Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 06:58
Static task
static1
Behavioral task
behavioral1
Sample
a7b2df41f56f1e1862a40c2f995b23b0_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
a7b2df41f56f1e1862a40c2f995b23b0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
a7b2df41f56f1e1862a40c2f995b23b0
-
SHA1
bc691751b27754c80b4663b0d8fa4fc1bf073c17
-
SHA256
f4828eee64fe3ca22473db49a49e4ce69848cb07e8f439ffac2eb38290ea3754
-
SHA512
86d0e5136695bff4777025f923bcabaae316e06084183fa859a8929bc750279f2e55bc17772d67100a83a2aa579d50e6790e86c6ea413bd9c3240b4fbf99e29f
-
SSDEEP
1536:AHGuKM2xLdnkNVq8llMQ5gCC8CGugXWRJbIuUwM+U3kZMBGZxNEbSHkRDx:n2l6CBvdeUupUBeUbSHU
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f763e38.exef76226f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76226f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76226f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763e38.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763e38.exe -
Processes:
f76226f.exef763e38.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763e38.exe -
Processes:
f763e38.exef76226f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76226f.exe -
Executes dropped EXE 3 IoCs
Processes:
f76226f.exef762462.exef763e38.exepid process 2420 f76226f.exe 2500 f762462.exe 1640 f763e38.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2420-16-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-18-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-20-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-23-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-22-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-21-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-19-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-17-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-15-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-14-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-12-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-63-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-64-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-65-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-66-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-67-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-69-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-70-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-85-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-88-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-90-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-108-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2420-152-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/1640-167-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx behavioral1/memory/1640-205-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx -
Processes:
f76226f.exef763e38.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763e38.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763e38.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76226f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763e38.exe -
Processes:
f76226f.exef763e38.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763e38.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f76226f.exef763e38.exedescription ioc process File opened (read-only) \??\S: f76226f.exe File opened (read-only) \??\G: f763e38.exe File opened (read-only) \??\E: f76226f.exe File opened (read-only) \??\L: f76226f.exe File opened (read-only) \??\N: f76226f.exe File opened (read-only) \??\O: f76226f.exe File opened (read-only) \??\Q: f76226f.exe File opened (read-only) \??\M: f76226f.exe File opened (read-only) \??\P: f76226f.exe File opened (read-only) \??\R: f76226f.exe File opened (read-only) \??\H: f76226f.exe File opened (read-only) \??\J: f76226f.exe File opened (read-only) \??\K: f76226f.exe File opened (read-only) \??\E: f763e38.exe File opened (read-only) \??\G: f76226f.exe File opened (read-only) \??\I: f76226f.exe File opened (read-only) \??\T: f76226f.exe -
Drops file in Windows directory 3 IoCs
Processes:
f76226f.exef763e38.exedescription ioc process File created C:\Windows\f7622dc f76226f.exe File opened for modification C:\Windows\SYSTEM.INI f76226f.exe File created C:\Windows\f7672ef f763e38.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f76226f.exef763e38.exepid process 2420 f76226f.exe 2420 f76226f.exe 1640 f763e38.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f76226f.exef763e38.exedescription pid process Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 2420 f76226f.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe Token: SeDebugPrivilege 1640 f763e38.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef76226f.exef763e38.exedescription pid process target process PID 1976 wrote to memory of 2376 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 2376 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 2376 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 2376 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 2376 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 2376 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 2376 1976 rundll32.exe rundll32.exe PID 2376 wrote to memory of 2420 2376 rundll32.exe f76226f.exe PID 2376 wrote to memory of 2420 2376 rundll32.exe f76226f.exe PID 2376 wrote to memory of 2420 2376 rundll32.exe f76226f.exe PID 2376 wrote to memory of 2420 2376 rundll32.exe f76226f.exe PID 2420 wrote to memory of 1124 2420 f76226f.exe taskhost.exe PID 2420 wrote to memory of 1184 2420 f76226f.exe Dwm.exe PID 2420 wrote to memory of 1212 2420 f76226f.exe Explorer.EXE PID 2420 wrote to memory of 1348 2420 f76226f.exe DllHost.exe PID 2420 wrote to memory of 1976 2420 f76226f.exe rundll32.exe PID 2420 wrote to memory of 2376 2420 f76226f.exe rundll32.exe PID 2420 wrote to memory of 2376 2420 f76226f.exe rundll32.exe PID 2376 wrote to memory of 2500 2376 rundll32.exe f762462.exe PID 2376 wrote to memory of 2500 2376 rundll32.exe f762462.exe PID 2376 wrote to memory of 2500 2376 rundll32.exe f762462.exe PID 2376 wrote to memory of 2500 2376 rundll32.exe f762462.exe PID 2376 wrote to memory of 1640 2376 rundll32.exe f763e38.exe PID 2376 wrote to memory of 1640 2376 rundll32.exe f763e38.exe PID 2376 wrote to memory of 1640 2376 rundll32.exe f763e38.exe PID 2376 wrote to memory of 1640 2376 rundll32.exe f763e38.exe PID 2420 wrote to memory of 1124 2420 f76226f.exe taskhost.exe PID 2420 wrote to memory of 1184 2420 f76226f.exe Dwm.exe PID 2420 wrote to memory of 1212 2420 f76226f.exe Explorer.EXE PID 2420 wrote to memory of 2500 2420 f76226f.exe f762462.exe PID 2420 wrote to memory of 2500 2420 f76226f.exe f762462.exe PID 2420 wrote to memory of 1640 2420 f76226f.exe f763e38.exe PID 2420 wrote to memory of 1640 2420 f76226f.exe f763e38.exe PID 1640 wrote to memory of 1124 1640 f763e38.exe taskhost.exe PID 1640 wrote to memory of 1184 1640 f763e38.exe Dwm.exe PID 1640 wrote to memory of 1212 1640 f763e38.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f76226f.exef763e38.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76226f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763e38.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7b2df41f56f1e1862a40c2f995b23b0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7b2df41f56f1e1862a40c2f995b23b0_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f76226f.exeC:\Users\Admin\AppData\Local\Temp\f76226f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f762462.exeC:\Users\Admin\AppData\Local\Temp\f762462.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f763e38.exeC:\Users\Admin\AppData\Local\Temp\f763e38.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD50de22898ae2526407a272171e6555fc3
SHA18414f56302e8d2b8103a4d0a374a9c433086b7bf
SHA256638b643458398d16f534948a193bdf30aff9033b07b3788c20f781374fef0313
SHA512aa5ce2d5b424c8b0051f1b02ec827ed0b59cbca62d5a87a7ff9168e7671c447a7efe124fcb7c4d87ec1aeb44b15c6259addcfe33d77cb8e1d68dceefe754a85c
-
\Users\Admin\AppData\Local\Temp\f76226f.exeFilesize
97KB
MD52dfe678f9674d3fc21bcb4e680f3b7d5
SHA1ce44876399f8d9f377f8b4fbaf3d88f3b8bf02b0
SHA256369197c45a5ec10aed193472aaabb1d80afed2e0bb8642a75d1306e153f733d7
SHA512b49175b7d43fda011a129508daa2227ab43975fd21a1e66a5ad31b0b076ff2fde2165245fce2ae5ec1c293f04029a940f4e545c03a4df12eb8a042b72c28bb81
-
memory/1124-29-0x0000000001F10000-0x0000000001F12000-memory.dmpFilesize
8KB
-
memory/1640-167-0x0000000000A60000-0x0000000001B1A000-memory.dmpFilesize
16.7MB
-
memory/1640-84-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1640-107-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/1640-105-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/1640-104-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1640-205-0x0000000000A60000-0x0000000001B1A000-memory.dmpFilesize
16.7MB
-
memory/1640-206-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2376-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2376-58-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2376-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2376-39-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2376-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2376-47-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2376-38-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2376-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2376-78-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2376-81-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2376-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2376-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2420-63-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-90-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-14-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-12-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-17-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-64-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-65-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-66-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-67-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-69-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-70-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-19-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-21-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-22-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-23-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-85-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-88-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-15-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-48-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/2420-108-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2420-16-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-50-0x0000000000370000-0x0000000000372000-memory.dmpFilesize
8KB
-
memory/2420-51-0x0000000000370000-0x0000000000372000-memory.dmpFilesize
8KB
-
memory/2420-18-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-20-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-122-0x0000000000370000-0x0000000000372000-memory.dmpFilesize
8KB
-
memory/2420-152-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/2420-151-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2500-99-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2500-100-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2500-106-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2500-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB