Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 18:59
Static task
static1
Behavioral task
behavioral1
Sample
19ffaf791aa6e33bac356d6245e7f680_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
19ffaf791aa6e33bac356d6245e7f680_NeikiAnalytics.dll
-
Size
120KB
-
MD5
19ffaf791aa6e33bac356d6245e7f680
-
SHA1
b65490b77e174fdaf37321750de44719de3dd5df
-
SHA256
78a18a2d1ed4460c7c1cddfd81d023691d1fd1f57069eb605c765071ec17ba67
-
SHA512
c9796f2411a5511b676079fa1236e90565a33e7c0bd2e3a3f2dba463685eb127b84a1f306562261f172922df93713d11c6ad444d975554b3b686f33d441da0e0
-
SSDEEP
1536:ivkltltUCsdydraA0pHGErBzNbea6R5LH2uvIvES+avbuO+/TiQWFjYf4GO:QkhtURygXHpBzNbeFydEgeiQWFj5G
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f769e23.exef769b07.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769b07.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769b07.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769e23.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769e23.exe -
Processes:
f769b07.exef769e23.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769e23.exe -
Processes:
f769b07.exef769e23.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769e23.exe -
Executes dropped EXE 3 IoCs
Processes:
f769b07.exef769e23.exef76b683.exepid process 2884 f769b07.exe 2384 f769e23.exe 2960 f76b683.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2832 rundll32.exe 2832 rundll32.exe 2832 rundll32.exe 2832 rundll32.exe 2832 rundll32.exe 2832 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2884-22-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-14-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-18-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-15-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-13-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-20-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-16-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-19-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-21-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-17-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-60-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-61-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-62-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-63-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-64-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-66-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-79-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-80-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-83-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-85-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-101-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-104-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-106-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2884-144-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2384-156-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx behavioral1/memory/2384-169-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx -
Processes:
f769b07.exef769e23.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769b07.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769e23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769e23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769e23.exe -
Processes:
f769b07.exef769e23.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769e23.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f769b07.exedescription ioc process File opened (read-only) \??\H: f769b07.exe File opened (read-only) \??\K: f769b07.exe File opened (read-only) \??\O: f769b07.exe File opened (read-only) \??\R: f769b07.exe File opened (read-only) \??\P: f769b07.exe File opened (read-only) \??\Q: f769b07.exe File opened (read-only) \??\S: f769b07.exe File opened (read-only) \??\E: f769b07.exe File opened (read-only) \??\I: f769b07.exe File opened (read-only) \??\J: f769b07.exe File opened (read-only) \??\M: f769b07.exe File opened (read-only) \??\G: f769b07.exe File opened (read-only) \??\L: f769b07.exe File opened (read-only) \??\N: f769b07.exe -
Drops file in Windows directory 3 IoCs
Processes:
f769b07.exef769e23.exedescription ioc process File created C:\Windows\f769be2 f769b07.exe File opened for modification C:\Windows\SYSTEM.INI f769b07.exe File created C:\Windows\f76ec81 f769e23.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f769b07.exepid process 2884 f769b07.exe 2884 f769b07.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f769b07.exedescription pid process Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe Token: SeDebugPrivilege 2884 f769b07.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef769b07.exedescription pid process target process PID 2648 wrote to memory of 2832 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2832 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2832 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2832 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2832 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2832 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2832 2648 rundll32.exe rundll32.exe PID 2832 wrote to memory of 2884 2832 rundll32.exe f769b07.exe PID 2832 wrote to memory of 2884 2832 rundll32.exe f769b07.exe PID 2832 wrote to memory of 2884 2832 rundll32.exe f769b07.exe PID 2832 wrote to memory of 2884 2832 rundll32.exe f769b07.exe PID 2884 wrote to memory of 1132 2884 f769b07.exe taskhost.exe PID 2884 wrote to memory of 1236 2884 f769b07.exe Dwm.exe PID 2884 wrote to memory of 1324 2884 f769b07.exe Explorer.EXE PID 2884 wrote to memory of 2288 2884 f769b07.exe DllHost.exe PID 2884 wrote to memory of 2648 2884 f769b07.exe rundll32.exe PID 2884 wrote to memory of 2832 2884 f769b07.exe rundll32.exe PID 2884 wrote to memory of 2832 2884 f769b07.exe rundll32.exe PID 2832 wrote to memory of 2384 2832 rundll32.exe f769e23.exe PID 2832 wrote to memory of 2384 2832 rundll32.exe f769e23.exe PID 2832 wrote to memory of 2384 2832 rundll32.exe f769e23.exe PID 2832 wrote to memory of 2384 2832 rundll32.exe f769e23.exe PID 2832 wrote to memory of 2960 2832 rundll32.exe f76b683.exe PID 2832 wrote to memory of 2960 2832 rundll32.exe f76b683.exe PID 2832 wrote to memory of 2960 2832 rundll32.exe f76b683.exe PID 2832 wrote to memory of 2960 2832 rundll32.exe f76b683.exe PID 2884 wrote to memory of 1132 2884 f769b07.exe taskhost.exe PID 2884 wrote to memory of 1236 2884 f769b07.exe Dwm.exe PID 2884 wrote to memory of 1324 2884 f769b07.exe Explorer.EXE PID 2884 wrote to memory of 2384 2884 f769b07.exe f769e23.exe PID 2884 wrote to memory of 2384 2884 f769b07.exe f769e23.exe PID 2884 wrote to memory of 2960 2884 f769b07.exe f76b683.exe PID 2884 wrote to memory of 2960 2884 f769b07.exe f76b683.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
f769b07.exef769e23.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769b07.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769e23.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19ffaf791aa6e33bac356d6245e7f680_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19ffaf791aa6e33bac356d6245e7f680_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f769b07.exeC:\Users\Admin\AppData\Local\Temp\f769b07.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f769e23.exeC:\Users\Admin\AppData\Local\Temp\f769e23.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76b683.exeC:\Users\Admin\AppData\Local\Temp\f76b683.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5ae7091d8a2600ef237cd918d6c627407
SHA137c3e91efa402054a3f39840ac656ec4812b591b
SHA25696292804eb592d1b6769ee96d3a53c1e47377e6b0f2fed061f69382934a65253
SHA5121a8ab2cb787d8a2dd881dc4a045669c4788561220c1cd083a20d137b03fbd10bb0eca9b7a99bac1db57a89c571bd6f8c8cf53035155274c3112cbe1fe3e28485
-
\Users\Admin\AppData\Local\Temp\f769b07.exeFilesize
97KB
MD50a33845e85940ad475238e35384ae385
SHA16950ffdc59b7cd988a8cf0eaf7c705dbf7daa69f
SHA256dfe5ff1b1e3bb0d351e244808aaae89d3322d00e006070ac71d5bb92efa3152b
SHA512c631c67d6178fc0fbbd29b7a9d6198938574b96528b82fa56fe088763e3bbb253a3e0d1b83847cf40f4cbe40c4ff9d068da4189301975a7600093081614963ce
-
memory/1132-28-0x0000000001D20000-0x0000000001D22000-memory.dmpFilesize
8KB
-
memory/2384-169-0x0000000000A60000-0x0000000001B1A000-memory.dmpFilesize
16.7MB
-
memory/2384-170-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2384-156-0x0000000000A60000-0x0000000001B1A000-memory.dmpFilesize
16.7MB
-
memory/2384-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2384-92-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2384-93-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2384-99-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2832-35-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2832-36-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2832-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2832-45-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2832-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2832-55-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2832-58-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2832-74-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2884-48-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2884-85-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-19-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-20-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-21-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-17-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-60-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-61-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-62-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-63-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-64-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-66-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2884-13-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-79-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-80-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-83-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-16-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-46-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2884-22-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-57-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2884-15-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-18-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-14-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-101-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-104-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-106-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2884-122-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2884-143-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2884-144-0x0000000000660000-0x000000000171A000-memory.dmpFilesize
16.7MB
-
memory/2960-97-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2960-100-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2960-98-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2960-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2960-174-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB