Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 05:31
Static task
static1
Behavioral task
behavioral1
Sample
35f3a890d7e3b1a4cb68773ce139af90_NeikiAnalytics.dll
Resource
win7-20231129-en
General
-
Target
35f3a890d7e3b1a4cb68773ce139af90_NeikiAnalytics.dll
-
Size
120KB
-
MD5
35f3a890d7e3b1a4cb68773ce139af90
-
SHA1
2144c99316d79531aaff77c0b255f249676d5133
-
SHA256
cdc76301238b085a90312234fb7ab97167f31ca4f6d98a032b31719b63cc2b63
-
SHA512
c27f118f50c1f2739dfd26a363ab4f2521701ad31ed8e6e17d7448c150ed3a7e0ac979874f0829b9138261ed1a97ec523963572b01017685fa2ad8a6df8a8fce
-
SSDEEP
3072:CZvqRQCf/iVrRO6USflAdcJDC+pH05YpxdYITz:CiRQRROJdcm+VcA/Y6z
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f763469.exef7618af.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763469.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763469.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763469.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7618af.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7618af.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7618af.exe -
Processes:
f7618af.exef763469.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763469.exe -
Processes:
f763469.exef7618af.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763469.exe -
Executes dropped EXE 3 IoCs
Processes:
f7618af.exef761bab.exef763469.exepid process 2132 f7618af.exe 2724 f761bab.exe 2492 f763469.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1620 rundll32.exe 1620 rundll32.exe 1620 rundll32.exe 1620 rundll32.exe 1620 rundll32.exe 1620 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2132-12-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-18-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-16-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-17-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-20-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-15-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-21-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-14-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-19-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-22-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-61-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-62-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-63-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-65-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-64-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-67-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-68-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-82-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-83-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-85-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-87-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-88-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-128-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2132-153-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2492-172-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/2492-206-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Processes:
f7618af.exef763469.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763469.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763469.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763469.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763469.exe -
Processes:
f7618af.exef763469.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763469.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7618af.exef763469.exedescription ioc process File opened (read-only) \??\K: f7618af.exe File opened (read-only) \??\N: f7618af.exe File opened (read-only) \??\O: f7618af.exe File opened (read-only) \??\S: f7618af.exe File opened (read-only) \??\E: f7618af.exe File opened (read-only) \??\L: f7618af.exe File opened (read-only) \??\M: f7618af.exe File opened (read-only) \??\P: f7618af.exe File opened (read-only) \??\G: f7618af.exe File opened (read-only) \??\J: f7618af.exe File opened (read-only) \??\Q: f7618af.exe File opened (read-only) \??\R: f7618af.exe File opened (read-only) \??\H: f7618af.exe File opened (read-only) \??\I: f7618af.exe File opened (read-only) \??\T: f7618af.exe File opened (read-only) \??\E: f763469.exe -
Drops file in Windows directory 3 IoCs
Processes:
f7618af.exef763469.exedescription ioc process File created C:\Windows\f76191c f7618af.exe File opened for modification C:\Windows\SYSTEM.INI f7618af.exe File created C:\Windows\f766ae3 f763469.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f7618af.exef763469.exepid process 2132 f7618af.exe 2132 f7618af.exe 2492 f763469.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f7618af.exef763469.exedescription pid process Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2132 f7618af.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe Token: SeDebugPrivilege 2492 f763469.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef7618af.exef763469.exedescription pid process target process PID 1712 wrote to memory of 1620 1712 rundll32.exe rundll32.exe PID 1712 wrote to memory of 1620 1712 rundll32.exe rundll32.exe PID 1712 wrote to memory of 1620 1712 rundll32.exe rundll32.exe PID 1712 wrote to memory of 1620 1712 rundll32.exe rundll32.exe PID 1712 wrote to memory of 1620 1712 rundll32.exe rundll32.exe PID 1712 wrote to memory of 1620 1712 rundll32.exe rundll32.exe PID 1712 wrote to memory of 1620 1712 rundll32.exe rundll32.exe PID 1620 wrote to memory of 2132 1620 rundll32.exe f7618af.exe PID 1620 wrote to memory of 2132 1620 rundll32.exe f7618af.exe PID 1620 wrote to memory of 2132 1620 rundll32.exe f7618af.exe PID 1620 wrote to memory of 2132 1620 rundll32.exe f7618af.exe PID 2132 wrote to memory of 1268 2132 f7618af.exe taskhost.exe PID 2132 wrote to memory of 1348 2132 f7618af.exe Dwm.exe PID 2132 wrote to memory of 1380 2132 f7618af.exe Explorer.EXE PID 2132 wrote to memory of 1460 2132 f7618af.exe DllHost.exe PID 2132 wrote to memory of 1712 2132 f7618af.exe rundll32.exe PID 2132 wrote to memory of 1620 2132 f7618af.exe rundll32.exe PID 2132 wrote to memory of 1620 2132 f7618af.exe rundll32.exe PID 1620 wrote to memory of 2724 1620 rundll32.exe f761bab.exe PID 1620 wrote to memory of 2724 1620 rundll32.exe f761bab.exe PID 1620 wrote to memory of 2724 1620 rundll32.exe f761bab.exe PID 1620 wrote to memory of 2724 1620 rundll32.exe f761bab.exe PID 1620 wrote to memory of 2492 1620 rundll32.exe f763469.exe PID 1620 wrote to memory of 2492 1620 rundll32.exe f763469.exe PID 1620 wrote to memory of 2492 1620 rundll32.exe f763469.exe PID 1620 wrote to memory of 2492 1620 rundll32.exe f763469.exe PID 2132 wrote to memory of 1268 2132 f7618af.exe taskhost.exe PID 2132 wrote to memory of 1348 2132 f7618af.exe Dwm.exe PID 2132 wrote to memory of 1380 2132 f7618af.exe Explorer.EXE PID 2132 wrote to memory of 2724 2132 f7618af.exe f761bab.exe PID 2132 wrote to memory of 2724 2132 f7618af.exe f761bab.exe PID 2132 wrote to memory of 2492 2132 f7618af.exe f763469.exe PID 2132 wrote to memory of 2492 2132 f7618af.exe f763469.exe PID 2492 wrote to memory of 1268 2492 f763469.exe taskhost.exe PID 2492 wrote to memory of 1348 2492 f763469.exe Dwm.exe PID 2492 wrote to memory of 1380 2492 f763469.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f7618af.exef763469.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7618af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763469.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1268
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1348
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1380
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35f3a890d7e3b1a4cb68773ce139af90_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35f3a890d7e3b1a4cb68773ce139af90_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\f7618af.exeC:\Users\Admin\AppData\Local\Temp\f7618af.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\f761bab.exeC:\Users\Admin\AppData\Local\Temp\f761bab.exe4⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\f763469.exeC:\Users\Admin\AppData\Local\Temp\f763469.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2492
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1460
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD543cafc28ae1676baaf97b7804e0697a5
SHA13e8f7fcbec680879e533ee6193d7ed1ab571fa26
SHA2561c70a57e1ac44481f79c98d1becb6932d1ae7351e577d0a6a461c42913d5f240
SHA51265aa71fd7b975f303069f2765e02b6b8b3a6a7f3c7cca4862452ac5344b4c879674f243f7499dc664e58908a62c5f1fad8335e1cb440c2e30c38693cac58b6c7
-
\Users\Admin\AppData\Local\Temp\f7618af.exeFilesize
97KB
MD587e949414d9d9fe0f4f0e8e3faa4146f
SHA153a09ab06bf8cead7405db15cedf13b3a3aa592e
SHA25695b0f61f78a607c370c07ddb872e38640a6c65d114616f824673662d417173f1
SHA51234be5b1fd919fe751ddd0dc187cd9becda325cd90ede5fde4be7bcac3733f2ebf99c3f5cf537d37fde85630b0e5cc7618fa89f258a3f1200aec3b2b219716350
-
memory/1268-28-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1620-58-0x0000000000330000-0x0000000000342000-memory.dmpFilesize
72KB
-
memory/1620-7-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1620-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1620-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1620-40-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1620-56-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1620-37-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1620-60-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1620-38-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2132-61-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-62-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-20-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-15-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-21-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-14-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-19-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-22-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-47-0x00000000040A0000-0x00000000040A2000-memory.dmpFilesize
8KB
-
memory/2132-46-0x00000000040F0000-0x00000000040F1000-memory.dmpFilesize
4KB
-
memory/2132-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2132-16-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-57-0x00000000040A0000-0x00000000040A2000-memory.dmpFilesize
8KB
-
memory/2132-18-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-12-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-128-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-63-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-65-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-64-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-67-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-68-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-17-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-82-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-83-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-85-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-87-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-88-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-153-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2132-152-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2132-129-0x00000000040A0000-0x00000000040A2000-memory.dmpFilesize
8KB
-
memory/2492-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2492-108-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2492-109-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2492-172-0x0000000000930000-0x00000000019EA000-memory.dmpFilesize
16.7MB
-
memory/2492-205-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2492-206-0x0000000000930000-0x00000000019EA000-memory.dmpFilesize
16.7MB
-
memory/2724-107-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2724-98-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2724-99-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2724-157-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2724-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB