Analysis
-
max time kernel
20s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 21:14
Static task
static1
Behavioral task
behavioral1
Sample
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe
-
Size
287KB
-
MD5
ad124f0b9c39bcf3186b883c638f9070
-
SHA1
1fa73d7be2d9054927ee76aec214cc776ddeec81
-
SHA256
ae225a3191bb49dfe617670c06ad9e18a9f0c2cbc60749ac920318593c87dc9c
-
SHA512
ac381d6ac0614aea86fd1e534542373816fd76b59e6323736e1cf9f4346958d5e3fd35443bb0f3fda0a88c20d78c806af8dbe5ae813875773fc51d1ee498dc53
-
SSDEEP
6144:IvED2U+T6i5LirrllHy4HUcMQY6XzPqyemGYD181i:CEDN+T5xYrllrU7QY6rqDYD2i
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
Processes:
explorer.exead124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 2604 explorer.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 2604 explorer.exe 3448 spoolsv.exe 2316 svchost.exe 5084 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/3780-4-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/3780-1-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/3780-5-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/3780-3-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/3780-9-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/3780-14-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/3780-28-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/3780-25-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/3780-65-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/3780-30-0x0000000002A60000-0x0000000003AEE000-memory.dmp upx behavioral2/memory/2604-72-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-82-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-80-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-81-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-77-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-67-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-71-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-70-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-69-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-84-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-83-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-85-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-87-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-86-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-89-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-90-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-91-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-92-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-94-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-96-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-98-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-101-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-102-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-105-0x0000000003530000-0x00000000045BE000-memory.dmp upx behavioral2/memory/2604-106-0x0000000003530000-0x00000000045BE000-memory.dmp upx -
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exedescription ioc process File opened (read-only) \??\J: explorer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\H: explorer.exe File opened (read-only) \??\I: explorer.exe -
Drops file in Windows directory 6 IoCs
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\explorer.exe ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exeexplorer.exesvchost.exepid process 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe 2604 explorer.exe 2604 explorer.exe 2316 svchost.exe 2316 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 2604 explorer.exe 2316 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe 2604 explorer.exe 2604 explorer.exe 3448 spoolsv.exe 3448 spoolsv.exe 2316 svchost.exe 2316 svchost.exe 5084 spoolsv.exe 5084 spoolsv.exe 2604 explorer.exe 2604 explorer.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 3780 wrote to memory of 788 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe fontdrvhost.exe PID 3780 wrote to memory of 792 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe fontdrvhost.exe PID 3780 wrote to memory of 340 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe dwm.exe PID 3780 wrote to memory of 2540 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe sihost.exe PID 3780 wrote to memory of 2556 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe svchost.exe PID 3780 wrote to memory of 2764 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe taskhostw.exe PID 3780 wrote to memory of 3544 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Explorer.EXE PID 3780 wrote to memory of 3716 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe svchost.exe PID 3780 wrote to memory of 3900 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe DllHost.exe PID 3780 wrote to memory of 3984 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 3780 wrote to memory of 4048 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe RuntimeBroker.exe PID 3780 wrote to memory of 680 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe SearchApp.exe PID 3780 wrote to memory of 4216 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe RuntimeBroker.exe PID 3780 wrote to memory of 5496 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe TextInputHost.exe PID 3780 wrote to memory of 4984 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe RuntimeBroker.exe PID 3780 wrote to memory of 3112 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe RuntimeBroker.exe PID 3780 wrote to memory of 996 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe backgroundTaskHost.exe PID 3780 wrote to memory of 2604 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe explorer.exe PID 3780 wrote to memory of 2604 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe explorer.exe PID 3780 wrote to memory of 2604 3780 ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe explorer.exe PID 2604 wrote to memory of 3448 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3448 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3448 2604 explorer.exe spoolsv.exe PID 3448 wrote to memory of 2316 3448 spoolsv.exe svchost.exe PID 3448 wrote to memory of 2316 3448 spoolsv.exe svchost.exe PID 3448 wrote to memory of 2316 3448 spoolsv.exe svchost.exe PID 2316 wrote to memory of 5084 2316 svchost.exe spoolsv.exe PID 2316 wrote to memory of 5084 2316 svchost.exe spoolsv.exe PID 2316 wrote to memory of 5084 2316 svchost.exe spoolsv.exe PID 2316 wrote to memory of 1224 2316 svchost.exe at.exe PID 2316 wrote to memory of 1224 2316 svchost.exe at.exe PID 2316 wrote to memory of 1224 2316 svchost.exe at.exe PID 2604 wrote to memory of 788 2604 explorer.exe fontdrvhost.exe PID 2604 wrote to memory of 792 2604 explorer.exe fontdrvhost.exe PID 2604 wrote to memory of 340 2604 explorer.exe dwm.exe PID 2604 wrote to memory of 2540 2604 explorer.exe sihost.exe PID 2604 wrote to memory of 2556 2604 explorer.exe svchost.exe PID 2604 wrote to memory of 2764 2604 explorer.exe taskhostw.exe PID 2604 wrote to memory of 3544 2604 explorer.exe Explorer.EXE PID 2604 wrote to memory of 3716 2604 explorer.exe svchost.exe PID 2604 wrote to memory of 3900 2604 explorer.exe DllHost.exe PID 2604 wrote to memory of 3984 2604 explorer.exe StartMenuExperienceHost.exe PID 2604 wrote to memory of 4048 2604 explorer.exe RuntimeBroker.exe PID 2604 wrote to memory of 680 2604 explorer.exe SearchApp.exe PID 2604 wrote to memory of 4216 2604 explorer.exe RuntimeBroker.exe PID 2604 wrote to memory of 5496 2604 explorer.exe TextInputHost.exe PID 2604 wrote to memory of 4984 2604 explorer.exe RuntimeBroker.exe PID 2604 wrote to memory of 3112 2604 explorer.exe RuntimeBroker.exe PID 2604 wrote to memory of 2316 2604 explorer.exe svchost.exe PID 2604 wrote to memory of 2316 2604 explorer.exe svchost.exe PID 2604 wrote to memory of 5384 2604 explorer.exe RuntimeBroker.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:340
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2556
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2764
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ad124f0b9c39bcf3186b883c638f9070_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3780 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Modifies Installed Components in the registry
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe5⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5084 -
C:\Windows\SysWOW64\at.exeat 21:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:1224
-
C:\Windows\SysWOW64\at.exeat 21:17 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:3008
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE4⤵PID:2836
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe5⤵PID:748
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE4⤵PID:5148
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe5⤵PID:3888
-
C:\Windows\SysWOW64\at.exeat 21:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:3856
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR6⤵PID:4032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3716
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3984
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4048
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:680
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4216
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:5496
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4984
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3112
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5384
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1884
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4172
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\mrsys.exeFilesize
287KB
MD5f6a506cdfa0f36d6d9b9e9d46f821484
SHA1d7e21d72bac6e12e58b2e04c1de25b08ae57a839
SHA256be016cdae448dc8dacccf9d37f5f92c4bed463847f0f1b7d40eaebeac1b47450
SHA51234e03247ce5fb1d7b51ac4ecd6df26e46b705e48d466aab4c6ac90a6631b276d4461f36af7a928f56937a37499262ffba3be3b975ecb53006253336e27a6e34b
-
C:\Windows\SYSTEM.INIFilesize
257B
MD559ad09b2deb22ae8c17eaf51ec7760a4
SHA155fac866ef6cb1d29d8cff2779ed430908d72ea7
SHA256a0b4308974c18e82f08c6f1664c3d931df2a99a59dd4d37953c899e03fef506d
SHA5125c0bde0abfa6d382e8655ea0ba6467e5e9e886d7973a35acfa177297f89f4d25216fb075c8a33b759452ffb46a019c8d940c1ae57ddb93649b54a72cd4f57a9a
-
C:\Windows\System\spoolsv.exeFilesize
287KB
MD5f637076045877d3d713dd4f75cbb791b
SHA11509461fca966d4d1f7e736d6c6595e2fe844574
SHA256b51eecbd71f9e7445cc9abbf9064feaa8ce8616cb58b6c93a8da5ab157994a4e
SHA512d657d880430d0fd2c371565a2a306a88a2a6a239c9233c67e9763648f5f1aa54d1db5c60c598fe2e415a4b7ca4239aa9c45811722bd710229ddf6cd2daa5e633
-
C:\hdjy.pifFilesize
100KB
MD580d2f5c7c23a22f5efc2299e9c69f317
SHA1ce9fbf031776a1ee6dff544a2bf1f0bb00cf0dc2
SHA256eb3dff00ead3f690eeb0152cca9ee6673b0c3b60c46a4a1820b2e0c21ad4f864
SHA512af6e43fd69f2049095dc8ffdb2308b4fd5c8f577532a956e7c12933d9f46d24a281c075f34cd0623045359a71d5112d402d6134966bc05ef6992253ec4b3a3b7
-
\??\c:\windows\system\explorer.exeFilesize
287KB
MD57a9e752e3cadd18ffd8099b7d35063be
SHA18094b4f59fab8534b019b036de8ea3655f39ed17
SHA256ca642693a3db23d0761397681a82e4ff69d697149e4429437531bf794c1f21d9
SHA512773cffeed2365515ecbc2c0c5555d5344495aeb770646aa6445cd36d96c0c262bad047594878c24b7788cba1197fac8815cab71cbe662c6529ab9f9b847b1d27
-
\??\c:\windows\system\svchost.exeFilesize
287KB
MD5a1d5a0e2d11b6c9c34cb373870595aa5
SHA16a02ae83e0b0757c008ed90be2a70225d0708624
SHA2564d64f897e1c0876d238745f5d554b1c133512663eea3b819377abe795d12a2cf
SHA512520bd1b49c3a15317daf3e467483fbe25e74e496f5666934afabd52f82d2a9c3046afb6cc126813102d624a0fb97b59adb7ef86d062e05b3fb138e67c7dc854a
-
memory/2316-79-0x0000000002ED0000-0x0000000002ED2000-memory.dmpFilesize
8KB
-
memory/2316-76-0x0000000004030000-0x0000000004031000-memory.dmpFilesize
4KB
-
memory/2316-41-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2604-87-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-91-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-106-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-105-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-102-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-101-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-98-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-96-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-21-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2604-94-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-92-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-90-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-89-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-86-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-85-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-83-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-84-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-74-0x0000000002B80000-0x0000000002B81000-memory.dmpFilesize
4KB
-
memory/2604-69-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-72-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-78-0x0000000000640000-0x0000000000642000-memory.dmpFilesize
8KB
-
memory/2604-82-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-80-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-81-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-77-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-67-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-71-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2604-70-0x0000000003530000-0x00000000045BE000-memory.dmpFilesize
16.6MB
-
memory/2836-150-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/3448-53-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/3780-65-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-14-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-3-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-0-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/3780-1-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-9-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-66-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/3780-11-0x0000000002080000-0x0000000002082000-memory.dmpFilesize
8KB
-
memory/3780-5-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-4-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-15-0x0000000002080000-0x0000000002082000-memory.dmpFilesize
8KB
-
memory/3780-25-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-28-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-30-0x0000000002A60000-0x0000000003AEE000-memory.dmpFilesize
16.6MB
-
memory/3780-8-0x0000000002090000-0x0000000002091000-memory.dmpFilesize
4KB
-
memory/3780-7-0x0000000002080000-0x0000000002082000-memory.dmpFilesize
8KB
-
memory/5084-46-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/5084-52-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/5148-159-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB