Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
254600be943591843fac7a5f1066d3b0_NeikiAnalytics.dll
Resource
win7-20231129-en
General
-
Target
254600be943591843fac7a5f1066d3b0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
254600be943591843fac7a5f1066d3b0
-
SHA1
867ec6de337d897bf9b110ca324b949897c1f8e4
-
SHA256
dafb705ca68bfc5fd7a93816a3884f00b61bf87e0136d4d35ad3530457edd278
-
SHA512
66e938146135f32f1e8e7368faa8baabc1762b036b1f80179a70bddfd9247742d88ea5ef0dc022746ef1d7f998223bc4a764a38984941e15e34fd0ed0f6cf92f
-
SSDEEP
3072:jwhcRIYe4oFLIDAhMmFdiAD3zog6SrSp8jtVNDk3:0uRIlLd7FzosrTtq
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f760751.exef76230b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f760751.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76230b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76230b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f760751.exe -
Processes:
f760751.exef76230b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76230b.exe -
Processes:
f760751.exef76230b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76230b.exe -
Executes dropped EXE 3 IoCs
Processes:
f760751.exef7608d7.exef76230b.exepid process 2208 f760751.exe 2472 f7608d7.exe 636 f76230b.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2344 rundll32.exe 2344 rundll32.exe 2344 rundll32.exe 2344 rundll32.exe 2344 rundll32.exe 2344 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2208-15-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-20-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-14-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-19-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-21-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-17-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-23-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-22-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-18-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-16-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-65-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-66-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-67-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-68-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-69-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-71-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-72-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-86-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-88-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-88-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-127-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2208-158-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/636-175-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/636-213-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Processes:
f760751.exef76230b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76230b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76230b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760751.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76230b.exe -
Processes:
f760751.exef76230b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76230b.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f760751.exef76230b.exedescription ioc process File opened (read-only) \??\H: f760751.exe File opened (read-only) \??\M: f760751.exe File opened (read-only) \??\S: f760751.exe File opened (read-only) \??\E: f760751.exe File opened (read-only) \??\K: f760751.exe File opened (read-only) \??\R: f760751.exe File opened (read-only) \??\E: f76230b.exe File opened (read-only) \??\G: f76230b.exe File opened (read-only) \??\G: f760751.exe File opened (read-only) \??\J: f760751.exe File opened (read-only) \??\N: f760751.exe File opened (read-only) \??\O: f760751.exe File opened (read-only) \??\Q: f760751.exe File opened (read-only) \??\I: f760751.exe File opened (read-only) \??\L: f760751.exe File opened (read-only) \??\P: f760751.exe File opened (read-only) \??\T: f760751.exe -
Drops file in Windows directory 3 IoCs
Processes:
f760751.exef76230b.exedescription ioc process File created C:\Windows\f76079f f760751.exe File opened for modification C:\Windows\SYSTEM.INI f760751.exe File created C:\Windows\f7657e0 f76230b.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f760751.exef76230b.exepid process 2208 f760751.exe 2208 f760751.exe 636 f76230b.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f760751.exef76230b.exedescription pid process Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 2208 f760751.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe Token: SeDebugPrivilege 636 f76230b.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef760751.exef76230b.exedescription pid process target process PID 1720 wrote to memory of 2344 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2344 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2344 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2344 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2344 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2344 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2344 1720 rundll32.exe rundll32.exe PID 2344 wrote to memory of 2208 2344 rundll32.exe f760751.exe PID 2344 wrote to memory of 2208 2344 rundll32.exe f760751.exe PID 2344 wrote to memory of 2208 2344 rundll32.exe f760751.exe PID 2344 wrote to memory of 2208 2344 rundll32.exe f760751.exe PID 2208 wrote to memory of 1288 2208 f760751.exe taskhost.exe PID 2208 wrote to memory of 1348 2208 f760751.exe Dwm.exe PID 2208 wrote to memory of 1376 2208 f760751.exe Explorer.EXE PID 2208 wrote to memory of 772 2208 f760751.exe DllHost.exe PID 2208 wrote to memory of 1720 2208 f760751.exe rundll32.exe PID 2208 wrote to memory of 2344 2208 f760751.exe rundll32.exe PID 2208 wrote to memory of 2344 2208 f760751.exe rundll32.exe PID 2344 wrote to memory of 2472 2344 rundll32.exe f7608d7.exe PID 2344 wrote to memory of 2472 2344 rundll32.exe f7608d7.exe PID 2344 wrote to memory of 2472 2344 rundll32.exe f7608d7.exe PID 2344 wrote to memory of 2472 2344 rundll32.exe f7608d7.exe PID 2344 wrote to memory of 636 2344 rundll32.exe f76230b.exe PID 2344 wrote to memory of 636 2344 rundll32.exe f76230b.exe PID 2344 wrote to memory of 636 2344 rundll32.exe f76230b.exe PID 2344 wrote to memory of 636 2344 rundll32.exe f76230b.exe PID 2208 wrote to memory of 1288 2208 f760751.exe taskhost.exe PID 2208 wrote to memory of 1348 2208 f760751.exe Dwm.exe PID 2208 wrote to memory of 1376 2208 f760751.exe Explorer.EXE PID 2208 wrote to memory of 2472 2208 f760751.exe f7608d7.exe PID 2208 wrote to memory of 2472 2208 f760751.exe f7608d7.exe PID 2208 wrote to memory of 636 2208 f760751.exe f76230b.exe PID 2208 wrote to memory of 636 2208 f760751.exe f76230b.exe PID 636 wrote to memory of 1288 636 f76230b.exe taskhost.exe PID 636 wrote to memory of 1348 636 f76230b.exe Dwm.exe PID 636 wrote to memory of 1376 636 f76230b.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f760751.exef76230b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760751.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76230b.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1288
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1348
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1376
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\254600be943591843fac7a5f1066d3b0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\254600be943591843fac7a5f1066d3b0_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\f760751.exeC:\Users\Admin\AppData\Local\Temp\f760751.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\f7608d7.exeC:\Users\Admin\AppData\Local\Temp\f7608d7.exe4⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\f76230b.exeC:\Users\Admin\AppData\Local\Temp\f76230b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:636
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:772
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
256B
MD550ed9d7505969e8a59f7f2ad0400f493
SHA1b7fa7b328fc09b43dc8c6bbf4c92f29588636767
SHA256d6461993493fecdae8660bee0c6711484a49e30857502938be2e6945980a6491
SHA5129c396009d2bc29db76cc2dffd53d61916b28210b7d1c48361df2bca5b1af3452d9d4a17fe44763ef9184ba7e68620bd31b1d6b3d37ad7f5b5c3c3d7f26ff3ed5
-
\Users\Admin\AppData\Local\Temp\f760751.exeFilesize
97KB
MD5c71414be53e3ef70c0911dba80de975c
SHA1d4d3a429b65d65a1e9bc8afa6a6d9bd0cf327421
SHA2565f3b68ce820223c17d66c52418fd7675f378e67f594519645a210f15614b82cf
SHA512a461367e7c8fc87cb2e88697b002124c1e2b1131f744e088b60c35d7d1d55d694a130680bda14e5ff85f774a0335dfc8f35f8262cbd6883a90e46614e88f1293
-
memory/636-212-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/636-213-0x0000000000930000-0x00000000019EA000-memory.dmpFilesize
16.7MB
-
memory/636-175-0x0000000000930000-0x00000000019EA000-memory.dmpFilesize
16.7MB
-
memory/636-108-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/636-105-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/636-85-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1288-29-0x0000000002170000-0x0000000002172000-memory.dmpFilesize
8KB
-
memory/2208-66-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-21-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-23-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2208-52-0x0000000003040000-0x0000000003042000-memory.dmpFilesize
8KB
-
memory/2208-50-0x0000000003050000-0x0000000003051000-memory.dmpFilesize
4KB
-
memory/2208-15-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-22-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-157-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2208-158-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-127-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-17-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-61-0x0000000003040000-0x0000000003042000-memory.dmpFilesize
8KB
-
memory/2208-86-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-18-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-16-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-20-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-65-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-14-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-67-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-68-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-69-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-71-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-72-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-19-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-88-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2208-88-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2344-39-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2344-49-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2344-83-0x0000000000170000-0x0000000000172000-memory.dmpFilesize
8KB
-
memory/2344-9-0x0000000000170000-0x0000000000182000-memory.dmpFilesize
72KB
-
memory/2344-80-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2344-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2344-59-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2344-8-0x0000000000170000-0x0000000000182000-memory.dmpFilesize
72KB
-
memory/2344-62-0x0000000000280000-0x0000000000292000-memory.dmpFilesize
72KB
-
memory/2344-63-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2344-40-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2472-98-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2472-162-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2472-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2472-107-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2472-99-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB