Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 06:54
Static task
static1
Behavioral task
behavioral1
Sample
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
23b270add7b30a413a1b0d8047cb8570
-
SHA1
8ebd82ba85376d1108820112238134237f3a2fbd
-
SHA256
c67427d1f7af3ad23965b88e84c0d4b78b30145eeee25450ca82ba7f22dac700
-
SHA512
5b5b75f71cb46f00f9572843a8781a25cde92ca7f3bc043a6af58c153b1c4efabd8ebffaf620f45cb73304713fa740b2333def89f864118b83d1efe1c16ba55b
-
SSDEEP
24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e4:ObCjPKNqQEfsw43qtmVfq4p
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.me.com - Port:
587 - Username:
[email protected] - Password:
RICHARD205lord
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
jhdfkldfhndfkjdfnbfklfnf.exewinmgr119.exewinmgr119.exepid process 2912 jhdfkldfhndfkjdfnbfklfnf.exe 848 winmgr119.exe 2888 winmgr119.exe -
Loads dropped DLL 1 IoCs
Processes:
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exepid process 2424 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2536-22-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/2536-24-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/2536-23-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/2536-31-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/2856-34-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2856-35-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2856-36-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2856-74-0x0000000000400000-0x0000000000491000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
cvtres.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts cvtres.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" jhdfkldfhndfkjdfnbfklfnf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 icanhazip.com 6 ipinfo.io 18 ipinfo.io -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe autoit_exe C:\ProgramData\winmgr119.exe autoit_exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
jhdfkldfhndfkjdfnbfklfnf.exeRegAsm.exeRegAsm.exedescription pid process target process PID 2912 set thread context of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2672 set thread context of 2536 2672 RegAsm.exe cvtres.exe PID 2672 set thread context of 2856 2672 RegAsm.exe cvtres.exe PID 2672 set thread context of 2576 2672 RegAsm.exe cvtres.exe PID 2912 set thread context of 288 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 288 set thread context of 1296 288 RegAsm.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 26 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3004 schtasks.exe 760 schtasks.exe 844 schtasks.exe 2656 schtasks.exe 1696 schtasks.exe 2288 schtasks.exe 1728 schtasks.exe 1644 schtasks.exe 2500 schtasks.exe 2416 schtasks.exe 3040 schtasks.exe 2572 schtasks.exe 2776 schtasks.exe 1464 schtasks.exe 1664 schtasks.exe 2756 schtasks.exe 2948 schtasks.exe 1836 schtasks.exe 2376 schtasks.exe 2068 schtasks.exe 112 schtasks.exe 1792 schtasks.exe 2556 schtasks.exe 988 schtasks.exe 2004 schtasks.exe 2740 schtasks.exe -
Processes:
RegAsm.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegAsm.exe -
NTFS ADS 4 IoCs
Processes:
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exewinmgr119.exewinmgr119.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe:Zone.Identifier:$DATA 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe File created C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA jhdfkldfhndfkjdfnbfklfnf.exe File created C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA winmgr119.exe File opened for modification C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA winmgr119.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exeRegAsm.exewinmgr119.exewinmgr119.exeRegAsm.exepid process 2424 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2672 RegAsm.exe 2672 RegAsm.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 848 winmgr119.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2672 RegAsm.exe 2888 winmgr119.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 2912 jhdfkldfhndfkjdfnbfklfnf.exe 288 RegAsm.exe 288 RegAsm.exe 288 RegAsm.exe 288 RegAsm.exe 288 RegAsm.exe 288 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
RegAsm.execvtres.execvtres.execvtres.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2672 RegAsm.exe Token: SeDebugPrivilege 2536 cvtres.exe Token: SeDebugPrivilege 2856 cvtres.exe Token: SeDebugPrivilege 2576 cvtres.exe Token: SeDebugPrivilege 288 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exeRegAsm.exepid process 2672 RegAsm.exe 288 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exeRegAsm.exedescription pid process target process PID 2424 wrote to memory of 2912 2424 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 2424 wrote to memory of 2912 2424 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 2424 wrote to memory of 2912 2424 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 2424 wrote to memory of 2912 2424 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 2912 wrote to memory of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2912 wrote to memory of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2912 wrote to memory of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2912 wrote to memory of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2912 wrote to memory of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2912 wrote to memory of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2912 wrote to memory of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2912 wrote to memory of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2912 wrote to memory of 2672 2912 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 2912 wrote to memory of 2776 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2776 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2776 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2776 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2672 wrote to memory of 2536 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2536 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2536 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2536 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2536 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2536 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2536 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2536 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2856 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2856 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2856 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2856 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2856 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2856 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2856 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2856 2672 RegAsm.exe cvtres.exe PID 2912 wrote to memory of 760 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 760 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 760 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 760 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2672 wrote to memory of 2576 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2576 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2576 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2576 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2576 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2576 2672 RegAsm.exe cvtres.exe PID 2672 wrote to memory of 2576 2672 RegAsm.exe cvtres.exe PID 2912 wrote to memory of 2556 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2556 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2556 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2556 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2068 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2068 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2068 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2068 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2500 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2500 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2500 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2500 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2948 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2948 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2948 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 2948 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 1464 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 1464 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 1464 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 2912 wrote to memory of 1464 2912 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exeC:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp642F.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp64FB.tmp"4⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp7911.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp4E9D.tmp"4⤵
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {24FECE88-E8C4-4A6F-A549-3EC6FE457A51} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]1⤵
-
C:\ProgramData\winmgr119.exeC:\ProgramData\winmgr119.exe2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\winmgr119.exeC:\ProgramData\winmgr119.exe2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\khaxFMfI\009276b996b04917a9a60a951037d8a6Filesize
16B
MD590ecb76c90cdd05e60b1c0b06ac158cf
SHA173a7ad54f7751552b147d8bcac6fe7f5ab71a480
SHA25609c4bfd0e179926ff30c08695837c3b5c23d722d64aa95e2af43c3713ececb11
SHA51282509393400ec6d9fb079e8f55f83f7133d615d1322283836bb3784faa89b0f755bea451952d714ea5aaaf302baa7b3369f32eae53adaae437de550e5c378233
-
C:\ProgramData\khaxFMfI\189d625f98324bab87032800e1e7f084Filesize
8B
MD5f399eb6a4201f31243b45bec4f24424a
SHA1c72edb4acc307f14b4b33bda2751eddb0505d486
SHA256d3bf914db82c128dd56db07298f1e2088e6342043fb3460a089cb13475b64c2c
SHA512952569ccea491de2d4dae77c7fc6ee77cbec877bf4ef5a97f78a29fe50c5218caebd9fb8ebacfc1ad9a2e22c502a945bb81816cab891fe1362a69c9d01b9a7be
-
C:\ProgramData\khaxFMfI\2c945db753d341ef9b0f02d75d493749Filesize
8B
MD5fc7f279669d1ced8d0ade0e5de7db3d6
SHA12908a8b3a95b3ebe9e96c4b50d99481edda85e6a
SHA2566e0e547839bb2a094f6fc878264c0c7329b2d12de328e7ba3589881dfc0c1e51
SHA51220c6c66c549b85aa7dbf5578fdf4f4d2ef6db0cd0137e0632b1080e08f95f7c16181d327b3542b575fbb9e0b3e2195b260a5bd11160addfb6c64135bdf9a0235
-
C:\ProgramData\khaxFMfI\47928f366bbf48c9ad07f8d6a7670eafFilesize
88B
MD5ceab929c883ec52f5aeacb93f9314fd2
SHA1e07bb3de7939e0c0c6f3bc9c24b6f3683e66e81f
SHA2560158c5da1833669dc55b03d9a5bdf9a9abbdff58708aa1fbb9abbf4e2f0df13a
SHA5128f5b2a83bce920255049216383602eb07d665829b663a5bd66faf8ff8f64914c30a2d8bec165bb430dbd4452baadf3f61aed0c307480552196611a283ef7a880
-
C:\ProgramData\winmgr119.exeFilesize
2.6MB
MD5f186e581eeb25618e933944e75ffeee0
SHA136478bd1a44f762f1951af1012c75e2e14775d41
SHA256893dae87abb152a18e1c22d942a650b0ac345bbb0d9c88dfe5f5082e89818455
SHA51201689c4bf091980e637a86b703cf7837b8e2d52adca5e98d0d59d2af66ebd3636acb1cf86b264f5bb81f809bc9fe438f967c511cd13d2fde658867d697d775f3
-
C:\Users\Admin\AppData\Local\Temp\Cab69BF.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar69E1.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\tmp642F.tmpFilesize
399B
MD5e4bf4f7accc657622fe419c0d62419ab
SHA1c2856936dd3de05bad0da5ca94d6b521e40ab5a2
SHA256b32fa68b79c5a7ceaa89e8e537efe33a963c499666202611329944bd2c09318e
SHA51285dc223e39a16ddeba53a4b3d6c9eff14d30ec67dfda1e650da2c9057f640edd033a31868915a31caac0d325d240a7f634f62cd52fbd2adc68bd1d9cb6281431
-
C:\Users\Admin\AppData\Local\Temp\tmp64FB.tmpFilesize
400B
MD5de4e5ff058882957cf8a3b5f839a031f
SHA10b3d8279120fb5fa27efbd9eee89695aa040fc24
SHA256ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49
SHA512a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72
-
C:\Users\Admin\AppData\Local\Temp\tmp7911.tmpFilesize
391B
MD53525ea58bba48993ea0d01b65ea71381
SHA11b917678fdd969e5ee5916e5899e7c75a979cf4d
SHA256681bcee53cf679ac674e700136f9229b9184fe60ed6410dbd7a33d462ed13ae2
SHA5125aad8dca43ec85882daf50c469bd04dcf0b62affc8bc605b3e289496a2679d4d548fea8bb0aea7080bbfbcdcab9d275fc6797b9c95b64f9f97ecf79583a83986
-
\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exeFilesize
2.6MB
MD599045a905d977f512b93f33470909f2e
SHA131ab68218b3cee928491ae11b36f6767bfff221a
SHA256eab1e31b17a4edf0cdb3a5fe9af61cc5ae2c288a215cc0dd61e9108f44fc25a8
SHA5128d64bd1c50039c0432e92e8e5f08a3f8c146f6501916ce5a917a8fad2ca50b8c8d0d5e861ce7adc0cbab1b0095d0781dccdd192d12df2f9edeccd21bf2a70484
-
memory/288-103-0x00000000001D0000-0x000000000029A000-memory.dmpFilesize
808KB
-
memory/288-100-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/288-101-0x00000000001D0000-0x000000000029A000-memory.dmpFilesize
808KB
-
memory/288-102-0x00000000001D0000-0x000000000029A000-memory.dmpFilesize
808KB
-
memory/2536-22-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2536-24-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2536-23-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2536-31-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2576-80-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2576-77-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2576-78-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2672-84-0x0000000073D32000-0x0000000073D34000-memory.dmpFilesize
8KB
-
memory/2672-18-0x0000000073D32000-0x0000000073D34000-memory.dmpFilesize
8KB
-
memory/2672-17-0x0000000000090000-0x000000000015A000-memory.dmpFilesize
808KB
-
memory/2672-15-0x0000000000090000-0x000000000015A000-memory.dmpFilesize
808KB
-
memory/2672-13-0x0000000000090000-0x000000000015A000-memory.dmpFilesize
808KB
-
memory/2672-10-0x0000000000090000-0x000000000015A000-memory.dmpFilesize
808KB
-
memory/2672-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2856-34-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2856-36-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2856-74-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2856-35-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB