Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 03:03
Static task
static1
Behavioral task
behavioral1
Sample
55beac26204ecb61e3cabc89d7415fa82d24776b0209243e9f54b20d69d77fa4_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
55beac26204ecb61e3cabc89d7415fa82d24776b0209243e9f54b20d69d77fa4_NeikiAnalytics.dll
-
Size
120KB
-
MD5
9bd66a6fc99500821c9a1ac4bc884000
-
SHA1
45b464d93333d955222c7ad84b2089794829cb8d
-
SHA256
55beac26204ecb61e3cabc89d7415fa82d24776b0209243e9f54b20d69d77fa4
-
SHA512
0a866cca481de11412cf43cb18e65be2d86117571c95b81d712cf492eeabf5f8f10bfb3855999757db6a2dceffce0e0b6d4a80ff0aa59c55479a7b149ef04a96
-
SSDEEP
1536:Q7FZ4qs7eNhBvfxBp6QG1/0aD3XC/UYACcCIWl+cMDzkF7my3JYw0ZoZwa:QcVKVnxL6X022UYigWzkVm
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
e5753dd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5753dd.exe -
Processes:
e5753dd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5753dd.exe -
Processes:
e5753dd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5753dd.exe -
Executes dropped EXE 3 IoCs
Processes:
e5753dd.exee575563.exee577c83.exepid process 2424 e5753dd.exe 4632 e575563.exe 3876 e577c83.exe -
Processes:
resource yara_rule behavioral2/memory/2424-6-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-8-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-10-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-12-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-22-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-24-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-33-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-18-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-13-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-11-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-36-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-37-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-38-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-39-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-40-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-58-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-59-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-60-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-61-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-64-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-65-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-67-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-70-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2424-72-0x00000000007E0000-0x000000000189A000-memory.dmp upx -
Processes:
e5753dd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5753dd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5753dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5753dd.exe -
Processes:
e5753dd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5753dd.exe -
Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e5753dd.exedescription ioc process File opened (read-only) \??\E: e5753dd.exe File opened (read-only) \??\G: e5753dd.exe File opened (read-only) \??\H: e5753dd.exe File opened (read-only) \??\I: e5753dd.exe File opened (read-only) \??\J: e5753dd.exe File opened (read-only) \??\K: e5753dd.exe File opened (read-only) \??\L: e5753dd.exe -
Drops file in Windows directory 2 IoCs
Processes:
e5753dd.exedescription ioc process File created C:\Windows\e57542b e5753dd.exe File opened for modification C:\Windows\SYSTEM.INI e5753dd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e5753dd.exepid process 2424 e5753dd.exe 2424 e5753dd.exe 2424 e5753dd.exe 2424 e5753dd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e5753dd.exedescription pid process Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe Token: SeDebugPrivilege 2424 e5753dd.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
rundll32.exerundll32.exee5753dd.exedescription pid process target process PID 532 wrote to memory of 312 532 rundll32.exe rundll32.exe PID 532 wrote to memory of 312 532 rundll32.exe rundll32.exe PID 532 wrote to memory of 312 532 rundll32.exe rundll32.exe PID 312 wrote to memory of 2424 312 rundll32.exe e5753dd.exe PID 312 wrote to memory of 2424 312 rundll32.exe e5753dd.exe PID 312 wrote to memory of 2424 312 rundll32.exe e5753dd.exe PID 2424 wrote to memory of 796 2424 e5753dd.exe fontdrvhost.exe PID 2424 wrote to memory of 804 2424 e5753dd.exe fontdrvhost.exe PID 2424 wrote to memory of 376 2424 e5753dd.exe dwm.exe PID 2424 wrote to memory of 2724 2424 e5753dd.exe sihost.exe PID 2424 wrote to memory of 2804 2424 e5753dd.exe svchost.exe PID 2424 wrote to memory of 672 2424 e5753dd.exe taskhostw.exe PID 2424 wrote to memory of 3440 2424 e5753dd.exe Explorer.EXE PID 2424 wrote to memory of 3572 2424 e5753dd.exe svchost.exe PID 2424 wrote to memory of 3768 2424 e5753dd.exe DllHost.exe PID 2424 wrote to memory of 3856 2424 e5753dd.exe StartMenuExperienceHost.exe PID 2424 wrote to memory of 3924 2424 e5753dd.exe RuntimeBroker.exe PID 2424 wrote to memory of 4036 2424 e5753dd.exe SearchApp.exe PID 2424 wrote to memory of 4004 2424 e5753dd.exe RuntimeBroker.exe PID 2424 wrote to memory of 4576 2424 e5753dd.exe TextInputHost.exe PID 2424 wrote to memory of 2712 2424 e5753dd.exe RuntimeBroker.exe PID 2424 wrote to memory of 4920 2424 e5753dd.exe backgroundTaskHost.exe PID 2424 wrote to memory of 4408 2424 e5753dd.exe backgroundTaskHost.exe PID 2424 wrote to memory of 532 2424 e5753dd.exe rundll32.exe PID 2424 wrote to memory of 312 2424 e5753dd.exe rundll32.exe PID 2424 wrote to memory of 312 2424 e5753dd.exe rundll32.exe PID 312 wrote to memory of 4632 312 rundll32.exe e575563.exe PID 312 wrote to memory of 4632 312 rundll32.exe e575563.exe PID 312 wrote to memory of 4632 312 rundll32.exe e575563.exe PID 312 wrote to memory of 3876 312 rundll32.exe e577c83.exe PID 312 wrote to memory of 3876 312 rundll32.exe e577c83.exe PID 312 wrote to memory of 3876 312 rundll32.exe e577c83.exe PID 2424 wrote to memory of 796 2424 e5753dd.exe fontdrvhost.exe PID 2424 wrote to memory of 804 2424 e5753dd.exe fontdrvhost.exe PID 2424 wrote to memory of 376 2424 e5753dd.exe dwm.exe PID 2424 wrote to memory of 2724 2424 e5753dd.exe sihost.exe PID 2424 wrote to memory of 2804 2424 e5753dd.exe svchost.exe PID 2424 wrote to memory of 672 2424 e5753dd.exe taskhostw.exe PID 2424 wrote to memory of 3440 2424 e5753dd.exe Explorer.EXE PID 2424 wrote to memory of 3572 2424 e5753dd.exe svchost.exe PID 2424 wrote to memory of 3768 2424 e5753dd.exe DllHost.exe PID 2424 wrote to memory of 3856 2424 e5753dd.exe StartMenuExperienceHost.exe PID 2424 wrote to memory of 3924 2424 e5753dd.exe RuntimeBroker.exe PID 2424 wrote to memory of 4036 2424 e5753dd.exe SearchApp.exe PID 2424 wrote to memory of 4004 2424 e5753dd.exe RuntimeBroker.exe PID 2424 wrote to memory of 4576 2424 e5753dd.exe TextInputHost.exe PID 2424 wrote to memory of 2712 2424 e5753dd.exe RuntimeBroker.exe PID 2424 wrote to memory of 4920 2424 e5753dd.exe backgroundTaskHost.exe PID 2424 wrote to memory of 4408 2424 e5753dd.exe backgroundTaskHost.exe PID 2424 wrote to memory of 4632 2424 e5753dd.exe e575563.exe PID 2424 wrote to memory of 4632 2424 e5753dd.exe e575563.exe PID 2424 wrote to memory of 5080 2424 e5753dd.exe RuntimeBroker.exe PID 2424 wrote to memory of 2240 2424 e5753dd.exe RuntimeBroker.exe PID 2424 wrote to memory of 3876 2424 e5753dd.exe e577c83.exe PID 2424 wrote to memory of 3876 2424 e5753dd.exe e577c83.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e5753dd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5753dd.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55beac26204ecb61e3cabc89d7415fa82d24776b0209243e9f54b20d69d77fa4_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55beac26204ecb61e3cabc89d7415fa82d24776b0209243e9f54b20d69d77fa4_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5753dd.exeC:\Users\Admin\AppData\Local\Temp\e5753dd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e575563.exeC:\Users\Admin\AppData\Local\Temp\e575563.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e577c83.exeC:\Users\Admin\AppData\Local\Temp\e577c83.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e5753dd.exeFilesize
97KB
MD5f118c14ea4fc77ab03a069c312288bf5
SHA1290235e44adb38d32085e34dfb65ea0cf5ea3925
SHA256ab01409b70b6212ef25b7232440a3a63da25b7a9c6f902556c7c6027feda5cf7
SHA51202daf7b23fef6c502f9e199f154850f0c64c88db64132fb3cff096664a21849f7a479d98d68bc9a228ecc9a33f7541c2cd26c0090fc013bb142b75b9acab1275
-
memory/312-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/312-46-0x0000000000920000-0x0000000000922000-memory.dmpFilesize
8KB
-
memory/312-14-0x0000000000920000-0x0000000000922000-memory.dmpFilesize
8KB
-
memory/312-15-0x00000000039D0000-0x00000000039D1000-memory.dmpFilesize
4KB
-
memory/312-23-0x0000000000920000-0x0000000000922000-memory.dmpFilesize
8KB
-
memory/312-19-0x0000000000920000-0x0000000000922000-memory.dmpFilesize
8KB
-
memory/2424-18-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-39-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-33-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-90-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2424-22-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-34-0x00000000005C0000-0x00000000005C2000-memory.dmpFilesize
8KB
-
memory/2424-13-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-12-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-11-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-25-0x00000000005C0000-0x00000000005C2000-memory.dmpFilesize
8KB
-
memory/2424-10-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-17-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/2424-8-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-6-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-36-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-37-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-38-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-24-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-40-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2424-70-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-67-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-65-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-64-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-79-0x00000000005C0000-0x00000000005C2000-memory.dmpFilesize
8KB
-
memory/2424-61-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-72-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-58-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-59-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2424-60-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/3876-56-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3876-52-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3876-98-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3876-54-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3876-45-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4632-35-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4632-55-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4632-50-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4632-94-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4632-53-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB