Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 14:27
Static task
static1
Behavioral task
behavioral1
Sample
d7482856356ba5eaa99a9b31e27b1da0_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
d7482856356ba5eaa99a9b31e27b1da0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
d7482856356ba5eaa99a9b31e27b1da0
-
SHA1
d1e5c06a21f85753335134fb769d5af1f2b2f960
-
SHA256
ec0398121807170f8d46b94adc67331ebd4d7ae0654e60d9b2cc797f017f0606
-
SHA512
0bb279c031f484a00c24332412f64b4bb621eca1eda5c512a6b1a1305830b2fd1ddcf941967be9933c78baae9061cbd158f590c5d118b56a9d66fbb09bd05c76
-
SSDEEP
1536:NM7KWetpU3dlJeG6x91fBSpBR4a9+RluX1/3GuZrvRLs3WOnAFaVP3O0gC:67KVDUtlJeGONSp7P+buX1uuZyP3pgC
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f761d41.exef7638cc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761d41.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761d41.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7638cc.exe -
Processes:
f761d41.exef7638cc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7638cc.exe -
Processes:
f761d41.exef7638cc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7638cc.exe -
Executes dropped EXE 3 IoCs
Processes:
f761d41.exef76203d.exef7638cc.exepid process 1872 f761d41.exe 2616 f76203d.exe 2880 f7638cc.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1976 rundll32.exe 1976 rundll32.exe 1976 rundll32.exe 1976 rundll32.exe 1976 rundll32.exe 1976 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1872-14-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-17-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-20-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-23-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-22-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-21-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-19-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-18-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-16-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-15-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-60-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-61-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-62-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-63-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-64-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-66-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-67-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-80-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-81-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-84-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-102-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-103-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-124-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/1872-145-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2880-167-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx behavioral1/memory/2880-199-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx -
Processes:
f761d41.exef7638cc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761d41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7638cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7638cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761d41.exe -
Processes:
f761d41.exef7638cc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7638cc.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f761d41.exef7638cc.exedescription ioc process File opened (read-only) \??\P: f761d41.exe File opened (read-only) \??\E: f7638cc.exe File opened (read-only) \??\E: f761d41.exe File opened (read-only) \??\G: f761d41.exe File opened (read-only) \??\H: f761d41.exe File opened (read-only) \??\I: f761d41.exe File opened (read-only) \??\K: f761d41.exe File opened (read-only) \??\O: f761d41.exe File opened (read-only) \??\L: f761d41.exe File opened (read-only) \??\M: f761d41.exe File opened (read-only) \??\Q: f761d41.exe File opened (read-only) \??\J: f761d41.exe File opened (read-only) \??\N: f761d41.exe File opened (read-only) \??\R: f761d41.exe File opened (read-only) \??\S: f761d41.exe -
Drops file in Windows directory 3 IoCs
Processes:
f761d41.exef7638cc.exedescription ioc process File created C:\Windows\f761d8f f761d41.exe File opened for modification C:\Windows\SYSTEM.INI f761d41.exe File created C:\Windows\f766f75 f7638cc.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f761d41.exef7638cc.exepid process 1872 f761d41.exe 1872 f761d41.exe 2880 f7638cc.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f761d41.exef7638cc.exedescription pid process Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 1872 f761d41.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe Token: SeDebugPrivilege 2880 f7638cc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef761d41.exef7638cc.exedescription pid process target process PID 1688 wrote to memory of 1976 1688 rundll32.exe rundll32.exe PID 1688 wrote to memory of 1976 1688 rundll32.exe rundll32.exe PID 1688 wrote to memory of 1976 1688 rundll32.exe rundll32.exe PID 1688 wrote to memory of 1976 1688 rundll32.exe rundll32.exe PID 1688 wrote to memory of 1976 1688 rundll32.exe rundll32.exe PID 1688 wrote to memory of 1976 1688 rundll32.exe rundll32.exe PID 1688 wrote to memory of 1976 1688 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1872 1976 rundll32.exe f761d41.exe PID 1976 wrote to memory of 1872 1976 rundll32.exe f761d41.exe PID 1976 wrote to memory of 1872 1976 rundll32.exe f761d41.exe PID 1976 wrote to memory of 1872 1976 rundll32.exe f761d41.exe PID 1872 wrote to memory of 1116 1872 f761d41.exe taskhost.exe PID 1872 wrote to memory of 1172 1872 f761d41.exe Dwm.exe PID 1872 wrote to memory of 1208 1872 f761d41.exe Explorer.EXE PID 1872 wrote to memory of 2360 1872 f761d41.exe DllHost.exe PID 1872 wrote to memory of 1688 1872 f761d41.exe rundll32.exe PID 1872 wrote to memory of 1976 1872 f761d41.exe rundll32.exe PID 1872 wrote to memory of 1976 1872 f761d41.exe rundll32.exe PID 1976 wrote to memory of 2616 1976 rundll32.exe f76203d.exe PID 1976 wrote to memory of 2616 1976 rundll32.exe f76203d.exe PID 1976 wrote to memory of 2616 1976 rundll32.exe f76203d.exe PID 1976 wrote to memory of 2616 1976 rundll32.exe f76203d.exe PID 1976 wrote to memory of 2880 1976 rundll32.exe f7638cc.exe PID 1976 wrote to memory of 2880 1976 rundll32.exe f7638cc.exe PID 1976 wrote to memory of 2880 1976 rundll32.exe f7638cc.exe PID 1976 wrote to memory of 2880 1976 rundll32.exe f7638cc.exe PID 1872 wrote to memory of 1116 1872 f761d41.exe taskhost.exe PID 1872 wrote to memory of 1172 1872 f761d41.exe Dwm.exe PID 1872 wrote to memory of 1208 1872 f761d41.exe Explorer.EXE PID 1872 wrote to memory of 2616 1872 f761d41.exe f76203d.exe PID 1872 wrote to memory of 2616 1872 f761d41.exe f76203d.exe PID 1872 wrote to memory of 2880 1872 f761d41.exe f7638cc.exe PID 1872 wrote to memory of 2880 1872 f761d41.exe f7638cc.exe PID 2880 wrote to memory of 1116 2880 f7638cc.exe taskhost.exe PID 2880 wrote to memory of 1172 2880 f7638cc.exe Dwm.exe PID 2880 wrote to memory of 1208 2880 f7638cc.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f761d41.exef7638cc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7638cc.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7482856356ba5eaa99a9b31e27b1da0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7482856356ba5eaa99a9b31e27b1da0_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f761d41.exeC:\Users\Admin\AppData\Local\Temp\f761d41.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76203d.exeC:\Users\Admin\AppData\Local\Temp\f76203d.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f7638cc.exeC:\Users\Admin\AppData\Local\Temp\f7638cc.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f761d41.exeFilesize
97KB
MD510155e9649226fd5f4fdafd0694cf7b2
SHA13738e32f62c4be523233c303ab56edbe631cd7a9
SHA256ff98d4e25d02fcd822b9acd48f4a74559d328e0ecc9273d3e9ee0ab368d3b265
SHA512421e34f56752970ebc8f44ecc152e8da2f792695201167e069fcbd633e4502afbb801f333b65e15aed3d03cf6627d440d9458b1dd1d6d0f9223f64b08106bb16
-
C:\Windows\SYSTEM.INIFilesize
257B
MD51288acf43513f3b3f75e4cebe7feee66
SHA18589e47b5bbe64adb143c7263a17ef4d4c445211
SHA2564f1b53e48f89aa241068e4fddda136da761fbb54639a1c6c6c86d74dd131ce0b
SHA5122cab0489558da79cfa260e39d57a9280e95d6bf064e656af5ddc4f13d96cae2682cfe5075d84817aedfdaad9a047648abec8c1e6f2b0a2d60590587261cc6a3f
-
memory/1116-29-0x0000000000310000-0x0000000000312000-memory.dmpFilesize
8KB
-
memory/1872-60-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-56-0x00000000040E0000-0x00000000040E2000-memory.dmpFilesize
8KB
-
memory/1872-14-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-17-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-20-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-23-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-61-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-21-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-19-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-18-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-16-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-15-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-44-0x0000000004230000-0x0000000004231000-memory.dmpFilesize
4KB
-
memory/1872-62-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-46-0x00000000040E0000-0x00000000040E2000-memory.dmpFilesize
8KB
-
memory/1872-66-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-145-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-146-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1872-124-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-103-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-102-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-84-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-81-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-80-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1872-22-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-67-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-63-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1872-64-0x00000000006D0000-0x000000000178A000-memory.dmpFilesize
16.7MB
-
memory/1976-57-0x0000000000760000-0x0000000000772000-memory.dmpFilesize
72KB
-
memory/1976-45-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/1976-38-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1976-7-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1976-36-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/1976-37-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1976-8-0x0000000000250000-0x0000000000262000-memory.dmpFilesize
72KB
-
memory/1976-58-0x0000000000760000-0x0000000000772000-memory.dmpFilesize
72KB
-
memory/1976-9-0x0000000000250000-0x0000000000262000-memory.dmpFilesize
72KB
-
memory/1976-55-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2616-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2616-96-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2616-94-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2616-104-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2616-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2880-105-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2880-100-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2880-199-0x00000000009C0000-0x0000000001A7A000-memory.dmpFilesize
16.7MB
-
memory/2880-167-0x00000000009C0000-0x0000000001A7A000-memory.dmpFilesize
16.7MB
-
memory/2880-101-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2880-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2880-198-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB