Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 17:00
Static task
static1
Behavioral task
behavioral1
Sample
0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.dll
-
Size
120KB
-
MD5
0b76861c541b49745b9bf714a0bdd660
-
SHA1
ae8b3827e7f57bc4a2afc32acac6b6326ba7293b
-
SHA256
a68ff706938fc2c3006b6829b4a3addfb69bfb89252811da70555b944041f06f
-
SHA512
baea0abd643accb0f947538222a76712bf8f67034e96c7b2ae47289bb6f811874a42a7562caf38f75a9913466e07fce785c0c5f58838943b3385a05624f4c9ce
-
SSDEEP
1536:X5VTYSacOZmA1Ah8OkJUNUhk/4mzg7i0Xj3NaEFbTB7TReM/urdvlEi9hv/:X5VTyZlAiRJyY7Vj9aax71eMGrHEAn
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f76a3dd.exef76bdc3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a3dd.exe -
Processes:
f76a3dd.exef76bdc3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bdc3.exe -
Processes:
f76bdc3.exef76a3dd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bdc3.exe -
Executes dropped EXE 3 IoCs
Processes:
f76a3dd.exef76a67c.exef76bdc3.exepid process 2172 f76a3dd.exe 2472 f76a67c.exe 2624 f76bdc3.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2172-11-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-16-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-13-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-20-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-17-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-24-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-18-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-15-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-14-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-19-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-61-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-62-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-63-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-65-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-64-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-67-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-81-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-83-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-84-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-85-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-106-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-105-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2172-146-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2624-184-0x0000000000990000-0x0000000001A4A000-memory.dmp upx -
Processes:
f76bdc3.exef76a3dd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a3dd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bdc3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bdc3.exe -
Processes:
f76a3dd.exef76bdc3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a3dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bdc3.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f76a3dd.exedescription ioc process File opened (read-only) \??\P: f76a3dd.exe File opened (read-only) \??\R: f76a3dd.exe File opened (read-only) \??\N: f76a3dd.exe File opened (read-only) \??\Q: f76a3dd.exe File opened (read-only) \??\E: f76a3dd.exe File opened (read-only) \??\H: f76a3dd.exe File opened (read-only) \??\I: f76a3dd.exe File opened (read-only) \??\L: f76a3dd.exe File opened (read-only) \??\M: f76a3dd.exe File opened (read-only) \??\O: f76a3dd.exe File opened (read-only) \??\G: f76a3dd.exe File opened (read-only) \??\J: f76a3dd.exe File opened (read-only) \??\K: f76a3dd.exe -
Drops file in Windows directory 3 IoCs
Processes:
f76a3dd.exef76bdc3.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI f76a3dd.exe File created C:\Windows\f770cae f76bdc3.exe File created C:\Windows\f76a4b8 f76a3dd.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f76a3dd.exef76bdc3.exepid process 2172 f76a3dd.exe 2172 f76a3dd.exe 2624 f76bdc3.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
f76a3dd.exef76bdc3.exedescription pid process Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2172 f76a3dd.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe Token: SeDebugPrivilege 2624 f76bdc3.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef76a3dd.exef76bdc3.exedescription pid process target process PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1772 1152 rundll32.exe rundll32.exe PID 1772 wrote to memory of 2172 1772 rundll32.exe f76a3dd.exe PID 1772 wrote to memory of 2172 1772 rundll32.exe f76a3dd.exe PID 1772 wrote to memory of 2172 1772 rundll32.exe f76a3dd.exe PID 1772 wrote to memory of 2172 1772 rundll32.exe f76a3dd.exe PID 2172 wrote to memory of 1180 2172 f76a3dd.exe taskhost.exe PID 2172 wrote to memory of 1312 2172 f76a3dd.exe Dwm.exe PID 2172 wrote to memory of 1368 2172 f76a3dd.exe Explorer.EXE PID 2172 wrote to memory of 460 2172 f76a3dd.exe DllHost.exe PID 2172 wrote to memory of 1152 2172 f76a3dd.exe rundll32.exe PID 2172 wrote to memory of 1772 2172 f76a3dd.exe rundll32.exe PID 2172 wrote to memory of 1772 2172 f76a3dd.exe rundll32.exe PID 1772 wrote to memory of 2472 1772 rundll32.exe f76a67c.exe PID 1772 wrote to memory of 2472 1772 rundll32.exe f76a67c.exe PID 1772 wrote to memory of 2472 1772 rundll32.exe f76a67c.exe PID 1772 wrote to memory of 2472 1772 rundll32.exe f76a67c.exe PID 1772 wrote to memory of 2624 1772 rundll32.exe f76bdc3.exe PID 1772 wrote to memory of 2624 1772 rundll32.exe f76bdc3.exe PID 1772 wrote to memory of 2624 1772 rundll32.exe f76bdc3.exe PID 1772 wrote to memory of 2624 1772 rundll32.exe f76bdc3.exe PID 2172 wrote to memory of 1180 2172 f76a3dd.exe taskhost.exe PID 2172 wrote to memory of 1312 2172 f76a3dd.exe Dwm.exe PID 2172 wrote to memory of 1368 2172 f76a3dd.exe Explorer.EXE PID 2172 wrote to memory of 2472 2172 f76a3dd.exe f76a67c.exe PID 2172 wrote to memory of 2472 2172 f76a3dd.exe f76a67c.exe PID 2172 wrote to memory of 2624 2172 f76a3dd.exe f76bdc3.exe PID 2172 wrote to memory of 2624 2172 f76a3dd.exe f76bdc3.exe PID 2624 wrote to memory of 1180 2624 f76bdc3.exe taskhost.exe PID 2624 wrote to memory of 1312 2624 f76bdc3.exe Dwm.exe PID 2624 wrote to memory of 1368 2624 f76bdc3.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f76bdc3.exef76a3dd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bdc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a3dd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f76a3dd.exeC:\Users\Admin\AppData\Local\Temp\f76a3dd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76a67c.exeC:\Users\Admin\AppData\Local\Temp\f76a67c.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f76bdc3.exeC:\Users\Admin\AppData\Local\Temp\f76bdc3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD58a0c03f9fcd1228d07159c0d22bde3ad
SHA1216f8abc9efed497ab3d1a90e4367939fce07b34
SHA2565b7fa12b3bc92692b830080b83150ad3e19b5b124c995295b5d0e992cbd833b4
SHA5128319f53cf899f3d8018d70a991be8f07c4741351aa9e231eb46374884aea6b767dde070d4e9eafc3c1226ce45bc880778fa32fbbe986d65f6269c442c6336576
-
\Users\Admin\AppData\Local\Temp\f76a3dd.exeFilesize
97KB
MD5c47dd693d8ca9e213f2bd7e4d1312d86
SHA1cdbe66be963bc7aeb0989fbe11f9ef3376063720
SHA25647648b9fd2462abbd0563361a19c05b47659dd3da5c0c4f269214c237cd5fac3
SHA5126d2f6631b2694aadd76172b5335a326b47dc1cabe38b5ca44fd40a8311934cc55abb631deb1801c47fb1130cb1ee17b2b420e30f0950d9f5ef1524e5e5b4d297
-
memory/1180-21-0x0000000001B40000-0x0000000001B42000-memory.dmpFilesize
8KB
-
memory/1772-41-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1772-75-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/1772-31-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1772-50-0x0000000000790000-0x00000000007A2000-memory.dmpFilesize
72KB
-
memory/1772-49-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/1772-78-0x0000000000170000-0x0000000000176000-memory.dmpFilesize
24KB
-
memory/1772-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1772-51-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/1772-8-0x0000000000170000-0x0000000000182000-memory.dmpFilesize
72KB
-
memory/1772-30-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/2172-62-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-11-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-24-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-18-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-15-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-14-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-20-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-40-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2172-13-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-59-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/2172-19-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-60-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/2172-61-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2172-63-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-65-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-64-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-146-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-16-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-17-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-67-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-81-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-83-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-84-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-85-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-147-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2172-105-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2172-106-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2472-94-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2472-103-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2472-93-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2472-148-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2472-53-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2624-104-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2624-99-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2624-100-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2624-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2624-184-0x0000000000990000-0x0000000001A4A000-memory.dmpFilesize
16.7MB
-
memory/2624-183-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2624-185-0x0000000000990000-0x0000000001A4A000-memory.dmpFilesize
16.7MB