Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 04:05
Static task
static1
Behavioral task
behavioral1
Sample
1a87df78564ed2cbcca969affa42d240_NeikiAnalytics.dll
Resource
win7-20240215-en
General
-
Target
1a87df78564ed2cbcca969affa42d240_NeikiAnalytics.dll
-
Size
120KB
-
MD5
1a87df78564ed2cbcca969affa42d240
-
SHA1
4a2d0c583557d69cffc878eaf96adae7831734ea
-
SHA256
17fafc3a0ec9df8f0c1f46460a88320d888feead12564b1c8f17175668174ea6
-
SHA512
5582ae29605d278c82dac9f1f23b3ea753ea046277be4413c3e364bde834cdfb8c5017ac8ba68d3c287edb144f83043823b16b289c4d3b32de80a7fd8e635367
-
SSDEEP
1536:ij5cZ3kyoIcSOPO3lgTZ1Src4veXXeFBGy0wpxSRrpcNOjaubf/IXMIbHd2m:i9c/oIcSO23lgEvmIBNBSbMMYv
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f7629ee.exef760e14.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f760e14.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f760e14.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7629ee.exe -
Processes:
f760e14.exef7629ee.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7629ee.exe -
Processes:
f760e14.exef7629ee.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760e14.exe -
Executes dropped EXE 3 IoCs
Processes:
f760e14.exef760f9a.exef7629ee.exepid process 1632 f760e14.exe 2656 f760f9a.exe 2580 f7629ee.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1632-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-23-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-22-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-61-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-62-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-64-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-67-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-68-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-83-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-84-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-87-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-103-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-104-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-106-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-108-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1632-146-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2580-167-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2580-200-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f760e14.exef7629ee.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760e14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7629ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760e14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7629ee.exe -
Processes:
f7629ee.exef760e14.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760e14.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f760e14.exef7629ee.exedescription ioc process File opened (read-only) \??\I: f760e14.exe File opened (read-only) \??\K: f760e14.exe File opened (read-only) \??\M: f760e14.exe File opened (read-only) \??\Q: f760e14.exe File opened (read-only) \??\T: f760e14.exe File opened (read-only) \??\H: f760e14.exe File opened (read-only) \??\O: f760e14.exe File opened (read-only) \??\S: f760e14.exe File opened (read-only) \??\G: f7629ee.exe File opened (read-only) \??\E: f760e14.exe File opened (read-only) \??\G: f760e14.exe File opened (read-only) \??\N: f760e14.exe File opened (read-only) \??\R: f760e14.exe File opened (read-only) \??\E: f7629ee.exe File opened (read-only) \??\J: f760e14.exe File opened (read-only) \??\L: f760e14.exe File opened (read-only) \??\P: f760e14.exe -
Drops file in Windows directory 3 IoCs
Processes:
f7629ee.exef760e14.exedescription ioc process File created C:\Windows\f765e36 f7629ee.exe File created C:\Windows\f760ea1 f760e14.exe File opened for modification C:\Windows\SYSTEM.INI f760e14.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f760e14.exef7629ee.exepid process 1632 f760e14.exe 1632 f760e14.exe 2580 f7629ee.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f760e14.exef7629ee.exedescription pid process Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 1632 f760e14.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe Token: SeDebugPrivilege 2580 f7629ee.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef760e14.exef7629ee.exedescription pid process target process PID 2260 wrote to memory of 1840 2260 rundll32.exe rundll32.exe PID 2260 wrote to memory of 1840 2260 rundll32.exe rundll32.exe PID 2260 wrote to memory of 1840 2260 rundll32.exe rundll32.exe PID 2260 wrote to memory of 1840 2260 rundll32.exe rundll32.exe PID 2260 wrote to memory of 1840 2260 rundll32.exe rundll32.exe PID 2260 wrote to memory of 1840 2260 rundll32.exe rundll32.exe PID 2260 wrote to memory of 1840 2260 rundll32.exe rundll32.exe PID 1840 wrote to memory of 1632 1840 rundll32.exe f760e14.exe PID 1840 wrote to memory of 1632 1840 rundll32.exe f760e14.exe PID 1840 wrote to memory of 1632 1840 rundll32.exe f760e14.exe PID 1840 wrote to memory of 1632 1840 rundll32.exe f760e14.exe PID 1632 wrote to memory of 1044 1632 f760e14.exe Dwm.exe PID 1632 wrote to memory of 1060 1632 f760e14.exe taskhost.exe PID 1632 wrote to memory of 1104 1632 f760e14.exe Explorer.EXE PID 1632 wrote to memory of 1544 1632 f760e14.exe DllHost.exe PID 1632 wrote to memory of 2260 1632 f760e14.exe rundll32.exe PID 1632 wrote to memory of 1840 1632 f760e14.exe rundll32.exe PID 1632 wrote to memory of 1840 1632 f760e14.exe rundll32.exe PID 1840 wrote to memory of 2656 1840 rundll32.exe f760f9a.exe PID 1840 wrote to memory of 2656 1840 rundll32.exe f760f9a.exe PID 1840 wrote to memory of 2656 1840 rundll32.exe f760f9a.exe PID 1840 wrote to memory of 2656 1840 rundll32.exe f760f9a.exe PID 1840 wrote to memory of 2580 1840 rundll32.exe f7629ee.exe PID 1840 wrote to memory of 2580 1840 rundll32.exe f7629ee.exe PID 1840 wrote to memory of 2580 1840 rundll32.exe f7629ee.exe PID 1840 wrote to memory of 2580 1840 rundll32.exe f7629ee.exe PID 1632 wrote to memory of 1044 1632 f760e14.exe Dwm.exe PID 1632 wrote to memory of 1060 1632 f760e14.exe taskhost.exe PID 1632 wrote to memory of 1104 1632 f760e14.exe Explorer.EXE PID 1632 wrote to memory of 2656 1632 f760e14.exe f760f9a.exe PID 1632 wrote to memory of 2656 1632 f760e14.exe f760f9a.exe PID 1632 wrote to memory of 2580 1632 f760e14.exe f7629ee.exe PID 1632 wrote to memory of 2580 1632 f760e14.exe f7629ee.exe PID 2580 wrote to memory of 1044 2580 f7629ee.exe Dwm.exe PID 2580 wrote to memory of 1060 2580 f7629ee.exe taskhost.exe PID 2580 wrote to memory of 1104 2580 f7629ee.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f7629ee.exef760e14.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7629ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760e14.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a87df78564ed2cbcca969affa42d240_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a87df78564ed2cbcca969affa42d240_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f760e14.exeC:\Users\Admin\AppData\Local\Temp\f760e14.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f760f9a.exeC:\Users\Admin\AppData\Local\Temp\f760f9a.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f7629ee.exeC:\Users\Admin\AppData\Local\Temp\f7629ee.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f760e14.exeFilesize
97KB
MD56310c73bcd7044acdbe7c23df589dfbc
SHA1b066d009828ac0c60480f8786f3806391df4edff
SHA256c80168fe2ce1e21d3942726eb9a2265ff52188eb4c1a7c035398388615be0551
SHA5126e114d519969aff876e17bd35ad6047d75d9e527955b64152073c43ec4638988d1724630a53c44a16354b9b4b2ee6e0fe3ab1076e8608babf09fe90200308dc9
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5203dcf46c017884539c552238c348434
SHA14387ad4ef3a04473d8cda36f2ef2ad9d174da375
SHA256e2c3100ba459f3f5f5cee65b09fa91b13b6faa0f31ad93adbbacafcb97b40352
SHA5124fe0b70c7bf0e8f72ebb5bd0f9f29cb0548b3a7d05e2ee179e1ef8b2d92a2e1e9b750339ec2c90148a56e4b0464e5f39a46c956e2f87a8810ed958f6882999ac
-
memory/1044-24-0x0000000001EA0000-0x0000000001EA2000-memory.dmpFilesize
8KB
-
memory/1632-63-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-64-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-15-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-14-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-19-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-16-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-17-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-21-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-41-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1632-23-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-104-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-55-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1632-60-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1632-106-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-108-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-83-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-145-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1632-67-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-22-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-20-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-18-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-103-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-87-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-61-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-65-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-84-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-62-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1632-146-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1632-68-0x0000000000590000-0x000000000164A000-memory.dmpFilesize
16.7MB
-
memory/1840-49-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1840-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1840-77-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1840-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1840-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1840-40-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1840-51-0x00000000002C0000-0x00000000002D2000-memory.dmpFilesize
72KB
-
memory/1840-52-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1840-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1840-30-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1840-31-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2580-167-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2580-100-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2580-102-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2580-99-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2580-81-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2580-200-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2580-201-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2656-94-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2656-95-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2656-101-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2656-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2656-53-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB