Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 00:36
Static task
static1
Behavioral task
behavioral1
Sample
3c7c4fb91d8fff627be8e172b06c34af10a1a18710d4e5fc05016101b66d43b5_NeikiAnalytics.dll
Resource
win7-20240220-en
General
-
Target
3c7c4fb91d8fff627be8e172b06c34af10a1a18710d4e5fc05016101b66d43b5_NeikiAnalytics.dll
-
Size
120KB
-
MD5
e2ac3fdf10345cd2106370d97b580be0
-
SHA1
8a2c41b57c0f7a137dcbd0b7de0585bd0fb24792
-
SHA256
3c7c4fb91d8fff627be8e172b06c34af10a1a18710d4e5fc05016101b66d43b5
-
SHA512
f0e267c275377309d51123f9fe81c70626cde36e47de25bbedd2842ecb7806e249cf76e682043f3d7b38e9732800c1170a9f45a6f9a5fd14f6c92bf1a2d8fe75
-
SSDEEP
3072:Uxw6xEFUc0tWv9B9GT+f4RkYxUlNPXXtznfhQv0:U6uUp9XffJlNPXdTGv
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
f7614b9.exef763054.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763054.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763054.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763054.exe -
Processes:
f7614b9.exef763054.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763054.exe -
Processes:
f7614b9.exef763054.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763054.exe -
Executes dropped EXE 3 IoCs
Processes:
f7614b9.exef76166e.exef763054.exepid process 2224 f7614b9.exe 2448 f76166e.exe 1556 f763054.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe 2920 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2224-14-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-17-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-19-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-20-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-22-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-18-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-16-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-23-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-15-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-21-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-61-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-62-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-63-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-64-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-65-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-80-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-81-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-82-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-103-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-106-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-108-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-109-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2224-146-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1556-162-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx behavioral1/memory/1556-199-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx -
Processes:
f7614b9.exef763054.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763054.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763054.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763054.exe -
Processes:
f7614b9.exef763054.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763054.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7614b9.exef763054.exedescription ioc process File opened (read-only) \??\J: f7614b9.exe File opened (read-only) \??\K: f7614b9.exe File opened (read-only) \??\Q: f7614b9.exe File opened (read-only) \??\E: f763054.exe File opened (read-only) \??\H: f7614b9.exe File opened (read-only) \??\I: f7614b9.exe File opened (read-only) \??\N: f7614b9.exe File opened (read-only) \??\G: f763054.exe File opened (read-only) \??\G: f7614b9.exe File opened (read-only) \??\L: f7614b9.exe File opened (read-only) \??\M: f7614b9.exe File opened (read-only) \??\O: f7614b9.exe File opened (read-only) \??\P: f7614b9.exe File opened (read-only) \??\E: f7614b9.exe -
Drops file in Windows directory 3 IoCs
Processes:
f763054.exef7614b9.exedescription ioc process File created C:\Windows\f7665d5 f763054.exe File created C:\Windows\f761516 f7614b9.exe File opened for modification C:\Windows\SYSTEM.INI f7614b9.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f7614b9.exef763054.exepid process 2224 f7614b9.exe 2224 f7614b9.exe 1556 f763054.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f7614b9.exef763054.exedescription pid process Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 2224 f7614b9.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe Token: SeDebugPrivilege 1556 f763054.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef7614b9.exef763054.exedescription pid process target process PID 2860 wrote to memory of 2920 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2920 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2920 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2920 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2920 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2920 2860 rundll32.exe rundll32.exe PID 2860 wrote to memory of 2920 2860 rundll32.exe rundll32.exe PID 2920 wrote to memory of 2224 2920 rundll32.exe f7614b9.exe PID 2920 wrote to memory of 2224 2920 rundll32.exe f7614b9.exe PID 2920 wrote to memory of 2224 2920 rundll32.exe f7614b9.exe PID 2920 wrote to memory of 2224 2920 rundll32.exe f7614b9.exe PID 2224 wrote to memory of 1040 2224 f7614b9.exe Dwm.exe PID 2224 wrote to memory of 1056 2224 f7614b9.exe taskhost.exe PID 2224 wrote to memory of 1100 2224 f7614b9.exe Explorer.EXE PID 2224 wrote to memory of 2308 2224 f7614b9.exe DllHost.exe PID 2224 wrote to memory of 2860 2224 f7614b9.exe rundll32.exe PID 2224 wrote to memory of 2920 2224 f7614b9.exe rundll32.exe PID 2224 wrote to memory of 2920 2224 f7614b9.exe rundll32.exe PID 2920 wrote to memory of 2448 2920 rundll32.exe f76166e.exe PID 2920 wrote to memory of 2448 2920 rundll32.exe f76166e.exe PID 2920 wrote to memory of 2448 2920 rundll32.exe f76166e.exe PID 2920 wrote to memory of 2448 2920 rundll32.exe f76166e.exe PID 2920 wrote to memory of 1556 2920 rundll32.exe f763054.exe PID 2920 wrote to memory of 1556 2920 rundll32.exe f763054.exe PID 2920 wrote to memory of 1556 2920 rundll32.exe f763054.exe PID 2920 wrote to memory of 1556 2920 rundll32.exe f763054.exe PID 2224 wrote to memory of 1040 2224 f7614b9.exe Dwm.exe PID 2224 wrote to memory of 1056 2224 f7614b9.exe taskhost.exe PID 2224 wrote to memory of 1100 2224 f7614b9.exe Explorer.EXE PID 2224 wrote to memory of 2448 2224 f7614b9.exe f76166e.exe PID 2224 wrote to memory of 2448 2224 f7614b9.exe f76166e.exe PID 2224 wrote to memory of 1556 2224 f7614b9.exe f763054.exe PID 2224 wrote to memory of 1556 2224 f7614b9.exe f763054.exe PID 1556 wrote to memory of 1040 1556 f763054.exe Dwm.exe PID 1556 wrote to memory of 1056 1556 f763054.exe taskhost.exe PID 1556 wrote to memory of 1100 1556 f763054.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f7614b9.exef763054.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7614b9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763054.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c7c4fb91d8fff627be8e172b06c34af10a1a18710d4e5fc05016101b66d43b5_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c7c4fb91d8fff627be8e172b06c34af10a1a18710d4e5fc05016101b66d43b5_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7614b9.exeC:\Users\Admin\AppData\Local\Temp\f7614b9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76166e.exeC:\Users\Admin\AppData\Local\Temp\f76166e.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f763054.exeC:\Users\Admin\AppData\Local\Temp\f763054.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5cb9e38f3f12cade9ce21d92fe6f3793b
SHA1f8352f7155f893af9b5de49e26c87ae02024c043
SHA2568e9e07df92fd352ae2a69e5663c26fc6dd7358985e8c3caea1555ec7fd1afc7d
SHA5128b84d69d578c89e4e1eb281a0085e22374090186657e3e540eedbf0b19cce89a7df10e6d063be43f1917a0053241f04b9fdfe93985a2433a472b4d6ad767d782
-
\Users\Admin\AppData\Local\Temp\f7614b9.exeFilesize
97KB
MD5be65a3ce9934a24d4bbded1c0a6c4d3b
SHA1549d8dec702cc163d90cb011acc01e8b0836a526
SHA256271dc846455e0da64e1bd03fbe9fe49e0e6cd47cd806d4687349f19bcb31936d
SHA512f93044a051526299c7b2e016a6a393fee0bf837346371e1eb14c375c2a02d02b5a6a8db36bf0ab27525c6e00c7e96f0ac828a6825b3fec46914aa06d769102e9
-
memory/1040-29-0x0000000001DA0000-0x0000000001DA2000-memory.dmpFilesize
8KB
-
memory/1556-198-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1556-199-0x0000000000A60000-0x0000000001B1A000-memory.dmpFilesize
16.7MB
-
memory/1556-162-0x0000000000A60000-0x0000000001B1A000-memory.dmpFilesize
16.7MB
-
memory/1556-99-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1556-102-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/1556-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2224-61-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-20-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-49-0x00000000016D0000-0x00000000016D2000-memory.dmpFilesize
8KB
-
memory/2224-48-0x00000000016D0000-0x00000000016D2000-memory.dmpFilesize
8KB
-
memory/2224-22-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2224-14-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-146-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-145-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2224-112-0x00000000016D0000-0x00000000016D2000-memory.dmpFilesize
8KB
-
memory/2224-109-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-108-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-18-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-16-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-23-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-15-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-21-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-106-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-62-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-63-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-64-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-65-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-103-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-46-0x00000000016E0000-0x00000000016E1000-memory.dmpFilesize
4KB
-
memory/2224-17-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-80-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-81-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-82-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2224-19-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/2448-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2448-93-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2448-101-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2448-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2448-92-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2920-73-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2920-56-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2920-36-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2920-58-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/2920-35-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2920-59-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2920-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2920-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2920-45-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2920-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2920-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB