Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:05
Static task
static1
Behavioral task
behavioral1
Sample
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe
-
Size
596KB
-
MD5
1d3535cc01b2cc54b808a55e945707a0
-
SHA1
a9a563b8ee37f17c847248bb207b28086d9f4628
-
SHA256
f5faa2b827aaae846580fe313cfc3562fcf04dbf26320c7190247621c7e10f19
-
SHA512
4c344a2abc7ace17a3fced1e3fcf09ac959b47d8bc1a5bf4280d46c3dccd015254a42ce722f93bbbe28f9866696db685df6209b4e863fa9e02772753eeb2ebbc
-
SSDEEP
12288:15/Sm4/r42toIX4IaZo2BOtdMKX8MbICwAvV6LwfAnxMlpxxWmBNIg9SWvAK:70/rX8IJ2BwNQcfAnxgDzBx
Malware Config
Extracted
redline
Vic
beshomandotestbesnd.run.place:1111
Extracted
xworm
127.0.0.1:7000
beshomandotestbesnd.run.place:7000
-
Install_directory
%ProgramData%
-
install_file
taskmgr.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/1448-339-0x0000000000F80000-0x0000000000F8E000-memory.dmp disable_win_def -
Detect Xworm Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1448-137-0x0000000000FB0000-0x0000000000FCA000-memory.dmp family_xworm C:\ProgramData\system.exe family_xworm behavioral1/memory/852-352-0x0000000000270000-0x000000000028A000-memory.dmp family_xworm behavioral1/memory/2808-475-0x0000000000290000-0x00000000002AA000-memory.dmp family_xworm -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\ProgramData\build.exe family_redline behavioral1/memory/1596-134-0x00000000000C0000-0x00000000000DE000-memory.dmp family_redline behavioral1/memory/1448-338-0x0000000000F50000-0x0000000000F6E000-memory.dmp family_redline -
SectopRAT payload 6 IoCs
Processes:
resource yara_rule C:\ProgramData\build.exe family_sectoprat behavioral1/memory/1596-134-0x00000000000C0000-0x00000000000DE000-memory.dmp family_sectoprat behavioral1/memory/1596-138-0x00000000049F0000-0x0000000004A30000-memory.dmp family_sectoprat behavioral1/memory/1596-337-0x00000000049F0000-0x0000000004A30000-memory.dmp family_sectoprat behavioral1/memory/1448-338-0x0000000000F50000-0x0000000000F6E000-memory.dmp family_sectoprat behavioral1/memory/1448-348-0x000000001B1F0000-0x000000001B270000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2580 powershell.exe 1408 powershell.exe 772 powershell.exe 2180 powershell.exe -
.NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral1/memory/2912-5-0x0000000002260000-0x00000000022C6000-memory.dmp net_reactor behavioral1/memory/2912-6-0x0000000002150000-0x00000000021B4000-memory.dmp net_reactor behavioral1/memory/2912-8-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-20-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-70-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-68-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-66-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-64-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-62-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-56-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-54-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-52-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-50-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-49-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-44-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-43-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-40-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-38-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-32-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-30-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-28-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-26-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-24-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-22-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-60-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-58-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-46-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-18-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-16-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-36-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-34-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-14-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-12-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-10-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor behavioral1/memory/2912-7-0x0000000002150000-0x00000000021AF000-memory.dmp net_reactor -
Drops startup file 2 IoCs
Processes:
system.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskmgr.lnk system.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskmgr.lnk system.exe -
Executes dropped EXE 4 IoCs
Processes:
system.exebuild.exetaskmgr.exetaskmgr.exepid process 1448 system.exe 1596 build.exe 852 taskmgr.exe 2808 taskmgr.exe -
Loads dropped DLL 2 IoCs
Processes:
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exepid process 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
system.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskmgr = "C:\\ProgramData\\taskmgr.exe" system.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
build.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 build.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 build.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 build.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
system.exepid process 1448 system.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exesystem.exebuild.exepid process 2580 powershell.exe 2180 powershell.exe 1408 powershell.exe 772 powershell.exe 1448 system.exe 1596 build.exe 1596 build.exe 1448 system.exe 1448 system.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exesystem.exebuild.exepowershell.exepowershell.exepowershell.exepowershell.exetaskmgr.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe Token: SeDebugPrivilege 1448 system.exe Token: SeDebugPrivilege 1596 build.exe Token: SeDebugPrivilege 2580 powershell.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeDebugPrivilege 772 powershell.exe Token: SeDebugPrivilege 1448 system.exe Token: SeDebugPrivilege 852 taskmgr.exe Token: SeDebugPrivilege 2808 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
system.exepid process 1448 system.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exesystem.exetaskeng.exedescription pid process target process PID 2912 wrote to memory of 1448 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe system.exe PID 2912 wrote to memory of 1448 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe system.exe PID 2912 wrote to memory of 1448 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe system.exe PID 2912 wrote to memory of 1448 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe system.exe PID 2912 wrote to memory of 1596 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe build.exe PID 2912 wrote to memory of 1596 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe build.exe PID 2912 wrote to memory of 1596 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe build.exe PID 2912 wrote to memory of 1596 2912 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe build.exe PID 1448 wrote to memory of 2580 1448 system.exe powershell.exe PID 1448 wrote to memory of 2580 1448 system.exe powershell.exe PID 1448 wrote to memory of 2580 1448 system.exe powershell.exe PID 1448 wrote to memory of 2180 1448 system.exe powershell.exe PID 1448 wrote to memory of 2180 1448 system.exe powershell.exe PID 1448 wrote to memory of 2180 1448 system.exe powershell.exe PID 1448 wrote to memory of 1408 1448 system.exe powershell.exe PID 1448 wrote to memory of 1408 1448 system.exe powershell.exe PID 1448 wrote to memory of 1408 1448 system.exe powershell.exe PID 1448 wrote to memory of 772 1448 system.exe powershell.exe PID 1448 wrote to memory of 772 1448 system.exe powershell.exe PID 1448 wrote to memory of 772 1448 system.exe powershell.exe PID 1448 wrote to memory of 1176 1448 system.exe schtasks.exe PID 1448 wrote to memory of 1176 1448 system.exe schtasks.exe PID 1448 wrote to memory of 1176 1448 system.exe schtasks.exe PID 1672 wrote to memory of 852 1672 taskeng.exe taskmgr.exe PID 1672 wrote to memory of 852 1672 taskeng.exe taskmgr.exe PID 1672 wrote to memory of 852 1672 taskeng.exe taskmgr.exe PID 1672 wrote to memory of 2808 1672 taskeng.exe taskmgr.exe PID 1672 wrote to memory of 2808 1672 taskeng.exe taskmgr.exe PID 1672 wrote to memory of 2808 1672 taskeng.exe taskmgr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\ProgramData\system.exe"C:\ProgramData\system.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"3⤵
- Creates scheduled task(s)
PID:1176 -
C:\ProgramData\build.exe"C:\ProgramData\build.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
C:\Windows\system32\taskeng.exetaskeng.exe {E06C42AA-EEB0-46B7-ACD1-08BCF95562C9} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\ProgramData\taskmgr.exeC:\ProgramData\taskmgr.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:852 -
C:\ProgramData\taskmgr.exeC:\ProgramData\taskmgr.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2808
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\build.exeFilesize
95KB
MD516280875fdcf55ab4c8f1dff6dabc72e
SHA139880e6fbb258f4f4fa5c79337ec893acae55fb7
SHA25691455ac8837ff1fdba7067cd3e7f790c1649ae70164ccbdf0483eae831a7253a
SHA51253ba4e5e88a8f19ba3faa2f1244501c2d62827a9178ec0fdc995582e03e7d8e39f2dfd7bde11285781a65a021d4f4aab48b94be66a8a1cebbd47ab0cb819202e
-
C:\ProgramData\system.exeFilesize
75KB
MD570b9f8ef4c4ce24fe372b292aebcd138
SHA15fd7ce9318727b27db0dd50effbb632686d53f8c
SHA25615af516d88e83cfc8d3deebe7aeb9ccaebc558fc93544ef31b612113fcce907b
SHA512b4658ccb665aa9f43cc049a51c477a0b314c5c13d254d648e34f9feca9feb06021bbf271857f73998e31cc7f877fa5457fbe7420beb58f3563fbfbe121a4cbad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a446ac12ba523086f5cbb3a3b9a41b05
SHA16e87c261fc7a6998905dd19e4ee2d9ad506a10e8
SHA256bca6dc8e4443cc83f9fc28dd74bde69186fe6e1b50971e75fa094c9ca1cc872a
SHA51285a83815e8701278ea035fa93c6f2b99da0992d93c4ccdbc9a16acf3e6880575c753b66d3f0f91dc58a9834655c5a19e806c53ec3e40e73c8ac7b40757eef673
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a750133d79254dba35dd7c0c8d293577
SHA11fde938d32a487e65fd744c8fac34a5b979640ea
SHA256f02a09cf320f1b69ced1720c62b671f7f6a7673884129a6e1e8b0364bb34ebc3
SHA5125a44978fea3de5758b22013fdd98c502484123c02434c5927b1d5822e1f2720d2999f92f8e93f72d5259d253aa441be1eccce5a9456229fb4644c2fd4656740e
-
C:\Users\Admin\AppData\Local\Temp\Cab3BBB.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar3CBB.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\tmp42AC.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp42C1.tmpFilesize
92KB
MD518e04095708297d6889a6962f81e8d8f
SHA19a25645db1da0217092c06579599b04982192124
SHA2564ed16c019fe50bb4ab1c9dcedf0e52f93454b5dbaf18615d60761e7927b69fb7
SHA51245ec57bddeeb8bca05babcf8da83bf9db630819b23076a1cf79f2e54b3e88e14cd7db650332554026ab5e8634061dd699f322bcba6683765063e67ac47ea1caf
-
C:\Users\Admin\AppData\Local\Temp\tmpB284.tmpFilesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
C:\Users\Admin\AppData\Local\Temp\tmpB69B.tmpFilesize
958KB
MD514d1aa6ede65544d3d2631768643b8c1
SHA1b492b5d9f785d4237911b3180b7eb78b95b90d34
SHA2562d4931d0c8474ba3a93c6542b3c95e4a23ddcd07751a870c892e1088a823ba9e
SHA512f3ae79743e1d8ed199b6923f1657239436c2431868df87a126772452473883d3bc71fd3427e918c543408e6a76f1f9a6e6ae0821643b9662a91c9de8014df998
-
C:\Users\Admin\AppData\Local\Temp\tmpB69C.tmpFilesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
C:\Users\Admin\AppData\Local\Temp\tmpB69D.tmpFilesize
11KB
MD54a8fbd593a733fc669169d614021185b
SHA1166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA5126b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b
-
C:\Users\Admin\AppData\Local\Temp\tmpB69E.tmpFilesize
11KB
MD5bfbc1a403197ac8cfc95638c2da2cf0e
SHA1634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1
-
C:\Users\Admin\AppData\Local\Temp\tmpB69F.tmpFilesize
11KB
MD53b068f508d40eb8258ff0b0592ca1f9c
SHA159ac025c3256e9c6c86165082974fe791ff9833a
SHA25607db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32
-
C:\Users\Admin\AppData\Local\Temp\tmpB6A0.tmpFilesize
11KB
MD587cbab2a743fb7e0625cc332c9aac537
SHA150f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA25657e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
SHA5126b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S8ZJ806P8ME7ST1LN6SE.tempFilesize
7KB
MD5990a6999dda20cd62dfd8412e644124e
SHA12e5c8b4548ac0dc33e156bcccfbba817e0bd8665
SHA25636519e5d34dff8c4e1c1ae471a4cf55af710abc55accf72747daf8855915d6fa
SHA512d5588b3035ae4cae70e1ec6d49ec2573cb80850a987e0eacdb8f053c77f63b76e7c36acfa11e81f70ad453d43a1ee15c899519e8f5c9a3b425e0d5e3c745a8bf
-
memory/852-352-0x0000000000270000-0x000000000028A000-memory.dmpFilesize
104KB
-
memory/1448-136-0x000007FEF5573000-0x000007FEF5574000-memory.dmpFilesize
4KB
-
memory/1448-137-0x0000000000FB0000-0x0000000000FCA000-memory.dmpFilesize
104KB
-
memory/1448-341-0x0000000000F90000-0x0000000000FAC000-memory.dmpFilesize
112KB
-
memory/1448-340-0x000000001DEE0000-0x000000001E1C2000-memory.dmpFilesize
2.9MB
-
memory/1448-343-0x000000001A750000-0x000000001A758000-memory.dmpFilesize
32KB
-
memory/1448-339-0x0000000000F80000-0x0000000000F8E000-memory.dmpFilesize
56KB
-
memory/1448-338-0x0000000000F50000-0x0000000000F6E000-memory.dmpFilesize
120KB
-
memory/1448-336-0x000007FEF5573000-0x000007FEF5574000-memory.dmpFilesize
4KB
-
memory/1448-342-0x000000001B2B0000-0x000000001B2F8000-memory.dmpFilesize
288KB
-
memory/1448-139-0x000000001B1F0000-0x000000001B270000-memory.dmpFilesize
512KB
-
memory/1448-347-0x000000001A760000-0x000000001A776000-memory.dmpFilesize
88KB
-
memory/1448-346-0x000000001B750000-0x000000001B79A000-memory.dmpFilesize
296KB
-
memory/1448-345-0x000000001B710000-0x000000001B744000-memory.dmpFilesize
208KB
-
memory/1448-344-0x000000001B530000-0x000000001B5D6000-memory.dmpFilesize
664KB
-
memory/1448-348-0x000000001B1F0000-0x000000001B270000-memory.dmpFilesize
512KB
-
memory/1596-335-0x00000000740FE000-0x00000000740FF000-memory.dmpFilesize
4KB
-
memory/1596-134-0x00000000000C0000-0x00000000000DE000-memory.dmpFilesize
120KB
-
memory/1596-135-0x00000000740FE000-0x00000000740FF000-memory.dmpFilesize
4KB
-
memory/1596-138-0x00000000049F0000-0x0000000004A30000-memory.dmpFilesize
256KB
-
memory/1596-337-0x00000000049F0000-0x0000000004A30000-memory.dmpFilesize
256KB
-
memory/2180-151-0x000000001B670000-0x000000001B952000-memory.dmpFilesize
2.9MB
-
memory/2180-152-0x0000000001C80000-0x0000000001C88000-memory.dmpFilesize
32KB
-
memory/2580-145-0x0000000001D10000-0x0000000001D18000-memory.dmpFilesize
32KB
-
memory/2580-144-0x000000001B740000-0x000000001BA22000-memory.dmpFilesize
2.9MB
-
memory/2808-475-0x0000000000290000-0x00000000002AA000-memory.dmpFilesize
104KB
-
memory/2912-12-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-54-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-14-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-28-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-10-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-7-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-30-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-36-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-16-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-32-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-18-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-46-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-38-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-40-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-43-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-44-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-49-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-50-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-52-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-3-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2912-58-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-34-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-56-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-60-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-130-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2912-132-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/2912-22-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-24-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-131-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/2912-62-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-64-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-66-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-68-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-70-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-20-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-8-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB
-
memory/2912-6-0x0000000002150000-0x00000000021B4000-memory.dmpFilesize
400KB
-
memory/2912-1-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/2912-5-0x0000000002260000-0x00000000022C6000-memory.dmpFilesize
408KB
-
memory/2912-2-0x00000000004E0000-0x0000000000568000-memory.dmpFilesize
544KB
-
memory/2912-4-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/2912-26-0x0000000002150000-0x00000000021AF000-memory.dmpFilesize
380KB