Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
bcf3a1358c8a9a7ff917fe27cdac4dc6eb7ef4d4102166498396089ddd5c2664.dll
Resource
win7-20240220-en
General
-
Target
bcf3a1358c8a9a7ff917fe27cdac4dc6eb7ef4d4102166498396089ddd5c2664.dll
-
Size
120KB
-
MD5
158a4ffdc52453ed8b625c64f1db23f6
-
SHA1
f4bc2b1f9aff0c35111a86c61f6dbde4f80f733a
-
SHA256
bcf3a1358c8a9a7ff917fe27cdac4dc6eb7ef4d4102166498396089ddd5c2664
-
SHA512
aa7d8b73a041257e40f3a9460ae1e12724a9bce5b64145382c41d39c4819e970fbb243fa958241dd2f3a5b7e592178c7309d5dc2488005fc77f90b3c9712aa1e
-
SSDEEP
3072:i/KlPRxHXU9ldr9BMFlOy1OkIOl76QOrnc/Uw:JPRlkJ9sIkdrOrc/9
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
f76194b.exef75fda0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76194b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76194b.exe -
Processes:
f75fda0.exef76194b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76194b.exe -
Processes:
f75fda0.exef76194b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76194b.exe -
Executes dropped EXE 3 IoCs
Processes:
f75fda0.exef75ff55.exef76194b.exepid process 2920 f75fda0.exe 2524 f75ff55.exe 852 f76194b.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2432 rundll32.exe 2432 rundll32.exe 2432 rundll32.exe 2432 rundll32.exe 2432 rundll32.exe 2432 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2920-22-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-13-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-14-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-19-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-20-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-16-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-18-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-17-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-15-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-21-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-63-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-64-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-65-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-66-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-67-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-69-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-82-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-84-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-86-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-87-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-109-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2920-157-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/852-184-0x00000000009A0000-0x0000000001A5A000-memory.dmp upx behavioral1/memory/852-212-0x00000000009A0000-0x0000000001A5A000-memory.dmp upx -
Processes:
f75fda0.exef76194b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f75fda0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76194b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76194b.exe -
Processes:
f76194b.exef75fda0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76194b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f75fda0.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f75fda0.exef76194b.exedescription ioc process File opened (read-only) \??\Q: f75fda0.exe File opened (read-only) \??\R: f75fda0.exe File opened (read-only) \??\S: f75fda0.exe File opened (read-only) \??\E: f75fda0.exe File opened (read-only) \??\I: f75fda0.exe File opened (read-only) \??\K: f75fda0.exe File opened (read-only) \??\N: f75fda0.exe File opened (read-only) \??\P: f75fda0.exe File opened (read-only) \??\E: f76194b.exe File opened (read-only) \??\G: f75fda0.exe File opened (read-only) \??\L: f75fda0.exe File opened (read-only) \??\O: f75fda0.exe File opened (read-only) \??\G: f76194b.exe File opened (read-only) \??\H: f75fda0.exe File opened (read-only) \??\J: f75fda0.exe File opened (read-only) \??\M: f75fda0.exe -
Drops file in Windows directory 3 IoCs
Processes:
f75fda0.exef76194b.exedescription ioc process File created C:\Windows\f75fe0e f75fda0.exe File opened for modification C:\Windows\SYSTEM.INI f75fda0.exe File created C:\Windows\f764e3f f76194b.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f75fda0.exef76194b.exepid process 2920 f75fda0.exe 2920 f75fda0.exe 852 f76194b.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f75fda0.exef76194b.exedescription pid process Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 2920 f75fda0.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe Token: SeDebugPrivilege 852 f76194b.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef75fda0.exef76194b.exedescription pid process target process PID 2924 wrote to memory of 2432 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2432 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2432 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2432 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2432 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2432 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2432 2924 rundll32.exe rundll32.exe PID 2432 wrote to memory of 2920 2432 rundll32.exe f75fda0.exe PID 2432 wrote to memory of 2920 2432 rundll32.exe f75fda0.exe PID 2432 wrote to memory of 2920 2432 rundll32.exe f75fda0.exe PID 2432 wrote to memory of 2920 2432 rundll32.exe f75fda0.exe PID 2920 wrote to memory of 1072 2920 f75fda0.exe taskhost.exe PID 2920 wrote to memory of 1128 2920 f75fda0.exe Dwm.exe PID 2920 wrote to memory of 1152 2920 f75fda0.exe Explorer.EXE PID 2920 wrote to memory of 1712 2920 f75fda0.exe DllHost.exe PID 2920 wrote to memory of 2924 2920 f75fda0.exe rundll32.exe PID 2920 wrote to memory of 2432 2920 f75fda0.exe rundll32.exe PID 2920 wrote to memory of 2432 2920 f75fda0.exe rundll32.exe PID 2432 wrote to memory of 2524 2432 rundll32.exe f75ff55.exe PID 2432 wrote to memory of 2524 2432 rundll32.exe f75ff55.exe PID 2432 wrote to memory of 2524 2432 rundll32.exe f75ff55.exe PID 2432 wrote to memory of 2524 2432 rundll32.exe f75ff55.exe PID 2432 wrote to memory of 852 2432 rundll32.exe f76194b.exe PID 2432 wrote to memory of 852 2432 rundll32.exe f76194b.exe PID 2432 wrote to memory of 852 2432 rundll32.exe f76194b.exe PID 2432 wrote to memory of 852 2432 rundll32.exe f76194b.exe PID 2920 wrote to memory of 1072 2920 f75fda0.exe taskhost.exe PID 2920 wrote to memory of 1128 2920 f75fda0.exe Dwm.exe PID 2920 wrote to memory of 1152 2920 f75fda0.exe Explorer.EXE PID 2920 wrote to memory of 2524 2920 f75fda0.exe f75ff55.exe PID 2920 wrote to memory of 2524 2920 f75fda0.exe f75ff55.exe PID 2920 wrote to memory of 852 2920 f75fda0.exe f76194b.exe PID 2920 wrote to memory of 852 2920 f75fda0.exe f76194b.exe PID 852 wrote to memory of 1072 852 f76194b.exe taskhost.exe PID 852 wrote to memory of 1128 852 f76194b.exe Dwm.exe PID 852 wrote to memory of 1152 852 f76194b.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f75fda0.exef76194b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f75fda0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76194b.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bcf3a1358c8a9a7ff917fe27cdac4dc6eb7ef4d4102166498396089ddd5c2664.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bcf3a1358c8a9a7ff917fe27cdac4dc6eb7ef4d4102166498396089ddd5c2664.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f75fda0.exeC:\Users\Admin\AppData\Local\Temp\f75fda0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f75ff55.exeC:\Users\Admin\AppData\Local\Temp\f75ff55.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f76194b.exeC:\Users\Admin\AppData\Local\Temp\f76194b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5eda0d7eb70a2878da126bf212e3d8235
SHA1f860192326238cf6f9449d98ae5a5ad59c2d58b6
SHA2569129d19863cd20785818b3c16a53dc07db1a02a81a95f8968793cf2ac38a8208
SHA512653ae1a32312f40cf50c368c2a2dd1643bfa5382c99a84a11bbad4eef0b4875b9265d26c16bf18882250baebf740bc19f7e563c009e91fd85450990947f2dfb1
-
\Users\Admin\AppData\Local\Temp\f75fda0.exeFilesize
97KB
MD58201e81b75ed5af7928109e9d7a161ed
SHA12ea6c6c7acf903faf1171357dbb88b612274f7fd
SHA2564dcb55767d5a801e8a4a1d4468d1420c2b0c7d9a04515c21236af703947e55c1
SHA51263aa4d97f6ab05a5dcec6ff55e70aeacab01feb930c0d6dac905757bbd6f4e5215c0fb72d0ca5c377e9d9c9fb4cf3929fc7b91dc1b55cfb2d7f55fb57d6ee701
-
memory/852-211-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-212-0x00000000009A0000-0x0000000001A5A000-memory.dmpFilesize
16.7MB
-
memory/852-184-0x00000000009A0000-0x0000000001A5A000-memory.dmpFilesize
16.7MB
-
memory/852-107-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/852-108-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/852-103-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1072-28-0x0000000002010000-0x0000000002012000-memory.dmpFilesize
8KB
-
memory/2432-60-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/2432-57-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2432-9-0x00000000000C0000-0x00000000000D2000-memory.dmpFilesize
72KB
-
memory/2432-80-0x00000000000C0000-0x00000000000C2000-memory.dmpFilesize
8KB
-
memory/2432-61-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2432-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2432-78-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2432-38-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2432-37-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2432-47-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2524-106-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2524-98-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2524-97-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2524-161-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2524-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2920-69-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-18-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-64-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-65-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-66-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-67-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-21-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-15-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-17-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-82-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-84-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-86-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-87-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-63-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-20-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-16-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-19-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-14-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-48-0x00000000017F0000-0x00000000017F1000-memory.dmpFilesize
4KB
-
memory/2920-109-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-133-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB
-
memory/2920-157-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-156-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2920-59-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB
-
memory/2920-13-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-22-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2920-50-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB
-
memory/2920-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB