Analysis
-
max time kernel
26s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 12:19
Static task
static1
Behavioral task
behavioral1
Sample
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe
-
Size
744KB
-
MD5
d26dc22db6445c1ce36114677a5e7240
-
SHA1
97a7668972f7fc8c33eef6ea828b597203470085
-
SHA256
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4
-
SHA512
b21747d8d0ab194429d03118e824b061bb7619eabd45e5f687cf715b2bdb836de550019d1447cf6ac84d3e7060c5153b8d976317199f45e2280329a4313846a1
-
SSDEEP
12288:kTyjXW+48qWywrU4kGFezOAVuJ5PIQww7F5DO3HYffXXjYBw:SIXW/8yw1ez54lImF5SXYHn8y
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
rundll32.exe4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
rundll32.exe4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe -
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe -
Deletes itself 2 IoCs
Processes:
rundll32.exepid process 2784 rundll32.exe 2784 rundll32.exe -
Executes dropped EXE 2 IoCs
Processes:
rundll32.exepid process 2784 rundll32.exe 2784 rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exepid process 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2432-7-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-10-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-3-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-5-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-8-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-9-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-4-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-11-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-6-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-28-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-15-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-31-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-40-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-41-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2784-62-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-67-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-66-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-69-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-68-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-64-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-63-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-65-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-60-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-82-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-83-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-84-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-135-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2432-7-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-10-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-3-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-5-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-8-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-9-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-4-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-11-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-6-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-28-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-15-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-31-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-40-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2432-41-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/2784-62-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-67-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-66-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-69-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-68-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-64-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-63-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-65-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-60-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-82-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-83-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-84-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx behavioral1/memory/2784-135-0x00000000039B0000-0x0000000004A3E000-memory.dmp upx -
Processes:
rundll32.exe4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe -
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\U: rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exerundll32.exepid process 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe 2784 rundll32.exe 2784 rundll32.exe 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe 2784 rundll32.exe 2784 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exerundll32.exedescription pid process Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe Token: SeDebugPrivilege 2784 rundll32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exerundll32.exepid process 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe 2784 rundll32.exe 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe 2784 rundll32.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exerundll32.exedescription pid process target process PID 2432 wrote to memory of 1088 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe taskhost.exe PID 2432 wrote to memory of 1164 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Dwm.exe PID 2432 wrote to memory of 1192 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Explorer.EXE PID 2432 wrote to memory of 1968 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe DllHost.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2784 wrote to memory of 1088 2784 rundll32.exe taskhost.exe PID 2784 wrote to memory of 1164 2784 rundll32.exe Dwm.exe PID 2784 wrote to memory of 1192 2784 rundll32.exe Explorer.EXE PID 2784 wrote to memory of 1088 2784 rundll32.exe taskhost.exe PID 2784 wrote to memory of 1164 2784 rundll32.exe Dwm.exe PID 2784 wrote to memory of 1192 2784 rundll32.exe Explorer.EXE PID 2432 wrote to memory of 1088 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe taskhost.exe PID 2432 wrote to memory of 1164 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Dwm.exe PID 2432 wrote to memory of 1192 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Explorer.EXE PID 2432 wrote to memory of 1968 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe DllHost.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2432 wrote to memory of 2784 2432 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe rundll32.exe PID 2784 wrote to memory of 1088 2784 rundll32.exe taskhost.exe PID 2784 wrote to memory of 1164 2784 rundll32.exe Dwm.exe PID 2784 wrote to memory of 1192 2784 rundll32.exe Explorer.EXE PID 2784 wrote to memory of 1088 2784 rundll32.exe taskhost.exe PID 2784 wrote to memory of 1164 2784 rundll32.exe Dwm.exe PID 2784 wrote to memory of 1192 2784 rundll32.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe3⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
8Hide Artifacts
2Hidden Files and Directories
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0F7626E2_Rar\rundll32.exeFilesize
664KB
MD52eb5d76180ce7b3241b281fa79ab3483
SHA106293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA51235f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
-
C:\Windows\SYSTEM.INIFilesize
257B
MD51ccbfdf9d28bd81836275bafde792925
SHA136f6c870ebf2c3710af8d2fcb32762ccba233eef
SHA25686d0d89f9008ea9005adb3a100d4e4ce6fa5c8a1843a8e50498a3ca9d8d48a65
SHA512b24e9337b7ed8cd064ff5e683199b0f0c6c39e629aa00aa60c8867456cd45ba7bb74e097c32081be905242eb6d2f56987322d82dd2d743a42d387fdbf1018602
-
F:\pugjm.exeFilesize
100KB
MD58362fe6541a7fc946dd90483a1d5ef45
SHA1be1c4fede5879a96b64730036fe2d1d162d84022
SHA256be2f0a1b6b29c7985745a8008f23b501b0a1eae70e18e44cd9ee09c9061774d0
SHA51224f7f70acc6e2d48847d570a30b768b9eceb3a1ca782faaa5ff47842c99210a4a384a96d0a33fa517a3bef6c11fb9a8dc3b5cb318a5d7b9e931d3fde1e6034a4
-
\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeFilesize
744KB
MD5d26dc22db6445c1ce36114677a5e7240
SHA197a7668972f7fc8c33eef6ea828b597203470085
SHA2564911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4
SHA512b21747d8d0ab194429d03118e824b061bb7619eabd45e5f687cf715b2bdb836de550019d1447cf6ac84d3e7060c5153b8d976317199f45e2280329a4313846a1
-
memory/1088-16-0x00000000020F0000-0x00000000020F2000-memory.dmpFilesize
8KB
-
memory/1088-16-0x00000000020F0000-0x00000000020F2000-memory.dmpFilesize
8KB
-
memory/2432-31-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-40-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-11-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-6-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-28-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-30-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2432-29-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2432-27-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2432-25-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2432-24-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2432-9-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-15-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-31-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-8-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-0-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2432-40-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-41-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-58-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2432-5-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-46-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2432-46-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2432-58-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2432-41-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-4-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-0-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2432-15-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-7-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-24-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2432-25-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2432-27-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2432-29-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2432-30-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2432-3-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-28-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-6-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-11-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-4-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-9-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-8-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-7-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-10-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-10-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-3-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2432-5-0x0000000002470000-0x00000000034FE000-memory.dmpFilesize
16.6MB
-
memory/2784-135-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-84-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-66-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-135-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-83-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-82-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-60-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-65-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-63-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-64-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-79-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2784-68-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-69-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-81-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2784-39-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2784-80-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2784-67-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-69-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-142-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2784-67-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-62-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-66-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-80-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2784-81-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2784-39-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2784-68-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-79-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2784-64-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-63-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-65-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-60-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-82-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-83-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-84-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-62-0x00000000039B0000-0x0000000004A3E000-memory.dmpFilesize
16.6MB
-
memory/2784-142-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB