Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 08:53
Static task
static1
Behavioral task
behavioral1
Sample
e2e11467890191bfc68f277311b05c20_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
e2e11467890191bfc68f277311b05c20_NeikiAnalytics.dll
-
Size
120KB
-
MD5
e2e11467890191bfc68f277311b05c20
-
SHA1
62c82caca124b7d81e59fc1c198e2444f26ec1e4
-
SHA256
923da3d503c245d8a7d8632b1c092e060795e34c48e6571a29f84fd3cf5ef728
-
SHA512
51e8b3d3e7f50b1c7be24cbd1a225fa3ee5cda28464973f695c6b8fecdbe32c6b36365f9b72c5bbc134cf684c88fa3421ef2a6dd0891b45d5319d216447daddd
-
SSDEEP
1536:ZxviAkkbVcbTfNXPWgb/euYj+TxW3TWNG8iUMlAaksEpX95oCNgl9Daj+bYVV9k:7lnwRPjo+T03TMGgVD/2Cw9Ds
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f761268.exef762e41.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761268.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761268.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762e41.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762e41.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762e41.exe -
Processes:
f761268.exef762e41.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762e41.exe -
Processes:
f762e41.exef761268.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761268.exe -
Executes dropped EXE 3 IoCs
Processes:
f761268.exef7614e8.exef762e41.exepid process 2944 f761268.exe 2668 f7614e8.exe 1260 f762e41.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe 1952 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2944-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-23-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-22-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-62-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-61-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-64-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-67-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-68-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-81-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-84-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-85-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-87-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-88-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2944-146-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1260-164-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/1260-200-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f762e41.exef761268.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762e41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762e41.exe -
Processes:
f761268.exef762e41.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761268.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762e41.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f761268.exef762e41.exedescription ioc process File opened (read-only) \??\H: f761268.exe File opened (read-only) \??\M: f761268.exe File opened (read-only) \??\O: f761268.exe File opened (read-only) \??\P: f761268.exe File opened (read-only) \??\G: f761268.exe File opened (read-only) \??\I: f761268.exe File opened (read-only) \??\K: f761268.exe File opened (read-only) \??\L: f761268.exe File opened (read-only) \??\N: f761268.exe File opened (read-only) \??\S: f761268.exe File opened (read-only) \??\T: f761268.exe File opened (read-only) \??\E: f761268.exe File opened (read-only) \??\J: f761268.exe File opened (read-only) \??\Q: f761268.exe File opened (read-only) \??\E: f762e41.exe File opened (read-only) \??\R: f761268.exe -
Drops file in Windows directory 3 IoCs
Processes:
f762e41.exef761268.exedescription ioc process File created C:\Windows\f766410 f762e41.exe File created C:\Windows\f7612c6 f761268.exe File opened for modification C:\Windows\SYSTEM.INI f761268.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f761268.exef762e41.exepid process 2944 f761268.exe 2944 f761268.exe 1260 f762e41.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f761268.exef762e41.exedescription pid process Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 2944 f761268.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe Token: SeDebugPrivilege 1260 f762e41.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef761268.exef762e41.exedescription pid process target process PID 2880 wrote to memory of 1952 2880 rundll32.exe rundll32.exe PID 2880 wrote to memory of 1952 2880 rundll32.exe rundll32.exe PID 2880 wrote to memory of 1952 2880 rundll32.exe rundll32.exe PID 2880 wrote to memory of 1952 2880 rundll32.exe rundll32.exe PID 2880 wrote to memory of 1952 2880 rundll32.exe rundll32.exe PID 2880 wrote to memory of 1952 2880 rundll32.exe rundll32.exe PID 2880 wrote to memory of 1952 2880 rundll32.exe rundll32.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe f761268.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe f761268.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe f761268.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe f761268.exe PID 2944 wrote to memory of 1112 2944 f761268.exe taskhost.exe PID 2944 wrote to memory of 1176 2944 f761268.exe Dwm.exe PID 2944 wrote to memory of 1204 2944 f761268.exe Explorer.EXE PID 2944 wrote to memory of 308 2944 f761268.exe DllHost.exe PID 2944 wrote to memory of 2880 2944 f761268.exe rundll32.exe PID 2944 wrote to memory of 1952 2944 f761268.exe rundll32.exe PID 2944 wrote to memory of 1952 2944 f761268.exe rundll32.exe PID 1952 wrote to memory of 2668 1952 rundll32.exe f7614e8.exe PID 1952 wrote to memory of 2668 1952 rundll32.exe f7614e8.exe PID 1952 wrote to memory of 2668 1952 rundll32.exe f7614e8.exe PID 1952 wrote to memory of 2668 1952 rundll32.exe f7614e8.exe PID 1952 wrote to memory of 1260 1952 rundll32.exe f762e41.exe PID 1952 wrote to memory of 1260 1952 rundll32.exe f762e41.exe PID 1952 wrote to memory of 1260 1952 rundll32.exe f762e41.exe PID 1952 wrote to memory of 1260 1952 rundll32.exe f762e41.exe PID 2944 wrote to memory of 1112 2944 f761268.exe taskhost.exe PID 2944 wrote to memory of 1176 2944 f761268.exe Dwm.exe PID 2944 wrote to memory of 1204 2944 f761268.exe Explorer.EXE PID 2944 wrote to memory of 2668 2944 f761268.exe f7614e8.exe PID 2944 wrote to memory of 2668 2944 f761268.exe f7614e8.exe PID 2944 wrote to memory of 1260 2944 f761268.exe f762e41.exe PID 2944 wrote to memory of 1260 2944 f761268.exe f762e41.exe PID 1260 wrote to memory of 1112 1260 f762e41.exe taskhost.exe PID 1260 wrote to memory of 1176 1260 f762e41.exe Dwm.exe PID 1260 wrote to memory of 1204 1260 f762e41.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f762e41.exef761268.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762e41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761268.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2e11467890191bfc68f277311b05c20_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2e11467890191bfc68f277311b05c20_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f761268.exeC:\Users\Admin\AppData\Local\Temp\f761268.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f7614e8.exeC:\Users\Admin\AppData\Local\Temp\f7614e8.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f762e41.exeC:\Users\Admin\AppData\Local\Temp\f762e41.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD532f71b6365f0ba62666218f97dd90f42
SHA1037cea30e7584e71a5e0634775251dc5bbd8e064
SHA256b8e195d2a2d45ee5370d9f3a12fd8461fabd97ead260bd83f2fa150795f3c254
SHA512181c5b096c7ef1fe2772eba51604f5840eb3b4cee25f0ebb6d6ae25f8b821f23da9ffe7a30cf97f8d190c724fa2444492846c8e0f795caf5e0a7a83cac176c23
-
\Users\Admin\AppData\Local\Temp\f761268.exeFilesize
97KB
MD5aebf96f694cb30844e3bc9f6a7e9cf38
SHA16854be4420884213309fc17eee6ddab59c1bc015
SHA256dededbbedaf21707bb5408f59f8f65ee564aa7750c4170b8f1ac316c457b8018
SHA5125f897dae5ba0dc43732ba902f440ce3aaa880c2eefcad289f617cad3ffbbe657d87b59743b66e03ea14cf50d6f1b12cdb18636f45b552777e588513454ad8ab0
-
memory/1112-29-0x0000000001F50000-0x0000000001F52000-memory.dmpFilesize
8KB
-
memory/1260-104-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/1260-201-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1260-102-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/1260-101-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1260-200-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/1260-164-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/1260-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1952-9-0x0000000000160000-0x0000000000172000-memory.dmpFilesize
72KB
-
memory/1952-57-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB
-
memory/1952-41-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB
-
memory/1952-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1952-59-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/1952-40-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1952-38-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1952-37-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB
-
memory/1952-10-0x0000000000160000-0x0000000000172000-memory.dmpFilesize
72KB
-
memory/2668-96-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2668-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2668-95-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2668-103-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2668-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2944-15-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-87-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-62-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-61-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-63-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-64-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-65-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-67-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-68-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-49-0x0000000003B90000-0x0000000003B92000-memory.dmpFilesize
8KB
-
memory/2944-81-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-84-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-85-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-47-0x0000000004230000-0x0000000004231000-memory.dmpFilesize
4KB
-
memory/2944-88-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-58-0x0000000003B90000-0x0000000003B92000-memory.dmpFilesize
8KB
-
memory/2944-22-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-17-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-19-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-21-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-14-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-145-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2944-146-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-18-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-20-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-23-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-16-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2944-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB