Analysis
-
max time kernel
138s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 08:40
Behavioral task
behavioral1
Sample
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
721b758a83caa37ad1a51b55f41ec1f0
-
SHA1
90a497ae13229c029868c3b89c9519f7d652e11c
-
SHA256
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea
-
SHA512
cdcf3e69c392122a7a590babfa5c09291aa300cbf76f004363f3f938ddb6e5a7658626652b28c21166a60a2d2b7e48a1822b38b65c73b335ab82aec8f2dc1e9b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf6IIwqEK9o:E5aIwC+Agr6S/FEAGsjiII8
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/2576-15-0x0000000002C50000-0x0000000002C79000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exepid process 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exedescription pid process Token: SeTcbPrivilege 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe Token: SeTcbPrivilege 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exepid process 2576 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exedescription pid process target process PID 2576 wrote to memory of 5104 2576 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe PID 2576 wrote to memory of 5104 2576 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe PID 2576 wrote to memory of 5104 2576 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeFilesize
1.2MB
MD5721b758a83caa37ad1a51b55f41ec1f0
SHA190a497ae13229c029868c3b89c9519f7d652e11c
SHA256240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea
SHA512cdcf3e69c392122a7a590babfa5c09291aa300cbf76f004363f3f938ddb6e5a7658626652b28c21166a60a2d2b7e48a1822b38b65c73b335ab82aec8f2dc1e9b
-
C:\Users\Admin\AppData\Roaming\WinSocket\settings.iniFilesize
59KB
MD5a516b3423fada769bdc50e381740c1ba
SHA16921c699d555811079666f29642d4bcb53d14dbd
SHA25604e143163368893d90d221802e295f8f61f89b392f761fd2f7f9af033e6a653d
SHA512e6489d3969a03a48ff8e49a88b098da4fcca19c4220191cc47c8f8e43d2d565e7142f4bf0b83c901c5d12e97138cd6fad7c58fbf9d8577bb0a665059618109b5
-
memory/1304-66-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-73-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1304-58-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-69-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-68-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-67-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-62-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-72-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/1304-59-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-60-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-65-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-61-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-64-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1304-63-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/2576-7-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-12-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-4-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-5-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2576-3-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-8-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-9-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-11-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-10-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-15-0x0000000002C50000-0x0000000002C79000-memory.dmpFilesize
164KB
-
memory/2576-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/2576-2-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-6-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-14-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2576-13-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/4956-51-0x0000028334D10000-0x0000028334D11000-memory.dmpFilesize
4KB
-
memory/4956-47-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/4956-46-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/5104-40-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/5104-26-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-27-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-28-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-30-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-31-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-32-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-33-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-34-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-35-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-53-0x0000000003160000-0x0000000003429000-memory.dmpFilesize
2.8MB
-
memory/5104-41-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/5104-52-0x0000000003060000-0x000000000311E000-memory.dmpFilesize
760KB
-
memory/5104-42-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/5104-36-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-37-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/5104-29-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB