Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 13:08
Static task
static1
Behavioral task
behavioral1
Sample
2eb2d78f9afa9955e06048b34ccb2c20_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
2eb2d78f9afa9955e06048b34ccb2c20_NeikiAnalytics.dll
-
Size
120KB
-
MD5
2eb2d78f9afa9955e06048b34ccb2c20
-
SHA1
ac008bdfbdd30068ca015565cd9667be1781b63e
-
SHA256
b4069d0d407a0085f2cb99c077a5d4af009f516449bcdef3bcf22fe2ec6a2871
-
SHA512
852f1a56c12d97930c0b7e4f823b42c300ba54c266d5db019476368d7914284b509e3cf419f740bb38d038b880c84f982cb514bc6eedd5300963639d8217d02f
-
SSDEEP
1536:uGeTQHhO4ZiNq1YzXiCIIhrsIJmN7EjrGJsIddOOQBUbSrQvu4fPd5UxFUxm6HRF:h0Go4z1YzyCN9mK+HWULvu4LH/
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f762fb8.exef7613fe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7613fe.exe -
Processes:
f762fb8.exef7613fe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7613fe.exe -
Processes:
f762fb8.exef7613fe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762fb8.exe -
Executes dropped EXE 3 IoCs
Processes:
f7613fe.exef761593.exef762fb8.exepid process 3020 f7613fe.exe 2948 f761593.exe 2920 f762fb8.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/3020-20-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-23-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-21-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-22-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-14-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-19-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-18-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-17-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-16-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-15-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-62-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-63-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-64-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-65-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-66-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-68-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-69-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-83-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-85-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-87-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3020-157-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2920-177-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2920-213-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Processes:
f762fb8.exef7613fe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762fb8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762fb8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7613fe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7613fe.exe -
Processes:
f7613fe.exef762fb8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762fb8.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7613fe.exef762fb8.exedescription ioc process File opened (read-only) \??\G: f7613fe.exe File opened (read-only) \??\I: f7613fe.exe File opened (read-only) \??\J: f7613fe.exe File opened (read-only) \??\K: f7613fe.exe File opened (read-only) \??\L: f7613fe.exe File opened (read-only) \??\O: f7613fe.exe File opened (read-only) \??\R: f7613fe.exe File opened (read-only) \??\E: f762fb8.exe File opened (read-only) \??\G: f762fb8.exe File opened (read-only) \??\E: f7613fe.exe File opened (read-only) \??\N: f7613fe.exe File opened (read-only) \??\S: f7613fe.exe File opened (read-only) \??\H: f7613fe.exe File opened (read-only) \??\M: f7613fe.exe File opened (read-only) \??\P: f7613fe.exe File opened (read-only) \??\Q: f7613fe.exe File opened (read-only) \??\T: f7613fe.exe -
Drops file in Windows directory 3 IoCs
Processes:
f7613fe.exef762fb8.exedescription ioc process File created C:\Windows\f76144c f7613fe.exe File opened for modification C:\Windows\SYSTEM.INI f7613fe.exe File created C:\Windows\f76647d f762fb8.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f7613fe.exef762fb8.exepid process 3020 f7613fe.exe 3020 f7613fe.exe 2920 f762fb8.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f7613fe.exef762fb8.exedescription pid process Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 3020 f7613fe.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe Token: SeDebugPrivilege 2920 f762fb8.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef7613fe.exef762fb8.exedescription pid process target process PID 2936 wrote to memory of 2372 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2372 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2372 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2372 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2372 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2372 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2372 2936 rundll32.exe rundll32.exe PID 2372 wrote to memory of 3020 2372 rundll32.exe f7613fe.exe PID 2372 wrote to memory of 3020 2372 rundll32.exe f7613fe.exe PID 2372 wrote to memory of 3020 2372 rundll32.exe f7613fe.exe PID 2372 wrote to memory of 3020 2372 rundll32.exe f7613fe.exe PID 3020 wrote to memory of 1124 3020 f7613fe.exe taskhost.exe PID 3020 wrote to memory of 1168 3020 f7613fe.exe Dwm.exe PID 3020 wrote to memory of 1200 3020 f7613fe.exe Explorer.EXE PID 3020 wrote to memory of 2016 3020 f7613fe.exe DllHost.exe PID 3020 wrote to memory of 2936 3020 f7613fe.exe rundll32.exe PID 3020 wrote to memory of 2372 3020 f7613fe.exe rundll32.exe PID 3020 wrote to memory of 2372 3020 f7613fe.exe rundll32.exe PID 2372 wrote to memory of 2948 2372 rundll32.exe f761593.exe PID 2372 wrote to memory of 2948 2372 rundll32.exe f761593.exe PID 2372 wrote to memory of 2948 2372 rundll32.exe f761593.exe PID 2372 wrote to memory of 2948 2372 rundll32.exe f761593.exe PID 2372 wrote to memory of 2920 2372 rundll32.exe f762fb8.exe PID 2372 wrote to memory of 2920 2372 rundll32.exe f762fb8.exe PID 2372 wrote to memory of 2920 2372 rundll32.exe f762fb8.exe PID 2372 wrote to memory of 2920 2372 rundll32.exe f762fb8.exe PID 3020 wrote to memory of 1124 3020 f7613fe.exe taskhost.exe PID 3020 wrote to memory of 1168 3020 f7613fe.exe Dwm.exe PID 3020 wrote to memory of 1200 3020 f7613fe.exe Explorer.EXE PID 3020 wrote to memory of 2948 3020 f7613fe.exe f761593.exe PID 3020 wrote to memory of 2948 3020 f7613fe.exe f761593.exe PID 3020 wrote to memory of 2920 3020 f7613fe.exe f762fb8.exe PID 3020 wrote to memory of 2920 3020 f7613fe.exe f762fb8.exe PID 2920 wrote to memory of 1124 2920 f762fb8.exe taskhost.exe PID 2920 wrote to memory of 1168 2920 f762fb8.exe Dwm.exe PID 2920 wrote to memory of 1200 2920 f762fb8.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f7613fe.exef762fb8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7613fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762fb8.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2eb2d78f9afa9955e06048b34ccb2c20_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2eb2d78f9afa9955e06048b34ccb2c20_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7613fe.exeC:\Users\Admin\AppData\Local\Temp\f7613fe.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f761593.exeC:\Users\Admin\AppData\Local\Temp\f761593.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f762fb8.exeC:\Users\Admin\AppData\Local\Temp\f762fb8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
255B
MD5805e99f5e1d1ef6938eb06e9fa33d38c
SHA1b126c46037722004b93841dc89d168c368b1733c
SHA256cb00988f43e80b5a7a237fad8c6870a278c8e18ea66805fb87456cf5ea83717d
SHA51254cad6d6d9e68402179ea73dc0aed7b4cc8eeb203a1d09c31ed5ef440f8b69f3fcb9e673cd50de88d80dcf2d5e5dd7dfa656ad08009b6357c798f69d65c0657e
-
\Users\Admin\AppData\Local\Temp\f7613fe.exeFilesize
97KB
MD572402f2bed113564debc1da315d0bf51
SHA1191539fba422a1ce523874b6d76f06544fc293b9
SHA256944f957cb902bdb05fe21fd5fdc206847c79ef1cb624cd29880a0a399e87c078
SHA5122e854530d105437c07c31e358548656534d53255640f84fe0115174e471be63a727bcedd0e86d9e280ef189a9cd3bfe9565ce4465f311e3463a9d5b5d99d6be8
-
memory/1124-29-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB
-
memory/2372-38-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2372-10-0x00000000001B0000-0x00000000001C2000-memory.dmpFilesize
72KB
-
memory/2372-80-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2372-56-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2372-37-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2372-9-0x00000000001B0000-0x00000000001C2000-memory.dmpFilesize
72KB
-
memory/2372-77-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2372-46-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2372-59-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2372-58-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/2372-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2920-213-0x0000000000910000-0x00000000019CA000-memory.dmpFilesize
16.7MB
-
memory/2920-106-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2920-108-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2920-105-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2920-177-0x0000000000910000-0x00000000019CA000-memory.dmpFilesize
16.7MB
-
memory/2920-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2920-212-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2948-107-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2948-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2948-162-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2948-98-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2948-99-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/3020-65-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-21-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-64-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-18-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-66-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-68-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-69-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-19-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-14-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-22-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-83-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-85-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-87-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-63-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-57-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/3020-62-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-23-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-15-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-16-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-123-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/3020-158-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3020-157-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-17-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-49-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/3020-47-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/3020-20-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/3020-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB