Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 14:27
Behavioral task
behavioral1
Sample
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe
-
Size
90KB
-
MD5
460b2a7276f55c4cf85b2137cda0a5f0
-
SHA1
f9edcbf61b306db1fc1e2e6cb935db8135d31885
-
SHA256
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba
-
SHA512
3590e143fde4fc886770e7a1eeb63fb9f78f7ef3efa2c33727687e0135a6bd5a1f27578245f6c0359cb36e78a71ee5669531805e5713cdca048fd8a30e49846e
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2696-253-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/2696-264-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 2468 csrsll.exe 1928 csrsll.exe 2696 csrsll.exe -
Loads dropped DLL 5 IoCs
Processes:
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exepid process 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2216-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2216-18-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2216-27-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2216-91-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2216-82-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/672-95-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/672-101-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/672-103-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2216-108-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/672-107-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/672-105-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/672-97-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral1/memory/672-148-0x0000000002D30000-0x0000000002D83000-memory.dmp upx behavioral1/memory/2468-151-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/672-154-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2468-213-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2696-253-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1928-252-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2468-255-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/672-258-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1928-263-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2696-264-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.execsrsll.exedescription pid process target process PID 2216 set thread context of 672 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 2468 set thread context of 1928 2468 csrsll.exe csrsll.exe PID 2468 set thread context of 2696 2468 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe Token: SeDebugPrivilege 1928 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.execsrsll.execsrsll.exepid process 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 2468 csrsll.exe 1928 csrsll.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.execmd.execsrsll.exedescription pid process target process PID 2216 wrote to memory of 672 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 2216 wrote to memory of 672 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 2216 wrote to memory of 672 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 2216 wrote to memory of 672 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 2216 wrote to memory of 672 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 2216 wrote to memory of 672 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 2216 wrote to memory of 672 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 2216 wrote to memory of 672 2216 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 672 wrote to memory of 2868 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe cmd.exe PID 672 wrote to memory of 2868 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe cmd.exe PID 672 wrote to memory of 2868 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe cmd.exe PID 672 wrote to memory of 2868 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe cmd.exe PID 2868 wrote to memory of 892 2868 cmd.exe reg.exe PID 2868 wrote to memory of 892 2868 cmd.exe reg.exe PID 2868 wrote to memory of 892 2868 cmd.exe reg.exe PID 2868 wrote to memory of 892 2868 cmd.exe reg.exe PID 672 wrote to memory of 2468 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe csrsll.exe PID 672 wrote to memory of 2468 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe csrsll.exe PID 672 wrote to memory of 2468 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe csrsll.exe PID 672 wrote to memory of 2468 672 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe csrsll.exe PID 2468 wrote to memory of 1928 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 1928 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 1928 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 1928 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 1928 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 1928 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 1928 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 1928 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 2696 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 2696 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 2696 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 2696 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 2696 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 2696 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 2696 2468 csrsll.exe csrsll.exe PID 2468 wrote to memory of 2696 2468 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ETSGH.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ETSGH.batFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
90KB
MD52f3deda19ef55aaa6a090b75395aa29c
SHA1159149327a5a761a4e18266137d5f827d7efd645
SHA256d0c32b409eb510f7d621ea40c40b94a119925e459149f26bc580a9014400c0f1
SHA51252cbffb884b9fc3dcd7d54bb5f07e32737fd3212ba163d42ccf85716f0a2d1d1e5bf397513d91b32e0f63cf1b72f6af2e3f1eb07b8cc1072a0669c6d351c03b7
-
memory/672-154-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/672-93-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/672-107-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/672-258-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/672-95-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/672-105-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/672-150-0x0000000002D40000-0x0000000002D93000-memory.dmpFilesize
332KB
-
memory/672-149-0x0000000002D40000-0x0000000002D93000-memory.dmpFilesize
332KB
-
memory/672-148-0x0000000002D30000-0x0000000002D83000-memory.dmpFilesize
332KB
-
memory/672-97-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/672-101-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/672-99-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/672-103-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1928-263-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1928-252-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2216-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2216-5-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2216-108-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2216-72-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/2216-15-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2216-92-0x00000000023A0000-0x00000000023F3000-memory.dmpFilesize
332KB
-
memory/2216-80-0x0000000000680000-0x0000000000682000-memory.dmpFilesize
8KB
-
memory/2216-42-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2216-3-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2216-82-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2216-91-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2216-62-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2216-30-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2216-18-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2216-27-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2216-26-0x0000000000404000-0x0000000000405000-memory.dmpFilesize
4KB
-
memory/2468-151-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2468-167-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2468-213-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2468-178-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2468-255-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2468-157-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2696-253-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2696-264-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB