Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 01:29
Static task
static1
Behavioral task
behavioral1
Sample
2b36ed5591854c78ad24fd72ae32a06d730b34ec60a9559c98fb8af8ed69b8e1_NeikiAnalytics.dll
Resource
win7-20240220-en
General
-
Target
2b36ed5591854c78ad24fd72ae32a06d730b34ec60a9559c98fb8af8ed69b8e1_NeikiAnalytics.dll
-
Size
120KB
-
MD5
f63adb8e3a7940e91f9f02fccac58630
-
SHA1
c7dc50add0c0fcf906e5a720615740eb8080e497
-
SHA256
2b36ed5591854c78ad24fd72ae32a06d730b34ec60a9559c98fb8af8ed69b8e1
-
SHA512
e8715770167a82a17124b53a4f803aa8605a12c12f6780b67b8e20e53a136e3ce13f5b3460f51a2c52414db6727f84501174e4bc70e44ecfdcd69c840a33691a
-
SSDEEP
1536:3OWKOYJHkgxuMUO7p3Ib8ggO9uahkYedNistxU52Zm98jKsYZB39gD60:3OWEHkO37Kb3/oYedN652oL79
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
e573ab7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573ab7.exe -
Processes:
e573ab7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573ab7.exe -
Processes:
e573ab7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573ab7.exe -
Executes dropped EXE 3 IoCs
Processes:
e573ab7.exee573bd0.exee57560f.exepid process 3948 e573ab7.exe 2060 e573bd0.exe 4472 e57560f.exe -
Processes:
resource yara_rule behavioral2/memory/3948-6-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-9-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-8-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-24-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-31-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-28-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-33-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-11-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-10-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-34-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-35-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-36-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-37-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-38-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-39-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-41-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-42-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-50-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-52-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-53-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-63-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-64-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-68-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-70-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-72-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-74-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-76-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-78-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-81-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3948-83-0x00000000008B0000-0x000000000196A000-memory.dmp upx -
Processes:
e573ab7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573ab7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573ab7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573ab7.exe -
Processes:
e573ab7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573ab7.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e573ab7.exedescription ioc process File opened (read-only) \??\G: e573ab7.exe File opened (read-only) \??\P: e573ab7.exe File opened (read-only) \??\K: e573ab7.exe File opened (read-only) \??\L: e573ab7.exe File opened (read-only) \??\Q: e573ab7.exe File opened (read-only) \??\R: e573ab7.exe File opened (read-only) \??\S: e573ab7.exe File opened (read-only) \??\E: e573ab7.exe File opened (read-only) \??\H: e573ab7.exe File opened (read-only) \??\I: e573ab7.exe File opened (read-only) \??\J: e573ab7.exe File opened (read-only) \??\M: e573ab7.exe File opened (read-only) \??\N: e573ab7.exe File opened (read-only) \??\O: e573ab7.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e573ab7.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zG.exe e573ab7.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e573ab7.exe File opened for modification C:\Program Files\7-Zip\7z.exe e573ab7.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e573ab7.exe -
Drops file in Windows directory 2 IoCs
Processes:
e573ab7.exedescription ioc process File created C:\Windows\e573b44 e573ab7.exe File opened for modification C:\Windows\SYSTEM.INI e573ab7.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e573ab7.exepid process 3948 e573ab7.exe 3948 e573ab7.exe 3948 e573ab7.exe 3948 e573ab7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e573ab7.exedescription pid process Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe Token: SeDebugPrivilege 3948 e573ab7.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
rundll32.exerundll32.exee573ab7.exedescription pid process target process PID 3136 wrote to memory of 3936 3136 rundll32.exe rundll32.exe PID 3136 wrote to memory of 3936 3136 rundll32.exe rundll32.exe PID 3136 wrote to memory of 3936 3136 rundll32.exe rundll32.exe PID 3936 wrote to memory of 3948 3936 rundll32.exe e573ab7.exe PID 3936 wrote to memory of 3948 3936 rundll32.exe e573ab7.exe PID 3936 wrote to memory of 3948 3936 rundll32.exe e573ab7.exe PID 3948 wrote to memory of 784 3948 e573ab7.exe fontdrvhost.exe PID 3948 wrote to memory of 792 3948 e573ab7.exe fontdrvhost.exe PID 3948 wrote to memory of 336 3948 e573ab7.exe dwm.exe PID 3948 wrote to memory of 3024 3948 e573ab7.exe sihost.exe PID 3948 wrote to memory of 2708 3948 e573ab7.exe svchost.exe PID 3948 wrote to memory of 780 3948 e573ab7.exe taskhostw.exe PID 3948 wrote to memory of 3456 3948 e573ab7.exe Explorer.EXE PID 3948 wrote to memory of 3552 3948 e573ab7.exe svchost.exe PID 3948 wrote to memory of 3748 3948 e573ab7.exe DllHost.exe PID 3948 wrote to memory of 3832 3948 e573ab7.exe StartMenuExperienceHost.exe PID 3948 wrote to memory of 3900 3948 e573ab7.exe RuntimeBroker.exe PID 3948 wrote to memory of 3988 3948 e573ab7.exe SearchApp.exe PID 3948 wrote to memory of 3872 3948 e573ab7.exe RuntimeBroker.exe PID 3948 wrote to memory of 4524 3948 e573ab7.exe RuntimeBroker.exe PID 3948 wrote to memory of 4228 3948 e573ab7.exe TextInputHost.exe PID 3948 wrote to memory of 4612 3948 e573ab7.exe backgroundTaskHost.exe PID 3948 wrote to memory of 2408 3948 e573ab7.exe backgroundTaskHost.exe PID 3948 wrote to memory of 3136 3948 e573ab7.exe rundll32.exe PID 3948 wrote to memory of 3936 3948 e573ab7.exe rundll32.exe PID 3948 wrote to memory of 3936 3948 e573ab7.exe rundll32.exe PID 3936 wrote to memory of 2060 3936 rundll32.exe e573bd0.exe PID 3936 wrote to memory of 2060 3936 rundll32.exe e573bd0.exe PID 3936 wrote to memory of 2060 3936 rundll32.exe e573bd0.exe PID 3936 wrote to memory of 4472 3936 rundll32.exe e57560f.exe PID 3936 wrote to memory of 4472 3936 rundll32.exe e57560f.exe PID 3936 wrote to memory of 4472 3936 rundll32.exe e57560f.exe PID 3948 wrote to memory of 784 3948 e573ab7.exe fontdrvhost.exe PID 3948 wrote to memory of 792 3948 e573ab7.exe fontdrvhost.exe PID 3948 wrote to memory of 336 3948 e573ab7.exe dwm.exe PID 3948 wrote to memory of 3024 3948 e573ab7.exe sihost.exe PID 3948 wrote to memory of 2708 3948 e573ab7.exe svchost.exe PID 3948 wrote to memory of 780 3948 e573ab7.exe taskhostw.exe PID 3948 wrote to memory of 3456 3948 e573ab7.exe Explorer.EXE PID 3948 wrote to memory of 3552 3948 e573ab7.exe svchost.exe PID 3948 wrote to memory of 3748 3948 e573ab7.exe DllHost.exe PID 3948 wrote to memory of 3832 3948 e573ab7.exe StartMenuExperienceHost.exe PID 3948 wrote to memory of 3900 3948 e573ab7.exe RuntimeBroker.exe PID 3948 wrote to memory of 3988 3948 e573ab7.exe SearchApp.exe PID 3948 wrote to memory of 3872 3948 e573ab7.exe RuntimeBroker.exe PID 3948 wrote to memory of 4524 3948 e573ab7.exe RuntimeBroker.exe PID 3948 wrote to memory of 4228 3948 e573ab7.exe TextInputHost.exe PID 3948 wrote to memory of 4612 3948 e573ab7.exe backgroundTaskHost.exe PID 3948 wrote to memory of 2060 3948 e573ab7.exe e573bd0.exe PID 3948 wrote to memory of 2060 3948 e573ab7.exe e573bd0.exe PID 3948 wrote to memory of 4372 3948 e573ab7.exe RuntimeBroker.exe PID 3948 wrote to memory of 1480 3948 e573ab7.exe RuntimeBroker.exe PID 3948 wrote to memory of 4472 3948 e573ab7.exe e57560f.exe PID 3948 wrote to memory of 4472 3948 e573ab7.exe e57560f.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e573ab7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573ab7.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b36ed5591854c78ad24fd72ae32a06d730b34ec60a9559c98fb8af8ed69b8e1_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b36ed5591854c78ad24fd72ae32a06d730b34ec60a9559c98fb8af8ed69b8e1_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e573ab7.exeC:\Users\Admin\AppData\Local\Temp\e573ab7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e573bd0.exeC:\Users\Admin\AppData\Local\Temp\e573bd0.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e57560f.exeC:\Users\Admin\AppData\Local\Temp\e57560f.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e573ab7.exeFilesize
97KB
MD58a5af57da92abb04e1eaab9146be009d
SHA166dcaf57f81ce90bfca31f2307b6b303981b7d63
SHA25617f059416eb3d9252455c0074ec0923e2e0e18441bd078bbcab9dd09c0959199
SHA512b5fabae7f611da904cefcdadd5bc74fd283c1fe43808becc8d9da60c6409108ffc3acbc6d51cbea2a0446e0f9e50a6c97c9df7dd7c00c3e1c009a0282606f90e
-
memory/2060-103-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2060-56-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2060-57-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2060-61-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3936-26-0x0000000004360000-0x0000000004361000-memory.dmpFilesize
4KB
-
memory/3936-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/3936-12-0x0000000004220000-0x0000000004222000-memory.dmpFilesize
8KB
-
memory/3936-25-0x0000000004220000-0x0000000004222000-memory.dmpFilesize
8KB
-
memory/3936-13-0x0000000004220000-0x0000000004222000-memory.dmpFilesize
8KB
-
memory/3948-39-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-53-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-11-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-33-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-10-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-28-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-31-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-16-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB
-
memory/3948-24-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-34-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-35-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-36-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-37-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-38-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-27-0x0000000000780000-0x0000000000782000-memory.dmpFilesize
8KB
-
memory/3948-41-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-42-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-50-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-52-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-29-0x0000000000780000-0x0000000000782000-memory.dmpFilesize
8KB
-
memory/3948-104-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3948-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3948-83-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-8-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-9-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-6-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-63-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-64-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-68-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-70-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-72-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-74-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-76-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-78-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-81-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3948-91-0x0000000000780000-0x0000000000782000-memory.dmpFilesize
8KB
-
memory/4472-62-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4472-59-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4472-60-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4472-108-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB