Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 21:25
Static task
static1
Behavioral task
behavioral1
Sample
37a8422d2b7e1e7709518a1c73c88b40_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
37a8422d2b7e1e7709518a1c73c88b40_NeikiAnalytics.dll
-
Size
120KB
-
MD5
37a8422d2b7e1e7709518a1c73c88b40
-
SHA1
883fb36e38caf2f990513300f7177bafc6190f2d
-
SHA256
f00bbb6299643284cdf0d16e9d47dc79e83399d957018aafbd2432004ad8e33c
-
SHA512
4b36ad1c62fa726c4477de606831378ccb6cae9c18dd0b0104c5d8d213a4dc6a316238d01f9cb4f4c46ad8a745fde0fe393f4732080e83b374d02e1ba60de8a2
-
SSDEEP
3072:SJaeXpw8Tgw/K02UA1H+6APMo2lHrPbUU:SJaCp1TNp2lP4MoGLAU
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f76a5e0.exef768bac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f768bac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f768bac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a5e0.exe -
Processes:
f768bac.exef76a5e0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a5e0.exe -
Processes:
f768bac.exef76a5e0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a5e0.exe -
Executes dropped EXE 3 IoCs
Processes:
f768bac.exef76902f.exef76a5e0.exepid process 2980 f768bac.exe 2228 f76902f.exe 2700 f76a5e0.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe 2268 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2980-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-25-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-22-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-24-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-23-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-62-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-61-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-64-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-80-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-67-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-84-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-85-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-87-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-106-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-108-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-110-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-146-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2700-160-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2700-196-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f768bac.exef76a5e0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768bac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a5e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a5e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a5e0.exe -
Processes:
f768bac.exef76a5e0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a5e0.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f768bac.exef76a5e0.exedescription ioc process File opened (read-only) \??\O: f768bac.exe File opened (read-only) \??\R: f768bac.exe File opened (read-only) \??\S: f768bac.exe File opened (read-only) \??\E: f768bac.exe File opened (read-only) \??\I: f768bac.exe File opened (read-only) \??\J: f768bac.exe File opened (read-only) \??\K: f768bac.exe File opened (read-only) \??\G: f768bac.exe File opened (read-only) \??\H: f768bac.exe File opened (read-only) \??\M: f768bac.exe File opened (read-only) \??\E: f76a5e0.exe File opened (read-only) \??\L: f768bac.exe File opened (read-only) \??\N: f768bac.exe File opened (read-only) \??\P: f768bac.exe File opened (read-only) \??\Q: f768bac.exe -
Drops file in Windows directory 3 IoCs
Processes:
f768bac.exef76a5e0.exedescription ioc process File created C:\Windows\f768cc5 f768bac.exe File opened for modification C:\Windows\SYSTEM.INI f768bac.exe File created C:\Windows\f76df76 f76a5e0.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f768bac.exef76a5e0.exepid process 2980 f768bac.exe 2980 f768bac.exe 2700 f76a5e0.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f768bac.exef76a5e0.exedescription pid process Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2980 f768bac.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe Token: SeDebugPrivilege 2700 f76a5e0.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef768bac.exef76a5e0.exedescription pid process target process PID 2772 wrote to memory of 2268 2772 rundll32.exe rundll32.exe PID 2772 wrote to memory of 2268 2772 rundll32.exe rundll32.exe PID 2772 wrote to memory of 2268 2772 rundll32.exe rundll32.exe PID 2772 wrote to memory of 2268 2772 rundll32.exe rundll32.exe PID 2772 wrote to memory of 2268 2772 rundll32.exe rundll32.exe PID 2772 wrote to memory of 2268 2772 rundll32.exe rundll32.exe PID 2772 wrote to memory of 2268 2772 rundll32.exe rundll32.exe PID 2268 wrote to memory of 2980 2268 rundll32.exe f768bac.exe PID 2268 wrote to memory of 2980 2268 rundll32.exe f768bac.exe PID 2268 wrote to memory of 2980 2268 rundll32.exe f768bac.exe PID 2268 wrote to memory of 2980 2268 rundll32.exe f768bac.exe PID 2980 wrote to memory of 1092 2980 f768bac.exe taskhost.exe PID 2980 wrote to memory of 1168 2980 f768bac.exe Dwm.exe PID 2980 wrote to memory of 1200 2980 f768bac.exe Explorer.EXE PID 2980 wrote to memory of 1320 2980 f768bac.exe DllHost.exe PID 2980 wrote to memory of 2772 2980 f768bac.exe rundll32.exe PID 2980 wrote to memory of 2268 2980 f768bac.exe rundll32.exe PID 2980 wrote to memory of 2268 2980 f768bac.exe rundll32.exe PID 2268 wrote to memory of 2228 2268 rundll32.exe f76902f.exe PID 2268 wrote to memory of 2228 2268 rundll32.exe f76902f.exe PID 2268 wrote to memory of 2228 2268 rundll32.exe f76902f.exe PID 2268 wrote to memory of 2228 2268 rundll32.exe f76902f.exe PID 2268 wrote to memory of 2700 2268 rundll32.exe f76a5e0.exe PID 2268 wrote to memory of 2700 2268 rundll32.exe f76a5e0.exe PID 2268 wrote to memory of 2700 2268 rundll32.exe f76a5e0.exe PID 2268 wrote to memory of 2700 2268 rundll32.exe f76a5e0.exe PID 2980 wrote to memory of 1092 2980 f768bac.exe taskhost.exe PID 2980 wrote to memory of 1168 2980 f768bac.exe Dwm.exe PID 2980 wrote to memory of 1200 2980 f768bac.exe Explorer.EXE PID 2980 wrote to memory of 2228 2980 f768bac.exe f76902f.exe PID 2980 wrote to memory of 2228 2980 f768bac.exe f76902f.exe PID 2980 wrote to memory of 2700 2980 f768bac.exe f76a5e0.exe PID 2980 wrote to memory of 2700 2980 f768bac.exe f76a5e0.exe PID 2700 wrote to memory of 1092 2700 f76a5e0.exe taskhost.exe PID 2700 wrote to memory of 1168 2700 f76a5e0.exe Dwm.exe PID 2700 wrote to memory of 1200 2700 f76a5e0.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f768bac.exef76a5e0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768bac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a5e0.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\37a8422d2b7e1e7709518a1c73c88b40_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\37a8422d2b7e1e7709518a1c73c88b40_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f768bac.exeC:\Users\Admin\AppData\Local\Temp\f768bac.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76902f.exeC:\Users\Admin\AppData\Local\Temp\f76902f.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f76a5e0.exeC:\Users\Admin\AppData\Local\Temp\f76a5e0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD561408ff5359aafdf9348b2a236e6c2e4
SHA15f4235db061f7f7b861811dea012880470bfc922
SHA256152fbfbbce832c28dab9c1f359808e6cd8405421cda52d8bf143c50a564cd3a4
SHA51205bc6ee53f710b2e5f0610f92e2f941361eb83c956e01c4b195bf0fe0be73203a9c5701846ebbec59875363e8592126fb6273328a3fe9e59f4ed631376c693df
-
\Users\Admin\AppData\Local\Temp\f768bac.exeFilesize
97KB
MD5d4c4f8a8f32907e9328f6ca813a3b3ce
SHA11bf0d56475d8d32a96357edb174b5bec97340ee9
SHA2566a25c1983f441074afc73199242e115c4bb753cde6913098ad8dd0cd1130888d
SHA51207b175de563f672ad8026b965283a0b9ddf357170524b3e330667a4b1bf7ae405bbdb8dad36d0d3bdfba62391b641a194838298b4dffe9f872b2f6972c22159b
-
memory/1092-27-0x0000000001BC0000-0x0000000001BC2000-memory.dmpFilesize
8KB
-
memory/2228-96-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2228-103-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2228-97-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2228-172-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2268-13-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2268-78-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/2268-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2268-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2268-7-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2268-3-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2268-76-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2268-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2268-57-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/2268-34-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2268-43-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2268-35-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2268-36-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2268-50-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2268-59-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/2700-104-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2700-81-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2700-195-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2700-196-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2700-160-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2700-101-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2700-102-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2980-87-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-22-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-63-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-64-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-65-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-62-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-80-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-18-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-24-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-67-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-84-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-85-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-58-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2980-21-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-17-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-61-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-20-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-25-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-19-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-106-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-108-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-110-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-119-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2980-146-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-147-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2980-15-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-42-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2980-14-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2980-23-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/2980-49-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB