Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 20:10
Static task
static1
Behavioral task
behavioral1
Sample
002d6272499705e0a4cd7b5e4a76b340_NeikiAnalytics.dll
Resource
win7-20231129-en
General
-
Target
002d6272499705e0a4cd7b5e4a76b340_NeikiAnalytics.dll
-
Size
120KB
-
MD5
002d6272499705e0a4cd7b5e4a76b340
-
SHA1
d5a57fd8b2c63ee7314cb6c80ef0a53e6ad0a6dc
-
SHA256
fe488670ddd540e79a75022cc8f84014c579cfda6a76173a121d219999bf4902
-
SHA512
bb630bac447079578da6f01431fa01a74a4a05f40f80c73b997af59ea4fd645bbfb07f3ca78b680ac7282e4e1b804ac6fecb8be962404d3a0d4adfc6ebc2ad6e
-
SSDEEP
1536:qUmMmrWGnbHaLmWspNz4AqhE+IHuGRVDpm5EE5THZh98M/JuNrv5JoG7bvsz:qUxUbHYEtO4cEEHZhlRuVoG7Ts
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f7617c5.exef761999.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761999.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761999.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7617c5.exe -
Processes:
f7617c5.exef761999.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761999.exe -
Processes:
f761999.exef7617c5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7617c5.exe -
Executes dropped EXE 3 IoCs
Processes:
f7617c5.exef761999.exef763360.exepid process 2620 f7617c5.exe 2460 f761999.exe 2892 f763360.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2512 rundll32.exe 2512 rundll32.exe 2512 rundll32.exe 2512 rundll32.exe 2512 rundll32.exe 2512 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2620-12-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-14-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-15-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-16-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-18-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-22-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-21-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-17-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-19-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-20-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-62-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-63-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-64-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-66-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-68-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-69-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-83-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-84-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-87-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-105-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2620-148-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2460-159-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx -
Processes:
f7617c5.exef761999.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761999.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7617c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761999.exe -
Processes:
f761999.exef7617c5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7617c5.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7617c5.exedescription ioc process File opened (read-only) \??\E: f7617c5.exe File opened (read-only) \??\K: f7617c5.exe File opened (read-only) \??\N: f7617c5.exe File opened (read-only) \??\O: f7617c5.exe File opened (read-only) \??\R: f7617c5.exe File opened (read-only) \??\G: f7617c5.exe File opened (read-only) \??\J: f7617c5.exe File opened (read-only) \??\M: f7617c5.exe File opened (read-only) \??\Q: f7617c5.exe File opened (read-only) \??\S: f7617c5.exe File opened (read-only) \??\L: f7617c5.exe File opened (read-only) \??\H: f7617c5.exe File opened (read-only) \??\I: f7617c5.exe File opened (read-only) \??\P: f7617c5.exe File opened (read-only) \??\T: f7617c5.exe -
Drops file in Windows directory 3 IoCs
Processes:
f7617c5.exef761999.exedescription ioc process File created C:\Windows\f761822 f7617c5.exe File opened for modification C:\Windows\SYSTEM.INI f7617c5.exe File created C:\Windows\f766893 f761999.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f7617c5.exepid process 2620 f7617c5.exe 2620 f7617c5.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f7617c5.exedescription pid process Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe Token: SeDebugPrivilege 2620 f7617c5.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef7617c5.exedescription pid process target process PID 2960 wrote to memory of 2512 2960 rundll32.exe rundll32.exe PID 2960 wrote to memory of 2512 2960 rundll32.exe rundll32.exe PID 2960 wrote to memory of 2512 2960 rundll32.exe rundll32.exe PID 2960 wrote to memory of 2512 2960 rundll32.exe rundll32.exe PID 2960 wrote to memory of 2512 2960 rundll32.exe rundll32.exe PID 2960 wrote to memory of 2512 2960 rundll32.exe rundll32.exe PID 2960 wrote to memory of 2512 2960 rundll32.exe rundll32.exe PID 2512 wrote to memory of 2620 2512 rundll32.exe f7617c5.exe PID 2512 wrote to memory of 2620 2512 rundll32.exe f7617c5.exe PID 2512 wrote to memory of 2620 2512 rundll32.exe f7617c5.exe PID 2512 wrote to memory of 2620 2512 rundll32.exe f7617c5.exe PID 2620 wrote to memory of 1248 2620 f7617c5.exe taskhost.exe PID 2620 wrote to memory of 1328 2620 f7617c5.exe Dwm.exe PID 2620 wrote to memory of 1372 2620 f7617c5.exe Explorer.EXE PID 2620 wrote to memory of 1520 2620 f7617c5.exe DllHost.exe PID 2620 wrote to memory of 2960 2620 f7617c5.exe rundll32.exe PID 2620 wrote to memory of 2512 2620 f7617c5.exe rundll32.exe PID 2620 wrote to memory of 2512 2620 f7617c5.exe rundll32.exe PID 2512 wrote to memory of 2460 2512 rundll32.exe f761999.exe PID 2512 wrote to memory of 2460 2512 rundll32.exe f761999.exe PID 2512 wrote to memory of 2460 2512 rundll32.exe f761999.exe PID 2512 wrote to memory of 2460 2512 rundll32.exe f761999.exe PID 2512 wrote to memory of 2892 2512 rundll32.exe f763360.exe PID 2512 wrote to memory of 2892 2512 rundll32.exe f763360.exe PID 2512 wrote to memory of 2892 2512 rundll32.exe f763360.exe PID 2512 wrote to memory of 2892 2512 rundll32.exe f763360.exe PID 2620 wrote to memory of 1248 2620 f7617c5.exe taskhost.exe PID 2620 wrote to memory of 1328 2620 f7617c5.exe Dwm.exe PID 2620 wrote to memory of 1372 2620 f7617c5.exe Explorer.EXE PID 2620 wrote to memory of 2460 2620 f7617c5.exe f761999.exe PID 2620 wrote to memory of 2460 2620 f7617c5.exe f761999.exe PID 2620 wrote to memory of 2892 2620 f7617c5.exe f763360.exe PID 2620 wrote to memory of 2892 2620 f7617c5.exe f763360.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
f7617c5.exef761999.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7617c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761999.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1248
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1328
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1372
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\002d6272499705e0a4cd7b5e4a76b340_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\002d6272499705e0a4cd7b5e4a76b340_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\f7617c5.exeC:\Users\Admin\AppData\Local\Temp\f7617c5.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\f761999.exeC:\Users\Admin\AppData\Local\Temp\f761999.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\f763360.exeC:\Users\Admin\AppData\Local\Temp\f763360.exe4⤵
- Executes dropped EXE
PID:2892
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1520
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD518ee0b9586938e34b6085bb4c2ed38e5
SHA15620a8f41142a46cb8e7896e6aea5ce48df8f7c6
SHA25618c57c35000fae8707fb6340f88f0cec616a684a5411f7861c57c1b5cd53fa2d
SHA5127c41acd38dd19ee8efb01d817197615f1ae9166594b6c466edecca77b31af43c731253c04f5c661e1987b6cefd5eb4ff9be1d2cb35d56dc3aa3f6093889ba604
-
\Users\Admin\AppData\Local\Temp\f7617c5.exeFilesize
97KB
MD5ae3fc9fb6f2f768c4436be81940aceda
SHA16ea9420bcfacee9f2089365433cbf15cdc5588a0
SHA256722fb76e341ed734222d7ee5d75f08b1fb7906c5549e43f0a862e69928bcb348
SHA512d8efa7ded8e3a2b91ed9785d2873491dccf746f30435911bd40233e4039aa6d5cc070bb29dc7cdbb76ab9b2769d8c56512063e6a086abae025e543c9af72cf27
-
memory/1248-28-0x0000000000210000-0x0000000000212000-memory.dmpFilesize
8KB
-
memory/2460-161-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2460-95-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2460-159-0x00000000009C0000-0x0000000001A7A000-memory.dmpFilesize
16.7MB
-
memory/2460-103-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2460-94-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2512-77-0x0000000000680000-0x0000000000682000-memory.dmpFilesize
8KB
-
memory/2512-9-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/2512-57-0x0000000000680000-0x0000000000682000-memory.dmpFilesize
8KB
-
memory/2512-4-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/2512-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2512-47-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/2512-37-0x0000000000680000-0x0000000000682000-memory.dmpFilesize
8KB
-
memory/2512-60-0x0000000000680000-0x0000000000682000-memory.dmpFilesize
8KB
-
memory/2512-59-0x00000000006A0000-0x00000000006B2000-memory.dmpFilesize
72KB
-
memory/2512-38-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/2620-20-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-84-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-58-0x0000000001610000-0x0000000001612000-memory.dmpFilesize
8KB
-
memory/2620-21-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-50-0x0000000001610000-0x0000000001612000-memory.dmpFilesize
8KB
-
memory/2620-19-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-48-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/2620-62-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-63-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-64-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-65-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-66-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-68-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-69-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2620-22-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-83-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-17-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-87-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-12-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-18-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-14-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-148-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-16-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-105-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-15-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2620-122-0x0000000001610000-0x0000000001612000-memory.dmpFilesize
8KB
-
memory/2620-147-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2892-101-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2892-104-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2892-102-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2892-81-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2892-165-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB