to memory of 1348 2168 rundll32.exe f763765.exe PID 2064 wrote to memory of 1052 2064 f7611fb.exe taskhost.exe PID 2064 wrote to memory of 1124 2064 f7611fb.exe Dwm.exe PID 2064 wrote to memory of 1180 2064 f7611fb.exe Explorer.EXE PID 2064 wrote to memory of 3000 2064 f7611fb.exe f761390.exe PID 2064 wrote to memory of 3000 2064 f7611fb.exe f761390.exe PID 2064 wrote to memory of 1348 2064 f7611fb.exe f763765.exe PID 2064 wrote to memory of 1348 2064 f7611fb.exe f763765.exe PID 1348 wrote to memory of 1052 1348 f763765.exe taskhost.exe PID 1348 wrote to memory of 1124 1348 f763765.exe Dwm.exe PID 1348 wrote to memory of 1180 1348 f763765.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f7611fb.exef763765.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7611fb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763765.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ff67929e46a15f64fc0e27cdfba6920_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ff67929e46a15f64fc0e27cdfba6920_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7611fb.exeC:\Users\Admin\AppData\Local\Temp\f7611fb.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f761390.exeC:\Users\Admin\AppData\Local\Temp\f761390.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f763765.exeC:\Users\Admin\AppData\Local\Temp\f763765.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD55b0f8d2eb37435c54a5211b156ab8529
SHA1fdc3f57987925c8b2d9d602a45c9920ab6cdefb8
SHA256d16b57e5f5a3878ded0e5768a0465acc9d0033a77259a40d1f83b8aa04246ea4
SHA5129533b241b393a08af0bec4472e1caf63eca7cc914c02213ed7cf5e5726b343756db87f9bed32b937d7332af53da73aae0e18ca69363de2c141a4da28f1ba7b3c
-
\Users\Admin\AppData\Local\Temp\f7611fb.exeFilesize
97KB
MD5278884790aabd3eb232089eeaaad9e90
SHA15ae731393291452fcb56b6d81a58042a2a6104d8
SHA256d8b7db83000bb2a4a7a9372e4d8fb698c31dce6df8e7349db73fc71d6406f3ba
SHA512a1134f383a0caa85b7b3f4b32629158390e289e0e1063422084730d7cda2338b931bc39e221f0593579ac05e4ff129d4170b142258dfc0eb0bfc4bbca94e4c12
-
memory/1052-29-0x0000000002030000-0x0000000002032000-memory.dmpFilesize
8KB
-
memory/1348-207-0x0000000000970000-0x0000000001A2A000-memory.dmpFilesize
16.7MB
-
memory/1348-206-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1348-172-0x0000000000970000-0x0000000001A2A000-memory.dmpFilesize
16.7MB
-
memory/1348-105-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1348-101-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1348-103-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1348-84-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2064-65-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-70-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2064-51-0x0000000000330000-0x0000000000332000-memory.dmpFilesize
8KB
-
memory/2064-22-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-18-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-147-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-148-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2064-60-0x0000000000330000-0x0000000000332000-memory.dmpFilesize
8KB
-
memory/2064-122-0x0000000000330000-0x0000000000332000-memory.dmpFilesize
8KB
-
memory/2064-20-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-16-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-110-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-21-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-49-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/2064-108-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-64-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-15-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-66-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-67-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-68-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-23-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-17-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-104-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-14-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-19-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2064-85-0x00000000006B0000-0x000000000176A000-memory.dmpFilesize
16.7MB
-
memory/2168-58-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2168-80-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2168-10-0x0000000000180000-0x0000000000192000-memory.dmpFilesize
72KB
-
memory/2168-38-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2168-39-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2168-82-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB
-
memory/2168-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2168-61-0x0000000000230000-0x0000000000242000-memory.dmpFilesize
72KB
-
memory/2168-79-0x0000000000420000-0x0000000000432000-memory.dmpFilesize
72KB
-
memory/2168-9-0x0000000000180000-0x0000000000192000-memory.dmpFilesize
72KB
-
memory/2168-48-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2168-62-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/3000-152-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3000-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3000-95-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/3000-102-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/3000-96-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB