Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 05:47
Behavioral task
behavioral1
Sample
08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
98143cf3aafa5f8f370d552fb99fe360
-
SHA1
67cc505864cf76a4a448c77230fbb9686be993c6
-
SHA256
08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3
-
SHA512
4462b54386fc45613be421b4f366ccc86ba592334e18d7952c5ea03801ac1c39526c4ea07e80203708a3ce8eb631478485f095ac50bebaa8691aff45fb1c442f
-
SSDEEP
24576:zQ5aILMCfmAUjzX677WOMcT/X2dI7T2FAoUcUOp6doF5ES/mfuOdfHhGEi:E5aIwC+Agr6tdlmU1/eHKO
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/1144-16-0x0000000002FF0000-0x0000000003019000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exepid process 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exedescription pid process Token: SeTcbPrivilege 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe Token: SeTcbPrivilege 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exepid process 1144 08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exedescription pid process target process PID 1144 wrote to memory of 1444 1144 08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe PID 1144 wrote to memory of 1444 1144 08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe PID 1144 wrote to memory of 1444 1144 08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1444 wrote to memory of 1900 1444 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 2472 wrote to memory of 3068 2472 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1564 wrote to memory of 4440 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1564 wrote to memory of 4440 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1564 wrote to memory of 4440 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1564 wrote to memory of 4440 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1564 wrote to memory of 4440 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1564 wrote to memory of 4440 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1564 wrote to memory of 4440 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1564 wrote to memory of 4440 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe PID 1564 wrote to memory of 4440 1564 09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\08ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\09ad7eb8fef39a9c076a799fd4344f1ff46cd1e39f6379a6ba32afedffc087c3_NeikiAnalytict.exeFilesize
1.4MB
MD598143cf3aafa5f8f370d552fb99fe360
SHA167cc505864cf76a4a448c77230fbb9686be993c6
SHA25608ad6eb7fef38a9c065a688fd4344f1ff45cd1e39f5369a5ba32afedffc076c3
SHA5124462b54386fc45613be421b4f366ccc86ba592334e18d7952c5ea03801ac1c39526c4ea07e80203708a3ce8eb631478485f095ac50bebaa8691aff45fb1c442f
-
C:\Users\Admin\AppData\Roaming\WinSocket\settings.iniFilesize
39KB
MD5891825276f986b4624cfeaa02e86e882
SHA1a70a9564081f135a6b80af1f171472d8c8414ba8
SHA256d704d010b86c8e7ce9d983f38c884affe9b855a0ac337c1ef3d35c42a47961c7
SHA512d764d503f22565b5c58a76aa714eff340a5307cec48954a4a714e427c1630e30b93f4d080c1b7db9e89f1fde8b16e92f78ccc0173b392e5bcb678ae3f6e8648d
-
memory/1144-16-0x0000000002FF0000-0x0000000003019000-memory.dmpFilesize
164KB
-
memory/1144-14-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1144-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/1144-13-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-12-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-11-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-10-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-9-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-8-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-7-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-6-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-5-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-4-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-3-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1144-2-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1444-37-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-36-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-35-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-34-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-40-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1444-33-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-32-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-31-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-30-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-29-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-28-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-27-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-26-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1444-41-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/1444-42-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/1444-52-0x0000000003060000-0x000000000311E000-memory.dmpFilesize
760KB
-
memory/1444-53-0x0000000003160000-0x0000000003429000-memory.dmpFilesize
2.8MB
-
memory/1900-48-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/1900-51-0x0000022E63950000-0x0000022E63951000-memory.dmpFilesize
4KB
-
memory/1900-46-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2472-72-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/2472-58-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-69-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-68-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-67-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-66-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-65-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-64-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-63-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-62-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-61-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-60-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-59-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2472-73-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB