Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 17:08
Static task
static1
Behavioral task
behavioral1
Sample
fc765bcc82fe5404cb1eb1c77fca01d0_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
fc765bcc82fe5404cb1eb1c77fca01d0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
fc765bcc82fe5404cb1eb1c77fca01d0
-
SHA1
4787adb9df31db9e232123c113e53928a1dd078b
-
SHA256
4fd169508e018f6421c4ac11d8a3f79ea819557b54e9016ce69d38eb403b5a7c
-
SHA512
6bce75e9ea53a0cfcce59f378ce1caa1d9968b6f7eba22f7a7149091025fce99253e5a0b99b3d52672bdf11756a2d215bddc8462224dc24f4208bf3d1300e280
-
SSDEEP
3072:6E0PdUU2aGsd/xBAJ7c8ZC2l/VJe/Lag2vnESz4wX4:sSUcsdAiWC2lq/LagqDz4U4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f762108.exef763c84.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762108.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762108.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763c84.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763c84.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763c84.exe -
Processes:
f762108.exef763c84.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763c84.exe -
Processes:
f762108.exef763c84.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762108.exe -
Executes dropped EXE 3 IoCs
Processes:
f762108.exef76255c.exef763c84.exepid process 552 f762108.exe 2688 f76255c.exe 2008 f763c84.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/552-12-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-15-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-18-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-21-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-22-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-20-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-19-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-17-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-16-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-14-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-58-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-59-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-60-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-61-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-62-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-64-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-79-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-80-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-82-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-85-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-103-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-106-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-108-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/552-145-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2008-161-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2008-198-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f763c84.exef762108.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763c84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763c84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763c84.exe -
Processes:
f763c84.exef762108.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763c84.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762108.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f762108.exef763c84.exedescription ioc process File opened (read-only) \??\I: f762108.exe File opened (read-only) \??\L: f762108.exe File opened (read-only) \??\P: f762108.exe File opened (read-only) \??\E: f763c84.exe File opened (read-only) \??\E: f762108.exe File opened (read-only) \??\H: f762108.exe File opened (read-only) \??\J: f762108.exe File opened (read-only) \??\M: f762108.exe File opened (read-only) \??\O: f762108.exe File opened (read-only) \??\G: f762108.exe File opened (read-only) \??\K: f762108.exe File opened (read-only) \??\N: f762108.exe File opened (read-only) \??\Q: f762108.exe File opened (read-only) \??\R: f762108.exe File opened (read-only) \??\S: f762108.exe -
Drops file in Windows directory 3 IoCs
Processes:
f762108.exef763c84.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI f762108.exe File created C:\Windows\f767484 f763c84.exe File created C:\Windows\f762175 f762108.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f762108.exef763c84.exepid process 552 f762108.exe 552 f762108.exe 2008 f763c84.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f762108.exef763c84.exedescription pid process Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 552 f762108.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe Token: SeDebugPrivilege 2008 f763c84.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef762108.exef763c84.exedescription pid process target process PID 3056 wrote to memory of 908 3056 rundll32.exe rundll32.exe PID 3056 wrote to memory of 908 3056 rundll32.exe rundll32.exe PID 3056 wrote to memory of 908 3056 rundll32.exe rundll32.exe PID 3056 wrote to memory of 908 3056 rundll32.exe rundll32.exe PID 3056 wrote to memory of 908 3056 rundll32.exe rundll32.exe PID 3056 wrote to memory of 908 3056 rundll32.exe rundll32.exe PID 3056 wrote to memory of 908 3056 rundll32.exe rundll32.exe PID 908 wrote to memory of 552 908 rundll32.exe f762108.exe PID 908 wrote to memory of 552 908 rundll32.exe f762108.exe PID 908 wrote to memory of 552 908 rundll32.exe f762108.exe PID 908 wrote to memory of 552 908 rundll32.exe f762108.exe PID 552 wrote to memory of 1104 552 f762108.exe taskhost.exe PID 552 wrote to memory of 1172 552 f762108.exe Dwm.exe PID 552 wrote to memory of 1196 552 f762108.exe Explorer.EXE PID 552 wrote to memory of 2268 552 f762108.exe DllHost.exe PID 552 wrote to memory of 3056 552 f762108.exe rundll32.exe PID 552 wrote to memory of 908 552 f762108.exe rundll32.exe PID 552 wrote to memory of 908 552 f762108.exe rundll32.exe PID 908 wrote to memory of 2688 908 rundll32.exe f76255c.exe PID 908 wrote to memory of 2688 908 rundll32.exe f76255c.exe PID 908 wrote to memory of 2688 908 rundll32.exe f76255c.exe PID 908 wrote to memory of 2688 908 rundll32.exe f76255c.exe PID 908 wrote to memory of 2008 908 rundll32.exe f763c84.exe PID 908 wrote to memory of 2008 908 rundll32.exe f763c84.exe PID 908 wrote to memory of 2008 908 rundll32.exe f763c84.exe PID 908 wrote to memory of 2008 908 rundll32.exe f763c84.exe PID 552 wrote to memory of 1104 552 f762108.exe taskhost.exe PID 552 wrote to memory of 1172 552 f762108.exe Dwm.exe PID 552 wrote to memory of 1196 552 f762108.exe Explorer.EXE PID 552 wrote to memory of 2688 552 f762108.exe f76255c.exe PID 552 wrote to memory of 2688 552 f762108.exe f76255c.exe PID 552 wrote to memory of 2008 552 f762108.exe f763c84.exe PID 552 wrote to memory of 2008 552 f762108.exe f763c84.exe PID 2008 wrote to memory of 1104 2008 f763c84.exe taskhost.exe PID 2008 wrote to memory of 1172 2008 f763c84.exe Dwm.exe PID 2008 wrote to memory of 1196 2008 f763c84.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f762108.exef763c84.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762108.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763c84.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fc765bcc82fe5404cb1eb1c77fca01d0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fc765bcc82fe5404cb1eb1c77fca01d0_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f762108.exeC:\Users\Admin\AppData\Local\Temp\f762108.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76255c.exeC:\Users\Admin\AppData\Local\Temp\f76255c.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f763c84.exeC:\Users\Admin\AppData\Local\Temp\f763c84.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5fad5acb6f75bbbcd8d7fccb26575fc65
SHA129b89c668f42490cc1681a02888e74f87377b4d4
SHA25684bb88ebada110ae8b00b2442fb02f10af579206b1a2d859dbba059a1618c18b
SHA512a19d528709abc729a9419e18de7c99ac7db4cb4b34057eb7020bfaaef5333a4da524d32d475cd264dc66035e0c9b63466036197f9bc09af56e7b2ed835ab7ef0
-
\Users\Admin\AppData\Local\Temp\f762108.exeFilesize
97KB
MD5e4e54105dd80c3f84e5a0d50201954b0
SHA1a940f826814323765dd86a9459e974859c01f8f8
SHA256c31913e3c23b975f337db7625809f9a3dc8f41eb6878824bca93bc93e269dbe2
SHA51245074831e5cd25c7025855f1dc9d06225fc8a9cba47d4d06697696b213e435d3b43e67ad11ab05aeac8c8f42a3397437d82f54494cc9758ce618653669eb9e0b
-
memory/552-60-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-145-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/552-12-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-15-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-18-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-21-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-22-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-20-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-19-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-17-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-16-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-14-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-61-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-144-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/552-79-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-121-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/552-108-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-106-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-56-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/552-57-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/552-103-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-62-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-82-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-58-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-59-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-48-0x00000000030D0000-0x00000000030D1000-memory.dmpFilesize
4KB
-
memory/552-80-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-85-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/552-64-0x00000000005E0000-0x000000000169A000-memory.dmpFilesize
16.7MB
-
memory/908-31-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/908-7-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/908-73-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/908-67-0x0000000000540000-0x0000000000552000-memory.dmpFilesize
72KB
-
memory/908-77-0x0000000000100000-0x0000000000102000-memory.dmpFilesize
8KB
-
memory/908-32-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/908-46-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/908-8-0x0000000000100000-0x0000000000112000-memory.dmpFilesize
72KB
-
memory/908-9-0x0000000000100000-0x0000000000112000-memory.dmpFilesize
72KB
-
memory/908-30-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/908-50-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/908-49-0x0000000000280000-0x0000000000292000-memory.dmpFilesize
72KB
-
memory/1104-24-0x0000000002050000-0x0000000002052000-memory.dmpFilesize
8KB
-
memory/2008-161-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2008-197-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2008-100-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2008-99-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2008-198-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2008-102-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2008-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2688-93-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-94-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2688-149-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2688-51-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2688-101-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB