Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 20:27
Static task
static1
Behavioral task
behavioral1
Sample
3861b22d5927e123435bbb02ede8fd074a3032ff0cc2903106ac3cdbd49ee17e.dll
Resource
win7-20240508-en
General
-
Target
3861b22d5927e123435bbb02ede8fd074a3032ff0cc2903106ac3cdbd49ee17e.dll
-
Size
120KB
-
MD5
890c06791b4e96a57c291ce0c546ad3d
-
SHA1
5ac84b1f2f534ae2a590f3aaf7786785b4a7abd1
-
SHA256
3861b22d5927e123435bbb02ede8fd074a3032ff0cc2903106ac3cdbd49ee17e
-
SHA512
40a038eea381ce5c4430a4ef3591af989e117cfea6177ddd04f12d0b1d8043d1b46660d073ed575ae683a650e5851818caad923695c2cdc60d520792b575775a
-
SSDEEP
1536:dBNZluWNc+fIBskEv/Kbl/OfLo6HaWDQ9K2ArSpQqan8ceOHNgZb6xV8G:wJ2RKbgo66OwArzVeOtgl
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
f761851.exef7633cd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761851.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761851.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7633cd.exe -
Processes:
f761851.exef7633cd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7633cd.exe -
Processes:
f761851.exef7633cd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7633cd.exe -
Executes dropped EXE 3 IoCs
Processes:
f761851.exef761b1f.exef7633cd.exepid process 1336 f761851.exe 2612 f761b1f.exe 2804 f7633cd.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1336-14-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-17-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-15-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-16-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-20-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-19-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-23-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-18-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-21-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-22-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-60-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-61-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-62-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-63-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-64-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-66-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-67-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-81-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-83-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-85-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-104-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1336-146-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2804-162-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2804-199-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Processes:
f761851.exef7633cd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7633cd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761851.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7633cd.exe -
Processes:
f761851.exef7633cd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7633cd.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f761851.exef7633cd.exedescription ioc process File opened (read-only) \??\J: f761851.exe File opened (read-only) \??\K: f761851.exe File opened (read-only) \??\R: f761851.exe File opened (read-only) \??\S: f761851.exe File opened (read-only) \??\H: f761851.exe File opened (read-only) \??\L: f761851.exe File opened (read-only) \??\M: f761851.exe File opened (read-only) \??\P: f761851.exe File opened (read-only) \??\I: f761851.exe File opened (read-only) \??\N: f761851.exe File opened (read-only) \??\O: f761851.exe File opened (read-only) \??\Q: f761851.exe File opened (read-only) \??\E: f7633cd.exe File opened (read-only) \??\E: f761851.exe File opened (read-only) \??\G: f761851.exe -
Drops file in Windows directory 3 IoCs
Processes:
f761851.exef7633cd.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI f761851.exe File created C:\Windows\f766a57 f7633cd.exe File created C:\Windows\f7618be f761851.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f761851.exef7633cd.exepid process 1336 f761851.exe 1336 f761851.exe 2804 f7633cd.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f761851.exef7633cd.exedescription pid process Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 1336 f761851.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe Token: SeDebugPrivilege 2804 f7633cd.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef761851.exef7633cd.exedescription pid process target process PID 2076 wrote to memory of 2768 2076 rundll32.exe rundll32.exe PID 2076 wrote to memory of 2768 2076 rundll32.exe rundll32.exe PID 2076 wrote to memory of 2768 2076 rundll32.exe rundll32.exe PID 2076 wrote to memory of 2768 2076 rundll32.exe rundll32.exe PID 2076 wrote to memory of 2768 2076 rundll32.exe rundll32.exe PID 2076 wrote to memory of 2768 2076 rundll32.exe rundll32.exe PID 2076 wrote to memory of 2768 2076 rundll32.exe rundll32.exe PID 2768 wrote to memory of 1336 2768 rundll32.exe f761851.exe PID 2768 wrote to memory of 1336 2768 rundll32.exe f761851.exe PID 2768 wrote to memory of 1336 2768 rundll32.exe f761851.exe PID 2768 wrote to memory of 1336 2768 rundll32.exe f761851.exe PID 1336 wrote to memory of 1076 1336 f761851.exe taskhost.exe PID 1336 wrote to memory of 1140 1336 f761851.exe Dwm.exe PID 1336 wrote to memory of 1196 1336 f761851.exe Explorer.EXE PID 1336 wrote to memory of 1688 1336 f761851.exe DllHost.exe PID 1336 wrote to memory of 2076 1336 f761851.exe rundll32.exe PID 1336 wrote to memory of 2768 1336 f761851.exe rundll32.exe PID 1336 wrote to memory of 2768 1336 f761851.exe rundll32.exe PID 2768 wrote to memory of 2612 2768 rundll32.exe f761b1f.exe PID 2768 wrote to memory of 2612 2768 rundll32.exe f761b1f.exe PID 2768 wrote to memory of 2612 2768 rundll32.exe f761b1f.exe PID 2768 wrote to memory of 2612 2768 rundll32.exe f761b1f.exe PID 2768 wrote to memory of 2804 2768 rundll32.exe f7633cd.exe PID 2768 wrote to memory of 2804 2768 rundll32.exe f7633cd.exe PID 2768 wrote to memory of 2804 2768 rundll32.exe f7633cd.exe PID 2768 wrote to memory of 2804 2768 rundll32.exe f7633cd.exe PID 1336 wrote to memory of 1076 1336 f761851.exe taskhost.exe PID 1336 wrote to memory of 1140 1336 f761851.exe Dwm.exe PID 1336 wrote to memory of 1196 1336 f761851.exe Explorer.EXE PID 1336 wrote to memory of 2612 1336 f761851.exe f761b1f.exe PID 1336 wrote to memory of 2612 1336 f761851.exe f761b1f.exe PID 1336 wrote to memory of 2804 1336 f761851.exe f7633cd.exe PID 1336 wrote to memory of 2804 1336 f761851.exe f7633cd.exe PID 2804 wrote to memory of 1076 2804 f7633cd.exe taskhost.exe PID 2804 wrote to memory of 1140 2804 f7633cd.exe Dwm.exe PID 2804 wrote to memory of 1196 2804 f7633cd.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f7633cd.exef761851.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7633cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761851.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3861b22d5927e123435bbb02ede8fd074a3032ff0cc2903106ac3cdbd49ee17e.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3861b22d5927e123435bbb02ede8fd074a3032ff0cc2903106ac3cdbd49ee17e.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f761851.exeC:\Users\Admin\AppData\Local\Temp\f761851.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f761b1f.exeC:\Users\Admin\AppData\Local\Temp\f761b1f.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f7633cd.exeC:\Users\Admin\AppData\Local\Temp\f7633cd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
256B
MD5434d901bfd52209f50f39073765d3f8f
SHA1a4381de449f2de122be02017eb01a0c15fcf1a82
SHA256684083988d5b94764310c7f4ef3cc0e5f853a0199ba76f830684e2c87917b861
SHA51225d7d23f2b1b6f97a9512a7a760fce204deb2547c077280b1273e729d9bae79f31299821b1862f8b11b2d70d5440743a511163e1f371dd3f795a9f92f4315922
-
\Users\Admin\AppData\Local\Temp\f761851.exeFilesize
97KB
MD506f170883d8b51caf0c9850c08971b8b
SHA12e37f1449dd221493911feb21b3c9a12beabd5a0
SHA256029d833c902feb11b989c3ea049f82df14ded057be17a27abe330ace3fd6f823
SHA5129c797af979753411ce133ef494fd4f743d51329c8762c3f8be1d5c784a50c0c3b399f3496905dcadd8a6776ae21283a1034da2a706c11d772404ab257ac3bc5a
-
memory/1076-29-0x0000000000490000-0x0000000000492000-memory.dmpFilesize
8KB
-
memory/1336-61-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-51-0x0000000000520000-0x0000000000522000-memory.dmpFilesize
8KB
-
memory/1336-62-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-16-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-63-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-19-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-23-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-18-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-21-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-22-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-48-0x0000000000520000-0x0000000000522000-memory.dmpFilesize
8KB
-
memory/1336-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1336-81-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-17-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-146-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-64-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-85-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-83-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-145-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1336-118-0x0000000000520000-0x0000000000522000-memory.dmpFilesize
8KB
-
memory/1336-104-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-67-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-60-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-14-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-15-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-20-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/1336-46-0x0000000002F10000-0x0000000002F11000-memory.dmpFilesize
4KB
-
memory/1336-66-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/2612-95-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2612-96-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2612-102-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2612-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2612-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2768-4-0x00000000001F0000-0x0000000000202000-memory.dmpFilesize
72KB
-
memory/2768-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2768-79-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2768-76-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2768-9-0x00000000001F0000-0x0000000000202000-memory.dmpFilesize
72KB
-
memory/2768-47-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2768-50-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2768-37-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2768-38-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2768-40-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2804-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2804-101-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2804-100-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2804-103-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2804-162-0x0000000000910000-0x00000000019CA000-memory.dmpFilesize
16.7MB
-
memory/2804-198-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2804-199-0x0000000000910000-0x00000000019CA000-memory.dmpFilesize
16.7MB