Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 06:20
Static task
static1
Behavioral task
behavioral1
Sample
a1c1218525f33669d49554250f706700_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
a1c1218525f33669d49554250f706700_NeikiAnalytics.dll
-
Size
120KB
-
MD5
a1c1218525f33669d49554250f706700
-
SHA1
c9a48f2fd0c8bd18af0dd1ad771b8e766fcaaf75
-
SHA256
01e34b2169285f69d303b23dfdbbd5afc61020ce8f2e5c07528b3bb34bebe03e
-
SHA512
e62e1736780ec356e3b2764627b6c4979c03239b641eb38eea5620bfd8370dc0a77767e5a45bedd236d6ec094c54435c79923c3d579e633a7bfe8914f4b111d9
-
SSDEEP
3072:dBABYC+RMU0A4F1UPcltAZznceTB5CYV:dBABz0+1UO+dpTnCK
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f764d74.exef76273f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f764d74.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f764d74.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76273f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76273f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76273f.exe -
Processes:
f76273f.exef764d74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764d74.exe -
Processes:
f76273f.exef764d74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76273f.exe -
Executes dropped EXE 3 IoCs
Processes:
f76273f.exef7628a6.exef764d74.exepid process 2204 f76273f.exe 2804 f7628a6.exe 1736 f764d74.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2424 rundll32.exe 2424 rundll32.exe 2424 rundll32.exe 2424 rundll32.exe 2424 rundll32.exe 2424 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2204-14-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-18-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-20-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-17-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-16-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-22-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-23-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-21-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-19-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-15-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-61-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-62-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-63-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-64-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-65-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-80-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-98-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-100-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-102-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-104-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-105-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2204-142-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/1736-158-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx behavioral1/memory/1736-197-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx -
Processes:
f76273f.exef764d74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76273f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f764d74.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f764d74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f764d74.exe -
Processes:
f76273f.exef764d74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764d74.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f76273f.exef764d74.exedescription ioc process File opened (read-only) \??\E: f76273f.exe File opened (read-only) \??\H: f764d74.exe File opened (read-only) \??\I: f764d74.exe File opened (read-only) \??\M: f76273f.exe File opened (read-only) \??\O: f76273f.exe File opened (read-only) \??\P: f76273f.exe File opened (read-only) \??\E: f764d74.exe File opened (read-only) \??\G: f764d74.exe File opened (read-only) \??\H: f76273f.exe File opened (read-only) \??\I: f76273f.exe File opened (read-only) \??\L: f76273f.exe File opened (read-only) \??\K: f76273f.exe File opened (read-only) \??\G: f76273f.exe File opened (read-only) \??\J: f76273f.exe File opened (read-only) \??\N: f76273f.exe -
Drops file in Windows directory 3 IoCs
Processes:
f76273f.exef764d74.exedescription ioc process File created C:\Windows\f76278d f76273f.exe File opened for modification C:\Windows\SYSTEM.INI f76273f.exe File created C:\Windows\f767761 f764d74.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f76273f.exef764d74.exepid process 2204 f76273f.exe 2204 f76273f.exe 1736 f764d74.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f76273f.exef764d74.exedescription pid process Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 2204 f76273f.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe Token: SeDebugPrivilege 1736 f764d74.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef76273f.exef764d74.exedescription pid process target process PID 2224 wrote to memory of 2424 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 2424 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 2424 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 2424 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 2424 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 2424 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 2424 2224 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2204 2424 rundll32.exe f76273f.exe PID 2424 wrote to memory of 2204 2424 rundll32.exe f76273f.exe PID 2424 wrote to memory of 2204 2424 rundll32.exe f76273f.exe PID 2424 wrote to memory of 2204 2424 rundll32.exe f76273f.exe PID 2204 wrote to memory of 1108 2204 f76273f.exe taskhost.exe PID 2204 wrote to memory of 1168 2204 f76273f.exe Dwm.exe PID 2204 wrote to memory of 1196 2204 f76273f.exe Explorer.EXE PID 2204 wrote to memory of 2004 2204 f76273f.exe DllHost.exe PID 2204 wrote to memory of 2224 2204 f76273f.exe rundll32.exe PID 2204 wrote to memory of 2424 2204 f76273f.exe rundll32.exe PID 2204 wrote to memory of 2424 2204 f76273f.exe rundll32.exe PID 2424 wrote to memory of 2804 2424 rundll32.exe f7628a6.exe PID 2424 wrote to memory of 2804 2424 rundll32.exe f7628a6.exe PID 2424 wrote to memory of 2804 2424 rundll32.exe f7628a6.exe PID 2424 wrote to memory of 2804 2424 rundll32.exe f7628a6.exe PID 2424 wrote to memory of 1736 2424 rundll32.exe f764d74.exe PID 2424 wrote to memory of 1736 2424 rundll32.exe f764d74.exe PID 2424 wrote to memory of 1736 2424 rundll32.exe f764d74.exe PID 2424 wrote to memory of 1736 2424 rundll32.exe f764d74.exe PID 2204 wrote to memory of 1108 2204 f76273f.exe taskhost.exe PID 2204 wrote to memory of 1168 2204 f76273f.exe Dwm.exe PID 2204 wrote to memory of 1196 2204 f76273f.exe Explorer.EXE PID 2204 wrote to memory of 2804 2204 f76273f.exe f7628a6.exe PID 2204 wrote to memory of 2804 2204 f76273f.exe f7628a6.exe PID 2204 wrote to memory of 1736 2204 f76273f.exe f764d74.exe PID 2204 wrote to memory of 1736 2204 f76273f.exe f764d74.exe PID 1736 wrote to memory of 1108 1736 f764d74.exe taskhost.exe PID 1736 wrote to memory of 1168 1736 f764d74.exe Dwm.exe PID 1736 wrote to memory of 1196 1736 f764d74.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f76273f.exef764d74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76273f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764d74.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a1c1218525f33669d49554250f706700_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a1c1218525f33669d49554250f706700_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\f76273f.exeC:\Users\Admin\AppData\Local\Temp\f76273f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\f7628a6.exeC:\Users\Admin\AppData\Local\Temp\f7628a6.exe4⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\f764d74.exeC:\Users\Admin\AppData\Local\Temp\f764d74.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1736
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2004
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD537bb9983ad2c133bada75435ce2de7f1
SHA1463413776c54d8ec55b86f808a49920c2d7ab29f
SHA2564f8ac0ddbccb3c9e1524ae3f071251cd04f2e387a500dc837e2c9cbef890254d
SHA51259ab75b6558ecd30d77a766ea0e58070a0a093316ece5666b0d1667c31dbca7fbe85e60f7bc8d1cec65fec5e1b75eca1b3e4d129e95ea208d64dff1e3974068a
-
\Users\Admin\AppData\Local\Temp\f76273f.exeFilesize
97KB
MD5f7e80c2642c5034cfd93a831bafcaec4
SHA1c5a0891e44dc8b602fb8d71862133988f323dcc9
SHA25660ce7d71f40dcf00b97bed492b633634a936896ca28e18d6e531cbb541742a68
SHA51266950a68c8b7b39c1805150b689d4874550469dee94d706605dfd54be8de8efe3db20916cca4a7dffc2dd00af2cfb80a87d08418c66903999ddba99507a6b5a8
-
memory/1108-24-0x0000000002010000-0x0000000002012000-memory.dmpFilesize
8KB
-
memory/1736-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1736-198-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1736-197-0x0000000000A60000-0x0000000001B1A000-memory.dmpFilesize
16.7MB
-
memory/1736-158-0x0000000000A60000-0x0000000001B1A000-memory.dmpFilesize
16.7MB
-
memory/1736-97-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/1736-94-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1736-95-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2204-98-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-100-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-22-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2204-14-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-142-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-138-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2204-105-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-104-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-23-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-21-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-19-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-102-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-15-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-59-0x00000000002D0000-0x00000000002D2000-memory.dmpFilesize
8KB
-
memory/2204-60-0x00000000002D0000-0x00000000002D2000-memory.dmpFilesize
8KB
-
memory/2204-61-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-62-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-63-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-64-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-65-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-41-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2204-16-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-80-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-18-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-17-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2204-20-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2424-51-0x00000000003B0000-0x00000000003C2000-memory.dmpFilesize
72KB
-
memory/2424-52-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/2424-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2424-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2424-76-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/2424-49-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/2424-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2424-31-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/2424-40-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2424-32-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2804-53-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2804-143-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2804-89-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2804-90-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2804-96-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB