77f9e86a000454810dff45d4bb41781ca15e81b23042b153429c09094582b8d2

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
Size

196KB
MD5

d6c90c1edc7cda15eb6c7860ddf3e070
SHA1

c0f533eb923e8df3771d0821f8845c6c06c609bd
SHA256

77f9e86a000454810dff45d4bb41781ca15e81b23042b153429c09094582b8d2
SHA512

451752902edf9f0a46a8d8f82f15cf39ed411f7e5a8e55cd999b4f1bebdd4ee66e57c4ffec17ec8095dbad742274bd8a6859134b8368586901a2671dc678da67
SSDEEP

3072:xW2YjwRu8geFoFGs5rIvj6LwXKda1+ZSEPCJNUY7f12gQmA5U6QIUMDTsn:xW2+wR3BkWv+3aY0xD54HMn

Score

9^/10

persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (176) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Deletes itself 1 IoCs

pid	Process
2692	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2532	Logo1_.exe
2856	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
2692	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
File created	C:\Windows\Logo1_.exe	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe
2532	Logo1_.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3016	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	28
PID 2996 wrote to memory of 3016	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	28
PID 2996 wrote to memory of 3016	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	28
PID 2996 wrote to memory of 3016	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	28
PID 3016 wrote to memory of 3028	3016	net.exe	30
PID 3016 wrote to memory of 3028	3016	net.exe	30
PID 3016 wrote to memory of 3028	3016	net.exe	30
PID 3016 wrote to memory of 3028	3016	net.exe	30
PID 2996 wrote to memory of 2692	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	31
PID 2996 wrote to memory of 2692	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	31
PID 2996 wrote to memory of 2692	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	31
PID 2996 wrote to memory of 2692	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	31
PID 2996 wrote to memory of 2532	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	32
PID 2996 wrote to memory of 2532	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	32
PID 2996 wrote to memory of 2532	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	32
PID 2996 wrote to memory of 2532	2996	d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe	32
PID 2692 wrote to memory of 2856	2692	cmd.exe	34
PID 2692 wrote to memory of 2856	2692	cmd.exe	34
PID 2692 wrote to memory of 2856	2692	cmd.exe	34
PID 2692 wrote to memory of 2856	2692	cmd.exe	34
PID 2532 wrote to memory of 2580	2532	Logo1_.exe	35
PID 2532 wrote to memory of 2580	2532	Logo1_.exe	35
PID 2532 wrote to memory of 2580	2532	Logo1_.exe	35
PID 2532 wrote to memory of 2580	2532	Logo1_.exe	35
PID 2580 wrote to memory of 2632	2580	net.exe	37
PID 2580 wrote to memory of 2632	2580	net.exe	37
PID 2580 wrote to memory of 2632	2580	net.exe	37
PID 2580 wrote to memory of 2632	2580	net.exe	37
PID 2532 wrote to memory of 2428	2532	Logo1_.exe	38
PID 2532 wrote to memory of 2428	2532	Logo1_.exe	38
PID 2532 wrote to memory of 2428	2532	Logo1_.exe	38
PID 2532 wrote to memory of 2428	2532	Logo1_.exe	38
PID 2428 wrote to memory of 2528	2428	net.exe	40
PID 2428 wrote to memory of 2528	2428	net.exe	40
PID 2428 wrote to memory of 2528	2428	net.exe	40
PID 2428 wrote to memory of 2528	2428	net.exe	40
PID 2532 wrote to memory of 1160	2532	Logo1_.exe	21
PID 2532 wrote to memory of 1160	2532	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1160
- C:\Users\Admin\AppData\Local\Temp\d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a6587.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe"
      4⤵
      Executes dropped EXE
      PID:2856
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2632
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a6587.bat

Filesize
620B

MD5
45902c980ddad34a89b6003886a431da

SHA1
707ad03b84cc1a70867f5979590bfeafc8d83e1d

SHA256
76ba7d097ac97326643d5e51664b79b55759de0584d73c9dafb789ff98abea19

SHA512
f3be6be697d0453409600e766a7e66379157d0a3e1a59e0b7db807328093c97a3e7a2e99feb15bb6443dfb9ce3710382b403af9f5f205813c963992c3ba310f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\d6c90c1edc7cda15eb6c7860ddf3e070_NeikiAnalytics.exe.exe

Filesize
132KB

MD5
81981e7a64e6414b121c4d2a77799ccd

SHA1
a810424978d5b9d9579554a325cc90d98b88d452

SHA256
c7c0e73e359b550b315299230d465a9107a27675a4fef2606e68c9687fe5e6af

SHA512
0de4ced9bc5c5105ef8836b6d51254626c26214d5d8da447415b2ca2cc6d0e9f870639e5ed60e57d85076c0eee43a8840338170e8d57178bc315e14731b7f308

Download Submit
C:\Windows\Logo1_.exe

Filesize
63KB

MD5
c5e93700c49bd09d83c67fd9afd7448c

SHA1
296be028a825b810fb6841abcd249d8f19a6a949

SHA256
bee18b931680370939385c304cc8bb49c5b3cefdeeb5ea4e2a3e77f08c9e8a8a

SHA512
0321abbf7d24b789282b48efdcd06eeae0f185602fd1324092ba192ad85eae5903451dd3ee69c823385ec7afe789b7c85bbf795049cab48a334e277b081f95b5

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
832B

MD5
7e3a0edd0c6cd8316f4b6c159d5167a1

SHA1
753428b4736ffb2c9e3eb50f89255b212768c55a

SHA256
1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

SHA512
9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

Download Submit
memory/1160-34-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/2532-27-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2532-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2532-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2532-38-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2996-20-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/2996-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2996-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2996-2-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2996-18-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/2996-1-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download