Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 02:39
Static task
static1
Behavioral task
behavioral1
Sample
30b87e011a5bd07acb5587b3d18217d0_NeikiAnalytics.dll
Resource
win7-20240220-en
General
-
Target
30b87e011a5bd07acb5587b3d18217d0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
30b87e011a5bd07acb5587b3d18217d0
-
SHA1
a31e49fff28f72e12cbef7165ca035b6ad74484d
-
SHA256
d79dcf48df06cfdb45a0e187f2ed2acedc5d798744c284a875c0df679d74a139
-
SHA512
c834c57ece56d4d7a6d412b570316ce9a9592b08b9d1a8663cab03c50678f027b77d57a9ae378783627c314029359ee37aa0883e0d75af1447d4736558211b99
-
SSDEEP
3072:BUodpCfoyvwKGZe32nbCCIQH3ZBCGgY02C1/PP0qfUV:BzMf3oKcVKEbFgY02M/PDq
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f76117e.exef760fd9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76117e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76117e.exe -
Processes:
f760fd9.exef76117e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76117e.exe -
Processes:
f76117e.exef760fd9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76117e.exe -
Executes dropped EXE 3 IoCs
Processes:
f760fd9.exef76117e.exef762b83.exepid process 1508 f760fd9.exe 2748 f76117e.exe 1944 f762b83.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1508-16-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-19-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-23-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-20-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-18-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-15-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-21-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-22-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-17-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-14-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-65-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-66-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-67-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-68-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-69-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-71-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-72-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-87-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-89-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-91-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-92-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1508-161-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2748-174-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2748-191-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f760fd9.exef76117e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f760fd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76117e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76117e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76117e.exe -
Processes:
f760fd9.exef76117e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76117e.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f760fd9.exedescription ioc process File opened (read-only) \??\E: f760fd9.exe File opened (read-only) \??\N: f760fd9.exe File opened (read-only) \??\R: f760fd9.exe File opened (read-only) \??\S: f760fd9.exe File opened (read-only) \??\J: f760fd9.exe File opened (read-only) \??\L: f760fd9.exe File opened (read-only) \??\M: f760fd9.exe File opened (read-only) \??\G: f760fd9.exe File opened (read-only) \??\I: f760fd9.exe File opened (read-only) \??\O: f760fd9.exe File opened (read-only) \??\P: f760fd9.exe File opened (read-only) \??\T: f760fd9.exe File opened (read-only) \??\H: f760fd9.exe File opened (read-only) \??\K: f760fd9.exe File opened (read-only) \??\Q: f760fd9.exe -
Drops file in Windows directory 3 IoCs
Processes:
f760fd9.exef76117e.exedescription ioc process File created C:\Windows\f761046 f760fd9.exe File opened for modification C:\Windows\SYSTEM.INI f760fd9.exe File created C:\Windows\f765fdc f76117e.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f760fd9.exef76117e.exepid process 1508 f760fd9.exe 1508 f760fd9.exe 2748 f76117e.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f760fd9.exef76117e.exedescription pid process Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 1508 f760fd9.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe Token: SeDebugPrivilege 2748 f76117e.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef760fd9.exef76117e.exedescription pid process target process PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 2368 wrote to memory of 1204 2368 rundll32.exe rundll32.exe PID 1204 wrote to memory of 1508 1204 rundll32.exe f760fd9.exe PID 1204 wrote to memory of 1508 1204 rundll32.exe f760fd9.exe PID 1204 wrote to memory of 1508 1204 rundll32.exe f760fd9.exe PID 1204 wrote to memory of 1508 1204 rundll32.exe f760fd9.exe PID 1508 wrote to memory of 1120 1508 f760fd9.exe taskhost.exe PID 1508 wrote to memory of 1180 1508 f760fd9.exe Dwm.exe PID 1508 wrote to memory of 1224 1508 f760fd9.exe Explorer.EXE PID 1508 wrote to memory of 1008 1508 f760fd9.exe DllHost.exe PID 1508 wrote to memory of 2368 1508 f760fd9.exe rundll32.exe PID 1508 wrote to memory of 1204 1508 f760fd9.exe rundll32.exe PID 1508 wrote to memory of 1204 1508 f760fd9.exe rundll32.exe PID 1204 wrote to memory of 2748 1204 rundll32.exe f76117e.exe PID 1204 wrote to memory of 2748 1204 rundll32.exe f76117e.exe PID 1204 wrote to memory of 2748 1204 rundll32.exe f76117e.exe PID 1204 wrote to memory of 2748 1204 rundll32.exe f76117e.exe PID 1204 wrote to memory of 1944 1204 rundll32.exe f762b83.exe PID 1204 wrote to memory of 1944 1204 rundll32.exe f762b83.exe PID 1204 wrote to memory of 1944 1204 rundll32.exe f762b83.exe PID 1204 wrote to memory of 1944 1204 rundll32.exe f762b83.exe PID 1508 wrote to memory of 1120 1508 f760fd9.exe taskhost.exe PID 1508 wrote to memory of 1180 1508 f760fd9.exe Dwm.exe PID 1508 wrote to memory of 1224 1508 f760fd9.exe Explorer.EXE PID 1508 wrote to memory of 2748 1508 f760fd9.exe f76117e.exe PID 1508 wrote to memory of 2748 1508 f760fd9.exe f76117e.exe PID 1508 wrote to memory of 1944 1508 f760fd9.exe f762b83.exe PID 1508 wrote to memory of 1944 1508 f760fd9.exe f762b83.exe PID 2748 wrote to memory of 1120 2748 f76117e.exe taskhost.exe PID 2748 wrote to memory of 1180 2748 f76117e.exe Dwm.exe PID 2748 wrote to memory of 1224 2748 f76117e.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f760fd9.exef76117e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760fd9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76117e.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\30b87e011a5bd07acb5587b3d18217d0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\30b87e011a5bd07acb5587b3d18217d0_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\f760fd9.exeC:\Users\Admin\AppData\Local\Temp\f760fd9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\f76117e.exeC:\Users\Admin\AppData\Local\Temp\f76117e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\f762b83.exeC:\Users\Admin\AppData\Local\Temp\f762b83.exe4⤵
- Executes dropped EXE
PID:1944
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1008
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f760fd9.exeFilesize
97KB
MD5dfbc731de76d1ae34099d34293ccf40c
SHA11f672ad1dd91175fca5197c20883a30273417c42
SHA2561afbb706d6409063b46dd9168f28a969c90318391feae8efd02c1234d8957148
SHA5121961b5680699f0e0424e6a675715a620f2d67a597abf0107dbd7bbb2f04999d93ec2fe5d54afdfbf3f3d1c3db8022b829e25b3cfb4b13fa161974eb1580694b2
-
C:\Windows\SYSTEM.INIFilesize
257B
MD55ec18b73b2e96ad3039c3f3a9cec7b05
SHA15523acc44b32a336034abd82a13517df25ed44b7
SHA25605a6ad1295463d31eb871ed87ef3159b3ab1ce9c1eb394558da5799e52f1731e
SHA5129825b9483387ef0af1473be86d8642eeef7d005ce216a58eb2d690b7ee14ebaee0eb8f6cb105de53e787bcc603be54f7013aae6e47be1c1fb3ea5990870884a3
-
memory/1120-24-0x0000000000410000-0x0000000000412000-memory.dmpFilesize
8KB
-
memory/1204-44-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1204-62-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/1204-61-0x00000000001F0000-0x0000000000202000-memory.dmpFilesize
72KB
-
memory/1204-35-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1204-9-0x0000000000170000-0x0000000000182000-memory.dmpFilesize
72KB
-
memory/1204-81-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/1204-80-0x0000000000210000-0x0000000000222000-memory.dmpFilesize
72KB
-
memory/1204-84-0x0000000000170000-0x0000000000172000-memory.dmpFilesize
8KB
-
memory/1204-10-0x0000000000170000-0x0000000000182000-memory.dmpFilesize
72KB
-
memory/1204-59-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/1204-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1204-34-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/1508-66-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-19-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-50-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/1508-20-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-15-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-21-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-22-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-17-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-14-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-52-0x00000000005C0000-0x00000000005C2000-memory.dmpFilesize
8KB
-
memory/1508-65-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-60-0x00000000005C0000-0x00000000005C2000-memory.dmpFilesize
8KB
-
memory/1508-67-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-68-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-69-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-71-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-72-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1508-23-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-18-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-16-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-87-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-89-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-91-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-92-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-161-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1508-162-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1508-127-0x00000000005C0000-0x00000000005C2000-memory.dmpFilesize
8KB
-
memory/1944-111-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1944-112-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1944-86-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1944-196-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2748-110-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2748-103-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2748-104-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2748-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2748-174-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2748-192-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2748-191-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB