Analysis
-
max time kernel
135s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 08:40
Behavioral task
behavioral1
Sample
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
721b758a83caa37ad1a51b55f41ec1f0
-
SHA1
90a497ae13229c029868c3b89c9519f7d652e11c
-
SHA256
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea
-
SHA512
cdcf3e69c392122a7a590babfa5c09291aa300cbf76f004363f3f938ddb6e5a7658626652b28c21166a60a2d2b7e48a1822b38b65c73b335ab82aec8f2dc1e9b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf6IIwqEK9o:E5aIwC+Agr6S/FEAGsjiII8
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1872-15-0x00000000002E0000-0x0000000000309000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exepid process 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1832 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1964 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Loads dropped DLL 2 IoCs
Processes:
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exepid process 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2488 sc.exe 1244 sc.exe 2112 sc.exe 1628 sc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exepowershell.exepowershell.exepid process 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1232 powershell.exe 2568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exedescription pid process Token: SeDebugPrivilege 2568 powershell.exe Token: SeDebugPrivilege 1232 powershell.exe Token: SeTcbPrivilege 1832 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe Token: SeTcbPrivilege 1964 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exepid process 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1832 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1964 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.execmd.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.execmd.execmd.exedescription pid process target process PID 1872 wrote to memory of 3016 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 3016 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 3016 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 3016 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 2992 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 2992 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 2992 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 2992 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 2560 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 2560 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 2560 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 2560 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe cmd.exe PID 1872 wrote to memory of 2688 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe PID 1872 wrote to memory of 2688 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe PID 1872 wrote to memory of 2688 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe PID 1872 wrote to memory of 2688 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe PID 2560 wrote to memory of 2568 2560 cmd.exe powershell.exe PID 2560 wrote to memory of 2568 2560 cmd.exe powershell.exe PID 2560 wrote to memory of 2568 2560 cmd.exe powershell.exe PID 2560 wrote to memory of 2568 2560 cmd.exe powershell.exe PID 2688 wrote to memory of 2476 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2476 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2476 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2476 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2604 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2604 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2604 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2604 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2992 wrote to memory of 2488 2992 cmd.exe sc.exe PID 2992 wrote to memory of 2488 2992 cmd.exe sc.exe PID 2992 wrote to memory of 2488 2992 cmd.exe sc.exe PID 2992 wrote to memory of 2488 2992 cmd.exe sc.exe PID 3016 wrote to memory of 1628 3016 cmd.exe sc.exe PID 3016 wrote to memory of 1628 3016 cmd.exe sc.exe PID 3016 wrote to memory of 1628 3016 cmd.exe sc.exe PID 3016 wrote to memory of 1628 3016 cmd.exe sc.exe PID 2688 wrote to memory of 2436 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2436 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2436 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2436 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe cmd.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {DFB65A56-F391-4E2D-BEBE-3E37A91C3DD2} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5def7594a7f6b0585e7f87c95ca6f468c
SHA1e56d69f2ad5ecb7500cdd01e045be8179c58e5ff
SHA256d898a8001d9e1d4f6db793093f30f8b337645fb1f5c6806cd435992605549ac9
SHA512ba95b683e5326c1157cf7fa6c8d5a87c3fb4910b4b6a369f7a3257ec711291d61de9ffde415d4e52ebd13fe257a9cb2f3ff3c9cbb9cd664bf59df777add1cf7b
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeFilesize
1.2MB
MD5721b758a83caa37ad1a51b55f41ec1f0
SHA190a497ae13229c029868c3b89c9519f7d652e11c
SHA256240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea
SHA512cdcf3e69c392122a7a590babfa5c09291aa300cbf76f004363f3f938ddb6e5a7658626652b28c21166a60a2d2b7e48a1822b38b65c73b335ab82aec8f2dc1e9b
-
memory/1832-77-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-73-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-74-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-75-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-78-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-76-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-72-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-68-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-69-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-70-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-71-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1832-79-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1872-11-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1872-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/1872-2-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-7-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-6-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-5-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-4-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-8-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-10-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-9-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-15-0x00000000002E0000-0x0000000000309000-memory.dmpFilesize
164KB
-
memory/1872-14-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-13-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-12-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1872-3-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2508-51-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2508-50-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2508-55-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2688-36-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-45-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2688-46-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2688-30-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-31-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-32-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-33-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-34-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-35-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-37-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-38-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-39-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-40-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-41-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2688-44-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB