Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 20:10
Static task
static1
Behavioral task
behavioral1
Sample
0119edc4123b1b68c8c4a0c04e5468e95377ad200c594160a2c6abd3814c0299.dll
Resource
win7-20231129-en
General
-
Target
0119edc4123b1b68c8c4a0c04e5468e95377ad200c594160a2c6abd3814c0299.dll
-
Size
120KB
-
MD5
e22aa94b66415e28ab49b2f6c74a84a0
-
SHA1
0aa66de62267175fd2420de595ec57126a244120
-
SHA256
0119edc4123b1b68c8c4a0c04e5468e95377ad200c594160a2c6abd3814c0299
-
SHA512
e05385d82a243e3ad850613e72a9c6f307000186b2946ff95b12e70a9763294db6a89671b98bfd9badb4ae75295ce09fa18115782545c117dad52027475c8228
-
SSDEEP
1536:doCVj26w8QBel86/YxjMCkpdupT3+M3qSMzJARCn0lE4nKJCWqYUvOiaQx4NigQK:doUQU++YxjGwZuJARuK/nKJYYUd74rb
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f7607ae.exef762349.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762349.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762349.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7607ae.exe -
Processes:
f7607ae.exef762349.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762349.exe -
Processes:
f762349.exef7607ae.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762349.exe -
Executes dropped EXE 3 IoCs
Processes:
f7607ae.exef760963.exef762349.exepid process 2552 f7607ae.exe 2492 f760963.exe 2180 f762349.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2852 rundll32.exe 2852 rundll32.exe 2852 rundll32.exe 2852 rundll32.exe 2852 rundll32.exe 2852 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2552-12-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-17-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-14-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-20-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-21-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-22-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-19-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-15-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-18-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-16-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-59-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-60-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-61-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-63-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-62-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-65-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-66-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-79-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-82-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-84-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-101-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-102-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-115-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2552-145-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2180-165-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx behavioral1/memory/2180-197-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx -
Processes:
f7607ae.exef762349.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7607ae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762349.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762349.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762349.exe -
Processes:
f7607ae.exef762349.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762349.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f762349.exef7607ae.exedescription ioc process File opened (read-only) \??\E: f762349.exe File opened (read-only) \??\K: f7607ae.exe File opened (read-only) \??\L: f7607ae.exe File opened (read-only) \??\Q: f7607ae.exe File opened (read-only) \??\R: f7607ae.exe File opened (read-only) \??\S: f7607ae.exe File opened (read-only) \??\E: f7607ae.exe File opened (read-only) \??\G: f7607ae.exe File opened (read-only) \??\I: f7607ae.exe File opened (read-only) \??\O: f7607ae.exe File opened (read-only) \??\H: f7607ae.exe File opened (read-only) \??\J: f7607ae.exe File opened (read-only) \??\P: f7607ae.exe File opened (read-only) \??\T: f7607ae.exe File opened (read-only) \??\M: f7607ae.exe File opened (read-only) \??\N: f7607ae.exe File opened (read-only) \??\G: f762349.exe -
Drops file in Windows directory 3 IoCs
Processes:
f7607ae.exef762349.exedescription ioc process File created C:\Windows\f7607ed f7607ae.exe File opened for modification C:\Windows\SYSTEM.INI f7607ae.exe File created C:\Windows\f76589b f762349.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f7607ae.exef762349.exepid process 2552 f7607ae.exe 2552 f7607ae.exe 2180 f762349.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f7607ae.exef762349.exedescription pid process Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2552 f7607ae.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe Token: SeDebugPrivilege 2180 f762349.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef7607ae.exef762349.exedescription pid process target process PID 2548 wrote to memory of 2852 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2852 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2852 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2852 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2852 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2852 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2852 2548 rundll32.exe rundll32.exe PID 2852 wrote to memory of 2552 2852 rundll32.exe f7607ae.exe PID 2852 wrote to memory of 2552 2852 rundll32.exe f7607ae.exe PID 2852 wrote to memory of 2552 2852 rundll32.exe f7607ae.exe PID 2852 wrote to memory of 2552 2852 rundll32.exe f7607ae.exe PID 2552 wrote to memory of 1116 2552 f7607ae.exe taskhost.exe PID 2552 wrote to memory of 1176 2552 f7607ae.exe Dwm.exe PID 2552 wrote to memory of 1204 2552 f7607ae.exe Explorer.EXE PID 2552 wrote to memory of 1052 2552 f7607ae.exe DllHost.exe PID 2552 wrote to memory of 2548 2552 f7607ae.exe rundll32.exe PID 2552 wrote to memory of 2852 2552 f7607ae.exe rundll32.exe PID 2552 wrote to memory of 2852 2552 f7607ae.exe rundll32.exe PID 2852 wrote to memory of 2492 2852 rundll32.exe f760963.exe PID 2852 wrote to memory of 2492 2852 rundll32.exe f760963.exe PID 2852 wrote to memory of 2492 2852 rundll32.exe f760963.exe PID 2852 wrote to memory of 2492 2852 rundll32.exe f760963.exe PID 2852 wrote to memory of 2180 2852 rundll32.exe f762349.exe PID 2852 wrote to memory of 2180 2852 rundll32.exe f762349.exe PID 2852 wrote to memory of 2180 2852 rundll32.exe f762349.exe PID 2852 wrote to memory of 2180 2852 rundll32.exe f762349.exe PID 2552 wrote to memory of 1116 2552 f7607ae.exe taskhost.exe PID 2552 wrote to memory of 1176 2552 f7607ae.exe Dwm.exe PID 2552 wrote to memory of 1204 2552 f7607ae.exe Explorer.EXE PID 2552 wrote to memory of 2492 2552 f7607ae.exe f760963.exe PID 2552 wrote to memory of 2492 2552 f7607ae.exe f760963.exe PID 2552 wrote to memory of 2180 2552 f7607ae.exe f762349.exe PID 2552 wrote to memory of 2180 2552 f7607ae.exe f762349.exe PID 2180 wrote to memory of 1116 2180 f762349.exe taskhost.exe PID 2180 wrote to memory of 1176 2180 f762349.exe Dwm.exe PID 2180 wrote to memory of 1204 2180 f762349.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f7607ae.exef762349.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7607ae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762349.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0119edc4123b1b68c8c4a0c04e5468e95377ad200c594160a2c6abd3814c0299.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0119edc4123b1b68c8c4a0c04e5468e95377ad200c594160a2c6abd3814c0299.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7607ae.exeC:\Users\Admin\AppData\Local\Temp\f7607ae.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f760963.exeC:\Users\Admin\AppData\Local\Temp\f760963.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f762349.exeC:\Users\Admin\AppData\Local\Temp\f762349.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD52d84243781f04f24c691729d7a51906b
SHA18141d482b5fa19eeb54bed1434a5ac8aa02d510c
SHA256f17165e8daa2d02132bf921e044f38f2dc0eb7b5fc9264a2c25b746a749029b3
SHA5126e4b321b1a2dc8826e06a04d54d5d1c3ab5d88af74baf1daae9f7445cb1bc8ad453542de391ef0d111951591e54cc9dac03071680b39e92c2c4730d501c9df64
-
\Users\Admin\AppData\Local\Temp\f7607ae.exeFilesize
97KB
MD50868f90eca2af1776005dc0e60ab3f51
SHA13eb3f0a291e8b905db63087429aa31f7b381732b
SHA256d012e4abb20435587cb4c63883b705b7533eeca7911d03583c673d63e3c740e7
SHA5126d4a90884e24fb7c2af1cca18baac556633d7c4425e7276439f714bd113a4edd9a9376d4bfb245f83ae887da716d497fe80160a453cfeeb9092db5bf61f8de69
-
memory/1116-28-0x0000000001F90000-0x0000000001F92000-memory.dmpFilesize
8KB
-
memory/2180-97-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2180-165-0x0000000000A80000-0x0000000001B3A000-memory.dmpFilesize
16.7MB
-
memory/2180-197-0x0000000000A80000-0x0000000001B3A000-memory.dmpFilesize
16.7MB
-
memory/2180-198-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2180-98-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2180-100-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2180-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2492-149-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2492-91-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2492-92-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2492-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2492-99-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2552-59-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-21-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-45-0x00000000003B0000-0x00000000003B2000-memory.dmpFilesize
8KB
-
memory/2552-44-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB
-
memory/2552-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2552-144-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2552-12-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-55-0x00000000003B0000-0x00000000003B2000-memory.dmpFilesize
8KB
-
memory/2552-15-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-18-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-16-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-17-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-60-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-61-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-63-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-62-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-65-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-66-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-145-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-115-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-79-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-82-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-84-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-14-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-19-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-22-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-101-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-102-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2552-20-0x0000000000650000-0x000000000170A000-memory.dmpFilesize
16.7MB
-
memory/2852-54-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2852-57-0x0000000000200000-0x0000000000212000-memory.dmpFilesize
72KB
-
memory/2852-74-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2852-56-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2852-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2852-35-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2852-36-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2852-38-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2852-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2852-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB