Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 03:56
Behavioral task
behavioral1
Sample
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
26cb45640e6ba9d849fae3c4f07540c0
-
SHA1
33484e4dea56c2d05bf6f3d2199e04bd81ed9fca
-
SHA256
1baf8d6a6a4992bc42f10b5e0c10dc6eee1c53178d31e40525e12865f39dec62
-
SHA512
7ee818e876b82476f8943e7980e985774332398165dbcfea3b8a37f4421f4cd72125fe2c6c69fe575f53462482f816bdf0607e0eddcc7fcd06056bb73e918468
-
SSDEEP
49152:+XzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVA:+XzhW148Pd+Tf1mpcOldJQ3/VA
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exespoolsv.exe26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 2136 explorer.exe 3040 spoolsv.exe 2460 svchost.exe 2516 spoolsv.exe -
Loads dropped DLL 4 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exepid process 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2136 explorer.exe 3040 spoolsv.exe 2460 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/2292-0-0x0000000000400000-0x0000000000A16000-memory.dmp themida \Windows\Resources\Themes\explorer.exe themida behavioral1/memory/2292-11-0x00000000034F0000-0x0000000003B06000-memory.dmp themida behavioral1/memory/2136-12-0x0000000000400000-0x0000000000A16000-memory.dmp themida \Windows\Resources\spoolsv.exe themida behavioral1/memory/2136-21-0x0000000003420000-0x0000000003A36000-memory.dmp themida behavioral1/memory/3040-24-0x0000000000400000-0x0000000000A16000-memory.dmp themida \Windows\Resources\svchost.exe themida behavioral1/memory/2460-36-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral1/memory/2292-43-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral1/memory/2516-47-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral1/memory/3040-50-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral1/memory/2292-52-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral1/memory/2136-53-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral1/memory/2460-54-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral1/memory/2460-61-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral1/memory/2136-66-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral1/memory/2136-72-0x0000000000400000-0x0000000000A16000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2136 explorer.exe 3040 spoolsv.exe 2460 svchost.exe 2516 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exespoolsv.exe26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exedescription ioc process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2352 schtasks.exe 1728 schtasks.exe 2232 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exesvchost.exepid process 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2460 svchost.exe 2460 svchost.exe 2136 explorer.exe 2136 explorer.exe 2460 svchost.exe 2136 explorer.exe 2460 svchost.exe 2460 svchost.exe 2136 explorer.exe 2136 explorer.exe 2460 svchost.exe 2460 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 2136 explorer.exe 2460 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 2136 explorer.exe 2136 explorer.exe 3040 spoolsv.exe 3040 spoolsv.exe 2460 svchost.exe 2460 svchost.exe 2516 spoolsv.exe 2516 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 2292 wrote to memory of 2136 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe explorer.exe PID 2292 wrote to memory of 2136 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe explorer.exe PID 2292 wrote to memory of 2136 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe explorer.exe PID 2292 wrote to memory of 2136 2292 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe explorer.exe PID 2136 wrote to memory of 3040 2136 explorer.exe spoolsv.exe PID 2136 wrote to memory of 3040 2136 explorer.exe spoolsv.exe PID 2136 wrote to memory of 3040 2136 explorer.exe spoolsv.exe PID 2136 wrote to memory of 3040 2136 explorer.exe spoolsv.exe PID 3040 wrote to memory of 2460 3040 spoolsv.exe svchost.exe PID 3040 wrote to memory of 2460 3040 spoolsv.exe svchost.exe PID 3040 wrote to memory of 2460 3040 spoolsv.exe svchost.exe PID 3040 wrote to memory of 2460 3040 spoolsv.exe svchost.exe PID 2460 wrote to memory of 2516 2460 svchost.exe spoolsv.exe PID 2460 wrote to memory of 2516 2460 svchost.exe spoolsv.exe PID 2460 wrote to memory of 2516 2460 svchost.exe spoolsv.exe PID 2460 wrote to memory of 2516 2460 svchost.exe spoolsv.exe PID 2136 wrote to memory of 2528 2136 explorer.exe Explorer.exe PID 2136 wrote to memory of 2528 2136 explorer.exe Explorer.exe PID 2136 wrote to memory of 2528 2136 explorer.exe Explorer.exe PID 2136 wrote to memory of 2528 2136 explorer.exe Explorer.exe PID 2460 wrote to memory of 2352 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 2352 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 2352 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 2352 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 1728 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 1728 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 1728 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 1728 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 2232 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 2232 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 2232 2460 svchost.exe schtasks.exe PID 2460 wrote to memory of 2232 2460 svchost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2516 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:58 /f5⤵
- Creates scheduled task(s)
PID:2352 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:59 /f5⤵
- Creates scheduled task(s)
PID:1728 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:00 /f5⤵
- Creates scheduled task(s)
PID:2232 -
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2528
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\Resources\Themes\explorer.exeFilesize
2.6MB
MD5e6ce91010089903947d813ac5596443c
SHA18263dbed4d567fb3c372d9f369035ec3196a5bf6
SHA2560b574b212104251e2d61a00b168bd4c975139260aea47652cf6b719c5999e864
SHA5129beb72520a1fea33b911baaea521f380aeb5c2bd2eeda5d048ba3482794d0fe106a52bc6d01eec3f8dddda9901ea552b2f5c565f6a2f45404c76fdaaf56e0912
-
\Windows\Resources\spoolsv.exeFilesize
2.6MB
MD5161dbde6e122235f18e694b99bc08e6e
SHA1370b9b39176946d93b3f105a4637585eca59a7be
SHA256d42735bcec4ace30764ab4e57d725ca970827066d3886d74f607ef1fde4dbaa4
SHA5125dae1dfbf4756382edc52ecfefdadd36b8bb740691fe5e7d2ecfc295ef94b733649bcc1132cd4645dc74871bb1f87a0a3b708b11e673df63d46b673d9ed24f9e
-
\Windows\Resources\svchost.exeFilesize
2.6MB
MD58b42612fddb0e5c05635d42b1bade2f0
SHA115f4bb14b6c81d0fa97e82021771d6204b6280b1
SHA256780e807fe2a1275a00387d0d2891d99793f9e9b40cce0817fb0c4ef8aafcb4c8
SHA512e6de45c407197007787d80bc022e11b5b765ed78a2cdf5598ec9e132d26f49d5c4a53f2d6158ca38b17776481b5e463093eedf765bbaf0192ad66864f4fb93e4
-
memory/2136-72-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2136-66-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2136-12-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2136-21-0x0000000003420000-0x0000000003A36000-memory.dmpFilesize
6.1MB
-
memory/2136-53-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2292-52-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2292-0-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2292-1-0x0000000077D20000-0x0000000077D22000-memory.dmpFilesize
8KB
-
memory/2292-43-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2292-11-0x00000000034F0000-0x0000000003B06000-memory.dmpFilesize
6.1MB
-
memory/2460-57-0x0000000003230000-0x0000000003846000-memory.dmpFilesize
6.1MB
-
memory/2460-48-0x0000000003230000-0x0000000003846000-memory.dmpFilesize
6.1MB
-
memory/2460-54-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2460-61-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2460-36-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2516-47-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/3040-50-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/3040-24-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/3040-35-0x0000000003560000-0x0000000003B76000-memory.dmpFilesize
6.1MB