Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 02:33
Static task
static1
Behavioral task
behavioral1
Sample
c6dc39e0ca504d863f0b63e142075ad08968b81974be1614146b785c128fc1c7.dll
Resource
win7-20240508-en
General
-
Target
c6dc39e0ca504d863f0b63e142075ad08968b81974be1614146b785c128fc1c7.dll
-
Size
120KB
-
MD5
161e0c7cd597f02dd080d2a73cdadaa6
-
SHA1
6798849f70d401db5cf36fa40aaa010e187c4043
-
SHA256
c6dc39e0ca504d863f0b63e142075ad08968b81974be1614146b785c128fc1c7
-
SHA512
196925a94bf4fa355ab1b3f08daa97a64bdeba540f0828713c06a90f0ac9025b89dcb5aece47eaf9697d913676086e8bae0176cbd9d71947c59e42f3fb768dd5
-
SSDEEP
1536:7nZYHfqvVwZ+bJIZNZnU0+5Th79iX3YNvMZAevJWRghfwwDCcSsDndj7I+bI:8fV+bJwNZnODNUhWwfwsDd/I+bI
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
f761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761fff.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761fff.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761fff.exe -
Processes:
f761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761fff.exe -
Processes:
f761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761fff.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-20-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-21-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-22-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-23-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-14-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-19-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-17-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-18-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-15-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-16-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-63-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-64-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-65-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-67-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-66-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-69-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-70-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-84-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-86-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-89-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-123-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2192-156-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 27 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-20-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-21-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-22-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-23-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2540-55-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2192-14-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-19-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-17-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-18-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-15-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-16-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-63-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-64-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-65-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-67-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-66-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-69-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-70-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/1776-83-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2192-84-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-86-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-89-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-123-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2192-152-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2540-157-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2192-156-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/1776-161-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f761fff.exef762185.exef763abf.exepid process 2192 f761fff.exe 2540 f762185.exe 1776 f763abf.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2192-20-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-21-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-22-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-23-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-14-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-19-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-17-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-18-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-15-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-16-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-63-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-64-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-65-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-67-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-66-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-69-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-70-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-84-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-86-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-89-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-123-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2192-156-0x0000000000690000-0x000000000174A000-memory.dmp upx -
Processes:
f761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761fff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761fff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761fff.exe -
Processes:
f761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761fff.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f761fff.exedescription ioc process File opened (read-only) \??\G: f761fff.exe File opened (read-only) \??\J: f761fff.exe File opened (read-only) \??\I: f761fff.exe File opened (read-only) \??\L: f761fff.exe File opened (read-only) \??\R: f761fff.exe File opened (read-only) \??\T: f761fff.exe File opened (read-only) \??\E: f761fff.exe File opened (read-only) \??\K: f761fff.exe File opened (read-only) \??\O: f761fff.exe File opened (read-only) \??\S: f761fff.exe File opened (read-only) \??\H: f761fff.exe File opened (read-only) \??\M: f761fff.exe File opened (read-only) \??\N: f761fff.exe File opened (read-only) \??\P: f761fff.exe File opened (read-only) \??\Q: f761fff.exe -
Drops file in Windows directory 2 IoCs
Processes:
f761fff.exedescription ioc process File created C:\Windows\f76205c f761fff.exe File opened for modification C:\Windows\SYSTEM.INI f761fff.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f761fff.exepid process 2192 f761fff.exe 2192 f761fff.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f761fff.exedescription pid process Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe Token: SeDebugPrivilege 2192 f761fff.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef761fff.exedescription pid process target process PID 2424 wrote to memory of 2444 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2444 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2444 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2444 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2444 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2444 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2444 2424 rundll32.exe rundll32.exe PID 2444 wrote to memory of 2192 2444 rundll32.exe f761fff.exe PID 2444 wrote to memory of 2192 2444 rundll32.exe f761fff.exe PID 2444 wrote to memory of 2192 2444 rundll32.exe f761fff.exe PID 2444 wrote to memory of 2192 2444 rundll32.exe f761fff.exe PID 2192 wrote to memory of 1100 2192 f761fff.exe taskhost.exe PID 2192 wrote to memory of 1160 2192 f761fff.exe Dwm.exe PID 2192 wrote to memory of 1188 2192 f761fff.exe Explorer.EXE PID 2192 wrote to memory of 1912 2192 f761fff.exe DllHost.exe PID 2192 wrote to memory of 2424 2192 f761fff.exe rundll32.exe PID 2192 wrote to memory of 2444 2192 f761fff.exe rundll32.exe PID 2192 wrote to memory of 2444 2192 f761fff.exe rundll32.exe PID 2444 wrote to memory of 2540 2444 rundll32.exe f762185.exe PID 2444 wrote to memory of 2540 2444 rundll32.exe f762185.exe PID 2444 wrote to memory of 2540 2444 rundll32.exe f762185.exe PID 2444 wrote to memory of 2540 2444 rundll32.exe f762185.exe PID 2444 wrote to memory of 1776 2444 rundll32.exe f763abf.exe PID 2444 wrote to memory of 1776 2444 rundll32.exe f763abf.exe PID 2444 wrote to memory of 1776 2444 rundll32.exe f763abf.exe PID 2444 wrote to memory of 1776 2444 rundll32.exe f763abf.exe PID 2192 wrote to memory of 1100 2192 f761fff.exe taskhost.exe PID 2192 wrote to memory of 1160 2192 f761fff.exe Dwm.exe PID 2192 wrote to memory of 1188 2192 f761fff.exe Explorer.EXE PID 2192 wrote to memory of 2540 2192 f761fff.exe f762185.exe PID 2192 wrote to memory of 2540 2192 f761fff.exe f762185.exe PID 2192 wrote to memory of 1776 2192 f761fff.exe f763abf.exe PID 2192 wrote to memory of 1776 2192 f761fff.exe f763abf.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
f761fff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761fff.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6dc39e0ca504d863f0b63e142075ad08968b81974be1614146b785c128fc1c7.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6dc39e0ca504d863f0b63e142075ad08968b81974be1614146b785c128fc1c7.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f761fff.exeC:\Users\Admin\AppData\Local\Temp\f761fff.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f762185.exeC:\Users\Admin\AppData\Local\Temp\f762185.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f763abf.exeC:\Users\Admin\AppData\Local\Temp\f763abf.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f761fff.exeFilesize
97KB
MD54f1ac5e14f40a0554557906f9a104e3c
SHA1244ae4d16673c8941cd5750d247d9b55689d31a1
SHA256eb86ed7288e376094acee6f9848ddf235a601f96a930580e3abe26735512bfd2
SHA512f277e2663b50968ff89589676a18d035d09f6b39fbd85d78df944d687c74a83ff61128f087a4b7bd1e14e971090e34c706eba6d64a52d4aa89754f5d5d9611d7
-
memory/1100-24-0x0000000002070000-0x0000000002072000-memory.dmpFilesize
8KB
-
memory/1776-105-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1776-161-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1776-83-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1776-108-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1776-106-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2192-22-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-43-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2192-23-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-152-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2192-123-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2192-56-0x0000000000290000-0x0000000000292000-memory.dmpFilesize
8KB
-
memory/2192-14-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-19-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-17-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-18-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-15-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-16-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-84-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-62-0x0000000000290000-0x0000000000292000-memory.dmpFilesize
8KB
-
memory/2192-21-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-89-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-20-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-86-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-63-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-64-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-65-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-67-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-66-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-69-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-70-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2192-156-0x0000000000690000-0x000000000174A000-memory.dmpFilesize
16.7MB
-
memory/2444-53-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/2444-42-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2444-82-0x00000000001D0000-0x00000000001D2000-memory.dmpFilesize
8KB
-
memory/2444-7-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2444-32-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2444-9-0x00000000001D0000-0x00000000001E2000-memory.dmpFilesize
72KB
-
memory/2444-33-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2444-79-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2444-51-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2444-8-0x00000000001D0000-0x00000000001E2000-memory.dmpFilesize
72KB
-
memory/2444-54-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2540-98-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2540-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2540-157-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2540-99-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2540-107-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB