Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 09:30
Static task
static1
Behavioral task
behavioral1
Sample
95c204834486f226cccd446454c8781489efccdeb8332ac004908ab2963ac944_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
95c204834486f226cccd446454c8781489efccdeb8332ac004908ab2963ac944_NeikiAnalytics.dll
-
Size
120KB
-
MD5
6df4ec2a8a91a5995e55d16bf4b72d40
-
SHA1
50b4fc4ccbf934947d13ea0b209cb2d64bd2d6e2
-
SHA256
95c204834486f226cccd446454c8781489efccdeb8332ac004908ab2963ac944
-
SHA512
eaaf21a0a5ae86c5700bd4ab09620ecb9060f1e8aac2f352518111d47e2293bc33e10a3aac3ca9790aadc823064a34cdd1e0074cf77235dbe943ee485dc0fbd2
-
SSDEEP
3072:5Zi8aCojvqs5R+SdWRgHErlSPJRvsGE7MzXwv:5b8vf53dqTr8vREAy
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
f761e2b.exef761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761fff.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761fff.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761fff.exe -
Processes:
f761e2b.exef761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761fff.exe -
Processes:
f761e2b.exef761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761fff.exe -
Executes dropped EXE 3 IoCs
Processes:
f761e2b.exef761fff.exef7639b6.exepid process 1816 f761e2b.exe 1696 f761fff.exe 2560 f7639b6.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1816-19-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-22-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-21-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-23-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-20-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-18-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-17-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-24-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-16-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-25-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-64-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-63-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-65-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-67-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-66-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-69-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-70-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-84-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-88-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-89-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-108-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-110-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-111-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1816-151-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1696-158-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Processes:
f761e2b.exef761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761fff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761e2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761fff.exe -
Processes:
f761e2b.exef761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761fff.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f761e2b.exedescription ioc process File opened (read-only) \??\P: f761e2b.exe File opened (read-only) \??\Q: f761e2b.exe File opened (read-only) \??\J: f761e2b.exe File opened (read-only) \??\K: f761e2b.exe File opened (read-only) \??\L: f761e2b.exe File opened (read-only) \??\N: f761e2b.exe File opened (read-only) \??\G: f761e2b.exe File opened (read-only) \??\I: f761e2b.exe File opened (read-only) \??\T: f761e2b.exe File opened (read-only) \??\E: f761e2b.exe File opened (read-only) \??\H: f761e2b.exe File opened (read-only) \??\R: f761e2b.exe File opened (read-only) \??\S: f761e2b.exe File opened (read-only) \??\M: f761e2b.exe File opened (read-only) \??\O: f761e2b.exe -
Drops file in Windows directory 2 IoCs
Processes:
f761e2b.exedescription ioc process File created C:\Windows\f761ea8 f761e2b.exe File opened for modification C:\Windows\SYSTEM.INI f761e2b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f761e2b.exepid process 1816 f761e2b.exe 1816 f761e2b.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f761e2b.exedescription pid process Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe Token: SeDebugPrivilege 1816 f761e2b.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef761e2b.exedescription pid process target process PID 1252 wrote to memory of 2060 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2060 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2060 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2060 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2060 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2060 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2060 1252 rundll32.exe rundll32.exe PID 2060 wrote to memory of 1816 2060 rundll32.exe f761e2b.exe PID 2060 wrote to memory of 1816 2060 rundll32.exe f761e2b.exe PID 2060 wrote to memory of 1816 2060 rundll32.exe f761e2b.exe PID 2060 wrote to memory of 1816 2060 rundll32.exe f761e2b.exe PID 1816 wrote to memory of 1096 1816 f761e2b.exe taskhost.exe PID 1816 wrote to memory of 1160 1816 f761e2b.exe Dwm.exe PID 1816 wrote to memory of 1204 1816 f761e2b.exe Explorer.EXE PID 1816 wrote to memory of 2212 1816 f761e2b.exe DllHost.exe PID 1816 wrote to memory of 1252 1816 f761e2b.exe rundll32.exe PID 1816 wrote to memory of 2060 1816 f761e2b.exe rundll32.exe PID 1816 wrote to memory of 2060 1816 f761e2b.exe rundll32.exe PID 2060 wrote to memory of 1696 2060 rundll32.exe f761fff.exe PID 2060 wrote to memory of 1696 2060 rundll32.exe f761fff.exe PID 2060 wrote to memory of 1696 2060 rundll32.exe f761fff.exe PID 2060 wrote to memory of 1696 2060 rundll32.exe f761fff.exe PID 2060 wrote to memory of 2560 2060 rundll32.exe f7639b6.exe PID 2060 wrote to memory of 2560 2060 rundll32.exe f7639b6.exe PID 2060 wrote to memory of 2560 2060 rundll32.exe f7639b6.exe PID 2060 wrote to memory of 2560 2060 rundll32.exe f7639b6.exe PID 1816 wrote to memory of 1096 1816 f761e2b.exe taskhost.exe PID 1816 wrote to memory of 1160 1816 f761e2b.exe Dwm.exe PID 1816 wrote to memory of 1204 1816 f761e2b.exe Explorer.EXE PID 1816 wrote to memory of 1696 1816 f761e2b.exe f761fff.exe PID 1816 wrote to memory of 1696 1816 f761e2b.exe f761fff.exe PID 1816 wrote to memory of 2560 1816 f761e2b.exe f7639b6.exe PID 1816 wrote to memory of 2560 1816 f761e2b.exe f7639b6.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
f761e2b.exef761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761fff.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95c204834486f226cccd446454c8781489efccdeb8332ac004908ab2963ac944_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95c204834486f226cccd446454c8781489efccdeb8332ac004908ab2963ac944_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f761e2b.exeC:\Users\Admin\AppData\Local\Temp\f761e2b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f761fff.exeC:\Users\Admin\AppData\Local\Temp\f761fff.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f7639b6.exeC:\Users\Admin\AppData\Local\Temp\f7639b6.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f761e2b.exeFilesize
97KB
MD54bfcdbe4ccb77f52b5c5d6cd611ff2ac
SHA10e3e30efedb06a7821591e191bc94226e7a4318d
SHA256569e93a0e035e8ecc462c7626c1e7325f80b8351bdfbbdd93d7c2a5398e20229
SHA512e67113e38187d079dafa1e51746cf6912c38a85d4e17f46c761127e38c372ea3937f1a1a9e3edd4db75096b8cbcd72740be82234772c1520ceda23fbb8ab909c
-
memory/1096-31-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1696-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1696-158-0x0000000000930000-0x00000000019EA000-memory.dmpFilesize
16.7MB
-
memory/1696-157-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1696-106-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1696-98-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1696-99-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1816-89-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-66-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-152-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1816-50-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1816-22-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-151-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-122-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1816-58-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1816-48-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/1816-111-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-23-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-110-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-19-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-20-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-18-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-17-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-24-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-16-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-25-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-64-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-63-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-65-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-67-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-21-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-69-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-70-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-108-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-13-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1816-84-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1816-88-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/2060-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2060-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2060-78-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2060-12-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2060-38-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2060-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2060-4-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2060-47-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2060-39-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2060-81-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/2060-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2060-59-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/2060-60-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2560-105-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2560-107-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2560-104-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2560-162-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB