Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 13:27
Static task
static1
Behavioral task
behavioral1
Sample
cd906030d501ed3283a4547f2f988bc0_NeikiAnalytics.dll
Resource
win7-20240220-en
General
-
Target
cd906030d501ed3283a4547f2f988bc0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
cd906030d501ed3283a4547f2f988bc0
-
SHA1
b5ec05269948e47bdc086a1def3a27424a0e2b20
-
SHA256
994f8cb8f98143788b089eacc953b61337c01bea06571a6250b238236a8a0248
-
SHA512
3949888e9206bd937fab465b5baf4e864f8c32e998ed83f0343eb66190137252d2dd71ec1817c8e3239026671f9ce6c79566f962cf8a2630fff304bf38d0656a
-
SSDEEP
1536:WPVoDmWBO9xx/EM9409gBgOrhQhmAPOVBO58RY5HJd0r8CGgo9obqRjjLJybRaxi:W9BWMbx/1ZmDwkvRMHMnqRjvSRaS1
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f763bc8.exef76200e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76200e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76200e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763bc8.exe -
Processes:
f76200e.exef763bc8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763bc8.exe -
Processes:
f763bc8.exef76200e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763bc8.exe -
Executes dropped EXE 3 IoCs
Processes:
f76200e.exef762240.exef763bc8.exepid process 2888 f76200e.exe 2372 f762240.exe 1580 f763bc8.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2888-14-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-16-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-19-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-21-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-23-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-17-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-22-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-15-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-18-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-20-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-60-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-61-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-62-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-64-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-63-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-66-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-67-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-82-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-84-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-86-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-85-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-107-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-124-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2888-153-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2372-157-0x0000000000990000-0x0000000001A4A000-memory.dmp upx behavioral1/memory/1580-173-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/1580-208-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f76200e.exef763bc8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76200e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763bc8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763bc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763bc8.exe -
Processes:
f76200e.exef763bc8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763bc8.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f76200e.exef763bc8.exedescription ioc process File opened (read-only) \??\E: f76200e.exe File opened (read-only) \??\K: f76200e.exe File opened (read-only) \??\T: f76200e.exe File opened (read-only) \??\H: f76200e.exe File opened (read-only) \??\I: f76200e.exe File opened (read-only) \??\P: f76200e.exe File opened (read-only) \??\Q: f76200e.exe File opened (read-only) \??\G: f76200e.exe File opened (read-only) \??\N: f76200e.exe File opened (read-only) \??\S: f76200e.exe File opened (read-only) \??\G: f763bc8.exe File opened (read-only) \??\J: f76200e.exe File opened (read-only) \??\L: f76200e.exe File opened (read-only) \??\M: f76200e.exe File opened (read-only) \??\O: f76200e.exe File opened (read-only) \??\R: f76200e.exe File opened (read-only) \??\E: f763bc8.exe -
Drops file in Windows directory 3 IoCs
Processes:
f76200e.exef763bc8.exedescription ioc process File created C:\Windows\f76205c f76200e.exe File opened for modification C:\Windows\SYSTEM.INI f76200e.exe File created C:\Windows\f767197 f763bc8.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f76200e.exef763bc8.exepid process 2888 f76200e.exe 2888 f76200e.exe 1580 f763bc8.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f76200e.exef763bc8.exedescription pid process Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 2888 f76200e.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe Token: SeDebugPrivilege 1580 f763bc8.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef76200e.exef763bc8.exedescription pid process target process PID 3040 wrote to memory of 2892 3040 rundll32.exe rundll32.exe PID 3040 wrote to memory of 2892 3040 rundll32.exe rundll32.exe PID 3040 wrote to memory of 2892 3040 rundll32.exe rundll32.exe PID 3040 wrote to memory of 2892 3040 rundll32.exe rundll32.exe PID 3040 wrote to memory of 2892 3040 rundll32.exe rundll32.exe PID 3040 wrote to memory of 2892 3040 rundll32.exe rundll32.exe PID 3040 wrote to memory of 2892 3040 rundll32.exe rundll32.exe PID 2892 wrote to memory of 2888 2892 rundll32.exe f76200e.exe PID 2892 wrote to memory of 2888 2892 rundll32.exe f76200e.exe PID 2892 wrote to memory of 2888 2892 rundll32.exe f76200e.exe PID 2892 wrote to memory of 2888 2892 rundll32.exe f76200e.exe PID 2888 wrote to memory of 1068 2888 f76200e.exe taskhost.exe PID 2888 wrote to memory of 1168 2888 f76200e.exe Dwm.exe PID 2888 wrote to memory of 1192 2888 f76200e.exe Explorer.EXE PID 2888 wrote to memory of 1596 2888 f76200e.exe DllHost.exe PID 2888 wrote to memory of 3040 2888 f76200e.exe rundll32.exe PID 2888 wrote to memory of 2892 2888 f76200e.exe rundll32.exe PID 2888 wrote to memory of 2892 2888 f76200e.exe rundll32.exe PID 2892 wrote to memory of 2372 2892 rundll32.exe f762240.exe PID 2892 wrote to memory of 2372 2892 rundll32.exe f762240.exe PID 2892 wrote to memory of 2372 2892 rundll32.exe f762240.exe PID 2892 wrote to memory of 2372 2892 rundll32.exe f762240.exe PID 2892 wrote to memory of 1580 2892 rundll32.exe f763bc8.exe PID 2892 wrote to memory of 1580 2892 rundll32.exe f763bc8.exe PID 2892 wrote to memory of 1580 2892 rundll32.exe f763bc8.exe PID 2892 wrote to memory of 1580 2892 rundll32.exe f763bc8.exe PID 2888 wrote to memory of 1068 2888 f76200e.exe taskhost.exe PID 2888 wrote to memory of 1168 2888 f76200e.exe Dwm.exe PID 2888 wrote to memory of 1192 2888 f76200e.exe Explorer.EXE PID 2888 wrote to memory of 2372 2888 f76200e.exe f762240.exe PID 2888 wrote to memory of 2372 2888 f76200e.exe f762240.exe PID 2888 wrote to memory of 1580 2888 f76200e.exe f763bc8.exe PID 2888 wrote to memory of 1580 2888 f76200e.exe f763bc8.exe PID 1580 wrote to memory of 1068 1580 f763bc8.exe taskhost.exe PID 1580 wrote to memory of 1168 1580 f763bc8.exe Dwm.exe PID 1580 wrote to memory of 1192 1580 f763bc8.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f76200e.exef763bc8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76200e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763bc8.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1068
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cd906030d501ed3283a4547f2f988bc0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cd906030d501ed3283a4547f2f988bc0_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\f76200e.exeC:\Users\Admin\AppData\Local\Temp\f76200e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\f762240.exeC:\Users\Admin\AppData\Local\Temp\f762240.exe4⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\f763bc8.exeC:\Users\Admin\AppData\Local\Temp\f763bc8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1596
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
256B
MD5b5da232db7e4f019e415a5369c3def96
SHA18d8ec0bdcd9c21c673958f2bbe5cc4ca4789f6c1
SHA25664c5b538506490463899ef7d6f7ad0ad7ca8e07733e035b041e77760c7e1ef12
SHA512a98202f82a5df6f3778081a50f0a91d553cdd42f2d068fb829f731a18d446ae259c3319a914ef3f2cc2d848764d68045da219b208005769c396acd9a2615f145
-
\Users\Admin\AppData\Local\Temp\f76200e.exeFilesize
97KB
MD593b2239926111d0bb1e6c59405c8ea3e
SHA19decfb123ec11d9cb1913c808bddf4fe7f28ee79
SHA2568ddc9f13a89c83a055b3e77a709929f0752ef0251bd821168e36bb18e6796643
SHA512d4bb4e4743e2bb29d45db49a389f685c1dd4aa1ea7b88541a21d02094fd27c94d0d79f1a5cf72213605ef2e2023d793575ac2dd172e4b46420a4f0f5dceff0df
-
memory/1068-29-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/1580-103-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/1580-209-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1580-208-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/1580-173-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/1580-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1580-105-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/1580-101-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2372-95-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2372-102-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2372-104-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2372-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2372-158-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2372-157-0x0000000000990000-0x0000000001A4A000-memory.dmpFilesize
16.7MB
-
memory/2888-18-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-23-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2888-14-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-48-0x00000000005E0000-0x00000000005E2000-memory.dmpFilesize
8KB
-
memory/2888-46-0x00000000005E0000-0x00000000005E2000-memory.dmpFilesize
8KB
-
memory/2888-45-0x0000000003010000-0x0000000003011000-memory.dmpFilesize
4KB
-
memory/2888-16-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-19-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-152-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2888-60-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-61-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-62-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-64-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-63-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-66-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-67-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-153-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-20-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-124-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-82-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-84-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-86-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-85-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-107-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-15-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-22-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-17-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2888-21-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2892-57-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2892-4-0x00000000000C0000-0x00000000000D2000-memory.dmpFilesize
72KB
-
memory/2892-76-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2892-79-0x00000000000C0000-0x00000000000C2000-memory.dmpFilesize
8KB
-
memory/2892-37-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2892-38-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2892-39-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2892-49-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2892-10-0x00000000000C0000-0x00000000000D2000-memory.dmpFilesize
72KB
-
memory/2892-58-0x00000000002E0000-0x00000000002F2000-memory.dmpFilesize
72KB
-
memory/2892-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB