Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:57
Static task
static1
Behavioral task
behavioral1
Sample
5d474feac1117f7231ede9e2eb5c8490_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
5d474feac1117f7231ede9e2eb5c8490_NeikiAnalytics.dll
-
Size
120KB
-
MD5
5d474feac1117f7231ede9e2eb5c8490
-
SHA1
0a9271a9e5530837ec0ea0102508d6c0eef0e7fd
-
SHA256
f7c73c5c22e2f66edd16975f69c6cdc7a50e166e6a4fdaa82c780a83d3048afb
-
SHA512
f7079e4501a1141511156d714cc4190905a2986f76e3b00344602057c336dfaa00e85582ae315c667a2c38a5bf49675ac8005449a4e40cfb4b6f99849b34be2f
-
SSDEEP
1536:A43OHt+Jq8kbq74LtwGTV/P9lIru+irDYeb7ugGSH6IDtU6eVjP4LbtGqd0I7/:ADHtBLtwGvl7N/YqugGiDtUJP4LbYQn
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f7693e6.exef76909c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76909c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76909c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76909c.exe -
Processes:
f76909c.exef7693e6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7693e6.exe -
Processes:
f7693e6.exef76909c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7693e6.exe -
Executes dropped EXE 3 IoCs
Processes:
f76909c.exef7693e6.exef76ab1e.exepid process 2100 f76909c.exe 2628 f7693e6.exe 700 f76ab1e.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2100-12-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-19-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-15-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-20-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-22-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-21-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-18-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-17-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-16-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-14-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-62-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-61-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-63-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-65-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-64-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-67-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-83-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-84-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-85-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-88-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-108-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-109-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2100-155-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2628-172-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx -
Processes:
f76909c.exef7693e6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7693e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7693e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7693e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7693e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7693e6.exe -
Processes:
f76909c.exef7693e6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7693e6.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f76909c.exedescription ioc process File opened (read-only) \??\L: f76909c.exe File opened (read-only) \??\O: f76909c.exe File opened (read-only) \??\H: f76909c.exe File opened (read-only) \??\M: f76909c.exe File opened (read-only) \??\R: f76909c.exe File opened (read-only) \??\E: f76909c.exe File opened (read-only) \??\G: f76909c.exe File opened (read-only) \??\I: f76909c.exe File opened (read-only) \??\K: f76909c.exe File opened (read-only) \??\N: f76909c.exe File opened (read-only) \??\S: f76909c.exe File opened (read-only) \??\J: f76909c.exe File opened (read-only) \??\P: f76909c.exe File opened (read-only) \??\Q: f76909c.exe -
Drops file in Windows directory 3 IoCs
Processes:
f76909c.exef7693e6.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI f76909c.exe File created C:\Windows\f76e234 f7693e6.exe File created C:\Windows\f769157 f76909c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f76909c.exepid process 2100 f76909c.exe 2100 f76909c.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f76909c.exedescription pid process Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe Token: SeDebugPrivilege 2100 f76909c.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef76909c.exedescription pid process target process PID 2860 wrote to memory of 2904 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2904 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2904 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2904 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2904 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2904 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2904 2860 rundll32.exe rundll32.exe PID 2904 wrote to memory of 2100 2904 rundll32.exe f76909c.exe PID 2904 wrote to memory of 2100 2904 rundll32.exe f76909c.exe PID 2904 wrote to memory of 2100 2904 rundll32.exe f76909c.exe PID 2904 wrote to memory of 2100 2904 rundll32.exe f76909c.exe PID 2100 wrote to memory of 1192 2100 f76909c.exe taskhost.exe PID 2100 wrote to memory of 1292 2100 f76909c.exe Dwm.exe PID 2100 wrote to memory of 1352 2100 f76909c.exe Explorer.EXE PID 2100 wrote to memory of 1824 2100 f76909c.exe DllHost.exe PID 2100 wrote to memory of 2860 2100 f76909c.exe rundll32.exe PID 2100 wrote to memory of 2904 2100 f76909c.exe rundll32.exe PID 2100 wrote to memory of 2904 2100 f76909c.exe rundll32.exe PID 2904 wrote to memory of 2628 2904 rundll32.exe f7693e6.exe PID 2904 wrote to memory of 2628 2904 rundll32.exe f7693e6.exe PID 2904 wrote to memory of 2628 2904 rundll32.exe f7693e6.exe PID 2904 wrote to memory of 2628 2904 rundll32.exe f7693e6.exe PID 2904 wrote to memory of 700 2904 rundll32.exe f76ab1e.exe PID 2904 wrote to memory of 700 2904 rundll32.exe f76ab1e.exe PID 2904 wrote to memory of 700 2904 rundll32.exe f76ab1e.exe PID 2904 wrote to memory of 700 2904 rundll32.exe f76ab1e.exe PID 2100 wrote to memory of 1192 2100 f76909c.exe taskhost.exe PID 2100 wrote to memory of 1292 2100 f76909c.exe Dwm.exe PID 2100 wrote to memory of 1352 2100 f76909c.exe Explorer.EXE PID 2100 wrote to memory of 2628 2100 f76909c.exe f7693e6.exe PID 2100 wrote to memory of 2628 2100 f76909c.exe f7693e6.exe PID 2100 wrote to memory of 700 2100 f76909c.exe f76ab1e.exe PID 2100 wrote to memory of 700 2100 f76909c.exe f76ab1e.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
f76909c.exef7693e6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76909c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7693e6.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d474feac1117f7231ede9e2eb5c8490_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d474feac1117f7231ede9e2eb5c8490_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f76909c.exeC:\Users\Admin\AppData\Local\Temp\f76909c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f7693e6.exeC:\Users\Admin\AppData\Local\Temp\f7693e6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76ab1e.exeC:\Users\Admin\AppData\Local\Temp\f76ab1e.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
255B
MD5b2aea8ac2335f5e0478def26291e282f
SHA18f58885ce15923e1dacdcf76101531cdfec3a3c0
SHA256aab14776b4483935596dbe7671983382da0e5378e669eba1b9a9696e52dca864
SHA512ff9a2168605384a7734c3dbeba897c395caea46976db2d57cb407534f952581bd2a15039f685ed21fe61f1bff14c738a5af918b0d45f41020de4eb8c01de8e86
-
\Users\Admin\AppData\Local\Temp\f76909c.exeFilesize
97KB
MD5ad91b7722b9454d9d8a97546a2d57cb7
SHA1f68553e2caa03b98a43829a71efc0758466444b2
SHA256a8cab30ec21d47137d7d7dbc48065c024af4fa0e621be21a9eeb3faed26b9706
SHA5124afb93380cb4ad0ce345fc0a91776ce032efdefe2309cf67db5b8711e1d5ca4bf6dafbc039c624df4735171665864e984b06893d155360b560312dc3e203ef51
-
memory/700-176-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/700-102-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/700-105-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/700-104-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/700-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1192-28-0x00000000002D0000-0x00000000002D2000-memory.dmpFilesize
8KB
-
memory/2100-63-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-17-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-154-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2100-155-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-135-0x00000000004C0000-0x00000000004C2000-memory.dmpFilesize
8KB
-
memory/2100-109-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-20-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-108-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-56-0x00000000004C0000-0x00000000004C2000-memory.dmpFilesize
8KB
-
memory/2100-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2100-46-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/2100-22-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-21-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-48-0x00000000004C0000-0x00000000004C2000-memory.dmpFilesize
8KB
-
memory/2100-18-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-83-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-16-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-14-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-62-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-61-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-12-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-65-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-64-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-67-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-19-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-88-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-15-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-85-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2100-84-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/2628-106-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2628-96-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2628-177-0x00000000009C0000-0x0000000001A7A000-memory.dmpFilesize
16.7MB
-
memory/2628-172-0x00000000009C0000-0x0000000001A7A000-memory.dmpFilesize
16.7MB
-
memory/2628-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2628-171-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2628-103-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2904-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2904-55-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2904-45-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2904-57-0x00000000001D0000-0x00000000001E2000-memory.dmpFilesize
72KB
-
memory/2904-35-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2904-36-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2904-58-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2904-80-0x00000000001F0000-0x0000000000202000-memory.dmpFilesize
72KB
-
memory/2904-79-0x0000000000160000-0x0000000000166000-memory.dmpFilesize
24KB
-
memory/2904-7-0x0000000000160000-0x0000000000172000-memory.dmpFilesize
72KB
-
memory/2904-75-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2904-9-0x0000000000160000-0x0000000000172000-memory.dmpFilesize
72KB
-
memory/2904-81-0x00000000001F0000-0x0000000000202000-memory.dmpFilesize
72KB