Analysis
-
max time kernel
147s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 15:57
Static task
static1
Behavioral task
behavioral1
Sample
b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
b2aefe9be1952a261220d2bab2f125e0
-
SHA1
36ce75250cf009627554c5dd4294273bbdd50d66
-
SHA256
adbb33e049bf586a1a9af7b968c9061183018149faa9f4cdfdd8831c543d7e22
-
SHA512
44a291274b6baee490678cc77f4e96b738d0d7cb0c366731b819eb8df93ccf74ed0537a748cd2057b9ef308cbd4b54d7cb7ec2f2d4bbda34e5d09601def8f0fb
-
SSDEEP
24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e8:ObCjPKNqQEfsw43qtmVfq4r
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.me.com - Port:
587 - Username:
[email protected] - Password:
RICHARD205lord
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
jhdfkldfhndfkjdfnbfklfnf.exewinmgr119.exewinmgr119.exepid process 1748 jhdfkldfhndfkjdfnbfklfnf.exe 2268 winmgr119.exe 2700 winmgr119.exe -
Loads dropped DLL 1 IoCs
Processes:
b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exepid process 2188 b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2460-22-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/2460-24-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/2460-23-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/2460-31-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/1908-34-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1908-35-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1908-36-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/1908-38-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2532-117-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/2692-123-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2692-125-0x0000000000400000-0x0000000000491000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
Processes:
cvtres.execvtres.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts cvtres.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts cvtres.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" jhdfkldfhndfkjdfnbfklfnf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 icanhazip.com 6 ipinfo.io 21 ipinfo.io -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe autoit_exe C:\ProgramData\winmgr119.exe autoit_exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
jhdfkldfhndfkjdfnbfklfnf.exeRegAsm.exeRegAsm.exedescription pid process target process PID 1748 set thread context of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2696 set thread context of 2460 2696 RegAsm.exe cvtres.exe PID 2696 set thread context of 1908 2696 RegAsm.exe cvtres.exe PID 2696 set thread context of 1684 2696 RegAsm.exe cvtres.exe PID 1748 set thread context of 2752 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2752 set thread context of 2532 2752 RegAsm.exe cvtres.exe PID 2752 set thread context of 2692 2752 RegAsm.exe cvtres.exe PID 2752 set thread context of 1160 2752 RegAsm.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 25 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1084 schtasks.exe 2568 schtasks.exe 568 schtasks.exe 1524 schtasks.exe 1756 schtasks.exe 2276 schtasks.exe 2620 schtasks.exe 1092 schtasks.exe 2968 schtasks.exe 848 schtasks.exe 2992 schtasks.exe 768 schtasks.exe 1584 schtasks.exe 1776 schtasks.exe 1064 schtasks.exe 2548 schtasks.exe 2888 schtasks.exe 2040 schtasks.exe 1104 schtasks.exe 1816 schtasks.exe 2192 schtasks.exe 2224 schtasks.exe 2332 schtasks.exe 3060 schtasks.exe 1660 schtasks.exe -
Processes:
RegAsm.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegAsm.exe -
NTFS ADS 4 IoCs
Processes:
b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exewinmgr119.exewinmgr119.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe:Zone.Identifier:$DATA b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe File created C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA jhdfkldfhndfkjdfnbfklfnf.exe File created C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA winmgr119.exe File opened for modification C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA winmgr119.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exeRegAsm.exewinmgr119.exewinmgr119.exeRegAsm.exepid process 2188 b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 2696 RegAsm.exe 2696 RegAsm.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2268 winmgr119.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2696 RegAsm.exe 2700 winmgr119.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 2752 RegAsm.exe 2752 RegAsm.exe 2752 RegAsm.exe 2752 RegAsm.exe 2752 RegAsm.exe 2752 RegAsm.exe 2752 RegAsm.exe 2752 RegAsm.exe 2752 RegAsm.exe 2752 RegAsm.exe 1748 jhdfkldfhndfkjdfnbfklfnf.exe 2752 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
RegAsm.execvtres.execvtres.execvtres.exeRegAsm.execvtres.execvtres.execvtres.exedescription pid process Token: SeDebugPrivilege 2696 RegAsm.exe Token: SeDebugPrivilege 2460 cvtres.exe Token: SeDebugPrivilege 1908 cvtres.exe Token: SeDebugPrivilege 1684 cvtres.exe Token: SeDebugPrivilege 2752 RegAsm.exe Token: SeDebugPrivilege 2532 cvtres.exe Token: SeDebugPrivilege 2692 cvtres.exe Token: SeDebugPrivilege 1160 cvtres.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 2696 RegAsm.exe 2752 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exeRegAsm.exetaskeng.exedescription pid process target process PID 2188 wrote to memory of 1748 2188 b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 2188 wrote to memory of 1748 2188 b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 2188 wrote to memory of 1748 2188 b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 2188 wrote to memory of 1748 2188 b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 1748 wrote to memory of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 1748 wrote to memory of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 1748 wrote to memory of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 1748 wrote to memory of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 1748 wrote to memory of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 1748 wrote to memory of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 1748 wrote to memory of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 1748 wrote to memory of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 1748 wrote to memory of 2696 1748 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 1748 wrote to memory of 2568 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2568 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2568 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2568 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2696 wrote to memory of 2460 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 2460 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 2460 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 2460 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 2460 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 2460 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 2460 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 2460 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1908 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1908 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1908 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1908 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1908 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1908 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1908 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1908 2696 RegAsm.exe cvtres.exe PID 1748 wrote to memory of 2192 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2192 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2192 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2192 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2696 wrote to memory of 1684 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1684 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1684 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1684 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1684 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1684 2696 RegAsm.exe cvtres.exe PID 2696 wrote to memory of 1684 2696 RegAsm.exe cvtres.exe PID 1748 wrote to memory of 2888 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2888 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2888 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2888 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2040 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2040 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2040 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 2040 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 568 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 568 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 568 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 568 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 1660 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 1660 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 1660 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1748 wrote to memory of 1660 1748 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 1940 wrote to memory of 2268 1940 taskeng.exe winmgr119.exe PID 1940 wrote to memory of 2268 1940 taskeng.exe winmgr119.exe PID 1940 wrote to memory of 2268 1940 taskeng.exe winmgr119.exe PID 1940 wrote to memory of 2268 1940 taskeng.exe winmgr119.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b2aefe9be1952a261220d2bab2f125e0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exeC:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp84D9.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp8586.tmp"4⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp9974.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmpF9E9.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmpFA95.tmp"4⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmpFAD5.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {38ABC047-75C6-4E69-BFFF-987A7178DC76} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\winmgr119.exeC:\ProgramData\winmgr119.exe2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\winmgr119.exeC:\ProgramData\winmgr119.exe2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\khaxFMfI\009276b996b04917a9a60a951037d8a6Filesize
16B
MD5bebe88b8fb16df12c56561613ae7aaac
SHA143d8689d8ee6bbb44699a8a795fc5e6a54a7801e
SHA256e5b5d128a970e5fb2f4678e70514fc3264676088b8eec4ee42c405af0014604c
SHA5120dfbfb4e93a8b8e994d9730b4a4e38d7805ea98a88e3fab4d4f2de85defebedff99b01bdc65e469a1c0840a70118af926997326121b16307a6e71a1568a5681c
-
C:\ProgramData\khaxFMfI\189d625f98324bab87032800e1e7f084Filesize
8B
MD57ddc06b79751d16771da8d2187fde7e8
SHA18f3b0f63ed364d9f243d0b1de25833fbf3f8616c
SHA256c1d0655e9c55cd3bb98b8560b7fb3d37db4eed3171146a2e8f43c4bd5e7b964a
SHA51267b291e8b71d9ef57976334b8dc099397b55ee7a090cbe29ed6ff7239cb143ea1740517693ef6b37c9d721bb8980539afb90a5d554bed5343496146100572b09
-
C:\ProgramData\khaxFMfI\2c945db753d341ef9b0f02d75d493749Filesize
8B
MD50719117227d0203e9dcf1983e4183252
SHA1c4bcb506a85ca65dc21191bd7bb9f802165629d1
SHA2568e6c850b5ca91d77ceb0f8af7f2a2c47614377fb0a48813bec4a262196fb423b
SHA51279b500a37ae9f37aab85d7ff0ff6b2bfb4e6d75376b42cb2af9c8f8a8a04869abbe5bfaf81e20200df12ca273b30e5a61519b72cfc24025b7258cd9fe5698b21
-
C:\ProgramData\khaxFMfI\47928f366bbf48c9ad07f8d6a7670eafFilesize
88B
MD57c296fd9c4143cd2dea8f3257e743235
SHA1a9041711ed2e96c93e86059cf88e9def128a7434
SHA256763607ae2055ec62a23b88abf45b13c1b44cca2281a25329e4d9bcc625f93559
SHA512c07323808e7393f5d91744a493ffadef30646d170d338c167c816c9965f3872a6d89048d969c76163f70316a73a200d604fd7a2e1718058fbeca6fc063ed2e1e
-
C:\ProgramData\winmgr119.exeFilesize
2.6MB
MD57a39620502a4000b59c9969d1fe9a5cc
SHA172ebe16feb5b75a8788b5ffe77d78cf8d4a04814
SHA256529e9e9e5cc7dc312ca50de25193def69c82d2291c17a8a052722464371ef14b
SHA5120e4198b74df9ebde2aef5dea6cb7384f7c050f8fbeebbead1f35a0e83c301d9bcfdc35169a9d22a554efcb9fe0245958c52b37061f1bae8bb2d763998458f42e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarAB93.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\tmp84D9.tmpFilesize
399B
MD5e4bf4f7accc657622fe419c0d62419ab
SHA1c2856936dd3de05bad0da5ca94d6b521e40ab5a2
SHA256b32fa68b79c5a7ceaa89e8e537efe33a963c499666202611329944bd2c09318e
SHA51285dc223e39a16ddeba53a4b3d6c9eff14d30ec67dfda1e650da2c9057f640edd033a31868915a31caac0d325d240a7f634f62cd52fbd2adc68bd1d9cb6281431
-
C:\Users\Admin\AppData\Local\Temp\tmp8586.tmpFilesize
400B
MD5de4e5ff058882957cf8a3b5f839a031f
SHA10b3d8279120fb5fa27efbd9eee89695aa040fc24
SHA256ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49
SHA512a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72
-
C:\Users\Admin\AppData\Local\Temp\tmp9974.tmpFilesize
391B
MD53525ea58bba48993ea0d01b65ea71381
SHA11b917678fdd969e5ee5916e5899e7c75a979cf4d
SHA256681bcee53cf679ac674e700136f9229b9184fe60ed6410dbd7a33d462ed13ae2
SHA5125aad8dca43ec85882daf50c469bd04dcf0b62affc8bc605b3e289496a2679d4d548fea8bb0aea7080bbfbcdcab9d275fc6797b9c95b64f9f97ecf79583a83986
-
\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exeFilesize
2.6MB
MD5a943b75f49a63a1b19e145e8b5a0d634
SHA1e7b139747d1a29d781911ca7265f37680ea91d33
SHA256f2f4787e093a3d903a7e06843165fc6b5f4060796698adfbdf228b1e9a14288e
SHA5121067079eb67d66e17322cbb8d259b080f07cce4f64ab8acc68762905dbba1a7ef1cd3410b65a3b98af6d674bf50921addca933d34da7ac2190ddbc04e3044a2c
-
memory/1160-132-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1684-45-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1684-43-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1684-42-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1908-34-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1908-35-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1908-36-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1908-38-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2460-24-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2460-31-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2460-23-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2460-22-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2532-117-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2692-125-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2692-123-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2696-17-0x0000000000110000-0x00000000001DA000-memory.dmpFilesize
808KB
-
memory/2696-13-0x0000000000110000-0x00000000001DA000-memory.dmpFilesize
808KB
-
memory/2696-15-0x0000000000110000-0x00000000001DA000-memory.dmpFilesize
808KB
-
memory/2696-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2696-85-0x0000000073CD2000-0x0000000073CD4000-memory.dmpFilesize
8KB
-
memory/2696-18-0x0000000073CD2000-0x0000000073CD4000-memory.dmpFilesize
8KB
-
memory/2696-10-0x0000000000110000-0x00000000001DA000-memory.dmpFilesize
808KB
-
memory/2752-102-0x0000000000170000-0x000000000023A000-memory.dmpFilesize
808KB
-
memory/2752-104-0x0000000000170000-0x000000000023A000-memory.dmpFilesize
808KB
-
memory/2752-103-0x0000000000170000-0x000000000023A000-memory.dmpFilesize
808KB
-
memory/2752-101-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB