Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
338e1dfc2b07ff5f5c0c130cd2bfb670_NeikiAnalytics.dll
Resource
win7-20240419-en
General
-
Target
338e1dfc2b07ff5f5c0c130cd2bfb670_NeikiAnalytics.dll
-
Size
120KB
-
MD5
338e1dfc2b07ff5f5c0c130cd2bfb670
-
SHA1
4c3dfec49b6e626a88621d1d8a6e56fb7e1d7f76
-
SHA256
b77c535a4a6c5b9799e0d9b0e123a990acd45be1d59ded0d62550aead8cdd853
-
SHA512
3c2c8165398ef237edae7bc4990b06f78cad39092b8a720dde5d0a30f6c145fd531622390903764474826753e4c2153772c6f10c469b0df49a25c837130c937f
-
SSDEEP
1536:0q/yJ2X7NBe7vj0gFDMYhxmPHur6QDUyS/Gis0mYJ8cU7g:0q/yj7ARYhY+705JA
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f7613bf.exef761536.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761536.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761536.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761536.exe -
Processes:
f7613bf.exef761536.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761536.exe -
Processes:
f761536.exef7613bf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7613bf.exe -
Executes dropped EXE 3 IoCs
Processes:
f7613bf.exef761536.exef7631e9.exepid process 2312 f7613bf.exe 2516 f761536.exe 2164 f7631e9.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2312-15-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-17-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-19-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-16-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-14-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-20-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-22-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-18-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-23-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-21-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-62-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-63-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-64-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-66-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-65-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-81-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-82-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-83-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-103-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-104-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-106-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-107-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2312-143-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2516-153-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2516-181-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f7613bf.exef761536.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761536.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7613bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761536.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761536.exe -
Processes:
f7613bf.exef761536.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761536.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7613bf.exedescription ioc process File opened (read-only) \??\K: f7613bf.exe File opened (read-only) \??\M: f7613bf.exe File opened (read-only) \??\N: f7613bf.exe File opened (read-only) \??\E: f7613bf.exe File opened (read-only) \??\J: f7613bf.exe File opened (read-only) \??\I: f7613bf.exe File opened (read-only) \??\L: f7613bf.exe File opened (read-only) \??\O: f7613bf.exe File opened (read-only) \??\P: f7613bf.exe File opened (read-only) \??\Q: f7613bf.exe File opened (read-only) \??\G: f7613bf.exe File opened (read-only) \??\H: f7613bf.exe -
Drops file in Windows directory 3 IoCs
Processes:
f761536.exef7613bf.exedescription ioc process File created C:\Windows\f76643f f761536.exe File created C:\Windows\f76140d f7613bf.exe File opened for modification C:\Windows\SYSTEM.INI f7613bf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f7613bf.exef761536.exepid process 2312 f7613bf.exe 2312 f7613bf.exe 2516 f761536.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f7613bf.exef761536.exedescription pid process Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2312 f7613bf.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe Token: SeDebugPrivilege 2516 f761536.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef7613bf.exef761536.exedescription pid process target process PID 3000 wrote to memory of 3028 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3028 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3028 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3028 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3028 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3028 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3028 3000 rundll32.exe rundll32.exe PID 3028 wrote to memory of 2312 3028 rundll32.exe f7613bf.exe PID 3028 wrote to memory of 2312 3028 rundll32.exe f7613bf.exe PID 3028 wrote to memory of 2312 3028 rundll32.exe f7613bf.exe PID 3028 wrote to memory of 2312 3028 rundll32.exe f7613bf.exe PID 2312 wrote to memory of 1072 2312 f7613bf.exe taskhost.exe PID 2312 wrote to memory of 1080 2312 f7613bf.exe Dwm.exe PID 2312 wrote to memory of 1152 2312 f7613bf.exe Explorer.EXE PID 2312 wrote to memory of 2120 2312 f7613bf.exe DllHost.exe PID 2312 wrote to memory of 3000 2312 f7613bf.exe rundll32.exe PID 2312 wrote to memory of 3028 2312 f7613bf.exe rundll32.exe PID 2312 wrote to memory of 3028 2312 f7613bf.exe rundll32.exe PID 3028 wrote to memory of 2516 3028 rundll32.exe f761536.exe PID 3028 wrote to memory of 2516 3028 rundll32.exe f761536.exe PID 3028 wrote to memory of 2516 3028 rundll32.exe f761536.exe PID 3028 wrote to memory of 2516 3028 rundll32.exe f761536.exe PID 3028 wrote to memory of 2164 3028 rundll32.exe f7631e9.exe PID 3028 wrote to memory of 2164 3028 rundll32.exe f7631e9.exe PID 3028 wrote to memory of 2164 3028 rundll32.exe f7631e9.exe PID 3028 wrote to memory of 2164 3028 rundll32.exe f7631e9.exe PID 2312 wrote to memory of 1072 2312 f7613bf.exe taskhost.exe PID 2312 wrote to memory of 1080 2312 f7613bf.exe Dwm.exe PID 2312 wrote to memory of 1152 2312 f7613bf.exe Explorer.EXE PID 2312 wrote to memory of 2516 2312 f7613bf.exe f761536.exe PID 2312 wrote to memory of 2516 2312 f7613bf.exe f761536.exe PID 2312 wrote to memory of 2164 2312 f7613bf.exe f7631e9.exe PID 2312 wrote to memory of 2164 2312 f7613bf.exe f7631e9.exe PID 2516 wrote to memory of 1072 2516 f761536.exe taskhost.exe PID 2516 wrote to memory of 1080 2516 f761536.exe Dwm.exe PID 2516 wrote to memory of 1152 2516 f761536.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f7613bf.exef761536.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7613bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761536.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1072
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1080
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1152
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\338e1dfc2b07ff5f5c0c130cd2bfb670_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\338e1dfc2b07ff5f5c0c130cd2bfb670_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\f7613bf.exeC:\Users\Admin\AppData\Local\Temp\f7613bf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\f761536.exeC:\Users\Admin\AppData\Local\Temp\f761536.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\f7631e9.exeC:\Users\Admin\AppData\Local\Temp\f7631e9.exe4⤵
- Executes dropped EXE
PID:2164
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2120
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD54f9aa1f4829f53f1e7aa81e6f02a9226
SHA143d7c8d31440191c842ae63605797cfbbb243805
SHA25660deaf6d479b9a3b9bce4890be40ed6f445989c4d2e34d674849d12ca5e8c7fd
SHA512d144dff6a407a95e22601750e549301d8f20187982033ac58329fcc20f920ddb2325367083fb772524a5d56149b062c4fa4b979d522b94e157246029f7ea3c7d
-
\Users\Admin\AppData\Local\Temp\f7613bf.exeFilesize
97KB
MD5bfd51dcc85ad07c0a47a8b96e38b9166
SHA13f25b865734b34b0fa27976af98cee316399c033
SHA256d0793f9f5a9ff0b4d85f4a62eabaa59a0f8fd492e29901a77181576341832103
SHA512bdce50650204c6751374fa8aac9e250014709b6cf8708ca06e43ce429a90a1a8bf740b82608fbf4cf383ecef3c2fbbec511f3469b18f150ff653d359002ccf94
-
memory/1072-29-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2164-185-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2164-101-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2164-98-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2164-99-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2164-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2312-63-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-19-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2312-144-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2312-143-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-16-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-20-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-22-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-18-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-23-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-50-0x0000000000490000-0x0000000000492000-memory.dmpFilesize
8KB
-
memory/2312-49-0x0000000000490000-0x0000000000492000-memory.dmpFilesize
8KB
-
memory/2312-48-0x0000000001760000-0x0000000001761000-memory.dmpFilesize
4KB
-
memory/2312-21-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-112-0x0000000000490000-0x0000000000492000-memory.dmpFilesize
8KB
-
memory/2312-107-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-106-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-62-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-104-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-103-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-64-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-66-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-65-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-14-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-15-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-17-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-81-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-82-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2312-83-0x00000000005A0000-0x000000000165A000-memory.dmpFilesize
16.7MB
-
memory/2516-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2516-180-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2516-94-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2516-93-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2516-100-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2516-181-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2516-153-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/3028-59-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/3028-76-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/3028-60-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/3028-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/3028-37-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/3028-38-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3028-57-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/3028-10-0x0000000000190000-0x00000000001A2000-memory.dmpFilesize
72KB
-
memory/3028-9-0x0000000000190000-0x00000000001A2000-memory.dmpFilesize
72KB
-
memory/3028-78-0x0000000000190000-0x0000000000192000-memory.dmpFilesize
8KB
-
memory/3028-40-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB