Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 05:08
Behavioral task
behavioral1
Sample
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe
-
Size
2.5MB
-
MD5
28ac907d06f0fd383ccfbba6595615b0
-
SHA1
b07e1f1492fa23da54e04ead3c3e7eea5ffbdcdd
-
SHA256
a0a2ff1c76bd92bbd57142414f481c18176ec907002703cf940da0b20361fc8e
-
SHA512
58aff6acb313a6bbcfaa3bcfcf953094a04d6c2a722356aff0d4d69687f2b7765cfa5922f32bf29d1ba7bf167fcb137db9b91d10cff636db8d971a49b1d57bc1
-
SSDEEP
49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxg:hxx9NUFkQx753uWuCyyxg
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exesvchost.exespoolsv.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 2988 explorer.exe 2656 spoolsv.exe 2832 svchost.exe 2728 spoolsv.exe -
Loads dropped DLL 4 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exepid process 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2988 explorer.exe 2656 spoolsv.exe 2832 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/2820-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida \Windows\Resources\Themes\explorer.exe themida behavioral1/memory/2988-11-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral1/memory/2656-23-0x0000000000400000-0x0000000000A0E000-memory.dmp themida \Windows\Resources\svchost.exe themida behavioral1/memory/2832-35-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2728-43-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2656-50-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2728-49-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2820-52-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2988-53-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2832-55-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2988-68-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2988-74-0x0000000000400000-0x0000000000A0E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Processes:
svchost.exespoolsv.exe28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2988 explorer.exe 2656 spoolsv.exe 2832 svchost.exe 2728 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\resources\themes\explorer.exe 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2916 schtasks.exe 2280 schtasks.exe 1796 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exesvchost.exepid process 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2988 explorer.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2832 svchost.exe 2988 explorer.exe 2832 svchost.exe 2832 svchost.exe 2988 explorer.exe 2988 explorer.exe 2832 svchost.exe 2988 explorer.exe 2988 explorer.exe 2832 svchost.exe 2832 svchost.exe 2988 explorer.exe 2832 svchost.exe 2988 explorer.exe 2832 svchost.exe 2988 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svchost.exeexplorer.exepid process 2832 svchost.exe 2988 explorer.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 2988 explorer.exe 2988 explorer.exe 2656 spoolsv.exe 2656 spoolsv.exe 2832 svchost.exe 2832 svchost.exe 2728 spoolsv.exe 2728 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 2820 wrote to memory of 2988 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe explorer.exe PID 2820 wrote to memory of 2988 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe explorer.exe PID 2820 wrote to memory of 2988 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe explorer.exe PID 2820 wrote to memory of 2988 2820 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe explorer.exe PID 2988 wrote to memory of 2656 2988 explorer.exe spoolsv.exe PID 2988 wrote to memory of 2656 2988 explorer.exe spoolsv.exe PID 2988 wrote to memory of 2656 2988 explorer.exe spoolsv.exe PID 2988 wrote to memory of 2656 2988 explorer.exe spoolsv.exe PID 2656 wrote to memory of 2832 2656 spoolsv.exe svchost.exe PID 2656 wrote to memory of 2832 2656 spoolsv.exe svchost.exe PID 2656 wrote to memory of 2832 2656 spoolsv.exe svchost.exe PID 2656 wrote to memory of 2832 2656 spoolsv.exe svchost.exe PID 2832 wrote to memory of 2728 2832 svchost.exe spoolsv.exe PID 2832 wrote to memory of 2728 2832 svchost.exe spoolsv.exe PID 2832 wrote to memory of 2728 2832 svchost.exe spoolsv.exe PID 2832 wrote to memory of 2728 2832 svchost.exe spoolsv.exe PID 2988 wrote to memory of 2472 2988 explorer.exe Explorer.exe PID 2988 wrote to memory of 2472 2988 explorer.exe Explorer.exe PID 2988 wrote to memory of 2472 2988 explorer.exe Explorer.exe PID 2988 wrote to memory of 2472 2988 explorer.exe Explorer.exe PID 2832 wrote to memory of 2916 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 2916 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 2916 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 2916 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 2280 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 2280 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 2280 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 2280 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 1796 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 1796 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 1796 2832 svchost.exe schtasks.exe PID 2832 wrote to memory of 1796 2832 svchost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:10 /f5⤵
- Creates scheduled task(s)
PID:2916 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:11 /f5⤵
- Creates scheduled task(s)
PID:2280 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:12 /f5⤵
- Creates scheduled task(s)
PID:1796 -
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2472
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Resources\spoolsv.exeFilesize
2.5MB
MD5459870793a9ba032a8eb5516071091e8
SHA10ce82e616f368a0d4451c2d41d7985a01e5f20e9
SHA256111b0a5034249ed54f291f1dbb8395da33e3ed2b3b5a44e84e6320667631050c
SHA51207919682087eeeae743d2786eef1c0bbbeb88f32a73e15b6e8f244738eb5902be9eea11dcdcedeff050e3142953eb38798adc94cb7fbc0655d5da5e557c71ce6
-
\Windows\Resources\Themes\explorer.exeFilesize
2.5MB
MD5d54c61be3b1e184ff8c495663564934e
SHA18faab9aaba40ce01d014f433816684df69314278
SHA25602f650f5969ac53ac40acb38b8465575b6da9da38e472dabad621e5ff9001960
SHA5122f5de48f378b75bea95062540698db89aba22ae5188a5d6bc28287b51601d5423437bc663a4906cecc21fb04afd6cb124edbc94718659a6316d2b94a914966a3
-
\Windows\Resources\svchost.exeFilesize
2.5MB
MD5ef127446cbc51b2c74a3d1cc6f58b703
SHA137cac3a489518f9ed4f6fff84f04e0d997a65d01
SHA256e722b992b8a79bebbf062678667a8e79d7f6d71a8b1e44843318c8315d5edd69
SHA512dbdc6f3bec492ab2936a464dc9009a0e7218c1f295d8aa927700309ce4832ed2b2779d48b134e973a1176e0395db94dd00ff8e8ea87ea04559c7f332bca77c43
-
memory/2656-50-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2656-33-0x0000000003870000-0x0000000003E7E000-memory.dmpFilesize
6.1MB
-
memory/2656-23-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2728-43-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2728-49-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2820-0-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2820-1-0x0000000077820000-0x0000000077822000-memory.dmpFilesize
8KB
-
memory/2820-52-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2832-35-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2832-42-0x00000000032C0000-0x00000000038CE000-memory.dmpFilesize
6.1MB
-
memory/2832-55-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2832-59-0x00000000032C0000-0x00000000038CE000-memory.dmpFilesize
6.1MB
-
memory/2988-21-0x0000000003780000-0x0000000003D8E000-memory.dmpFilesize
6.1MB
-
memory/2988-11-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2988-53-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2988-56-0x0000000003780000-0x0000000003D8E000-memory.dmpFilesize
6.1MB
-
memory/2988-68-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2988-74-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB