cd0e51ba7193321712a8052927061bc54d88be46e0fb94b10c29f4d4f61f214e

Analysis

max time kernel
136s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Size 91KB
Sample240603-e8zp2sbf5w
SHA256 cd0e51ba7193321712a8052927061bc54d88be46e0fb94b10c29f4d4f61f214e
MD5 9bccf2661d8cba99d3b07dfdbce1bcd0
SHA1 1bde34be4e86ba91e32a44ab9598950895a081d1
SHA512 48e42bc8c8689c605115eb65187fd321ef842a077555257115ec24df75d1f1b2631ef0850c123f2d61f6307a83879327d5ac51f3c6596ed011e5300bca04e16d
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuZf3gRYjXbUeHORIC4q:uT3OA3+KQsxfS40T3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 14 IoCs

pid	Process
4820	xk.exe
1276	IExplorer.exe
4412	WINLOGON.EXE
2620	CSRSS.EXE
4544	SERVICES.EXE
4508	LSASS.EXE
224	SMSS.EXE
1012	xk.exe
2384	IExplorer.exe
936	WINLOGON.EXE
3192	CSRSS.EXE
3108	SERVICES.EXE
2164	LSASS.EXE
4952	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File created	C:\desktop.ini	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened for modification	F:\desktop.ini	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File created	F:\desktop.ini	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\T:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\X:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\I:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\L:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\O:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\B:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\M:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\N:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\U:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\W:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\J:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\K:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\S:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\P:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\V:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\E:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\G:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened (read-only)	\??\H:	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shell.exe	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Mig2.scr	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
File created	C:\Windows\xk.exe	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
4820	xk.exe
1276	IExplorer.exe
4412	WINLOGON.EXE
2620	CSRSS.EXE
4544	SERVICES.EXE
4508	LSASS.EXE
224	SMSS.EXE
1012	xk.exe
2384	IExplorer.exe
936	WINLOGON.EXE
3192	CSRSS.EXE
3108	SERVICES.EXE
2164	LSASS.EXE
4952	SMSS.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4820	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	82
PID 4172 wrote to memory of 4820	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	82
PID 4172 wrote to memory of 4820	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	82
PID 4172 wrote to memory of 1276	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	83
PID 4172 wrote to memory of 1276	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	83
PID 4172 wrote to memory of 1276	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	83
PID 4172 wrote to memory of 4412	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	84
PID 4172 wrote to memory of 4412	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	84
PID 4172 wrote to memory of 4412	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	84
PID 4172 wrote to memory of 2620	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	85
PID 4172 wrote to memory of 2620	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	85
PID 4172 wrote to memory of 2620	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	85
PID 4172 wrote to memory of 4544	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	86
PID 4172 wrote to memory of 4544	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	86
PID 4172 wrote to memory of 4544	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	86
PID 4172 wrote to memory of 4508	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	87
PID 4172 wrote to memory of 4508	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	87
PID 4172 wrote to memory of 4508	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	87
PID 4172 wrote to memory of 224	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	88
PID 4172 wrote to memory of 224	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	88
PID 4172 wrote to memory of 224	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	88
PID 4172 wrote to memory of 1012	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	89
PID 4172 wrote to memory of 1012	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	89
PID 4172 wrote to memory of 1012	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	89
PID 4172 wrote to memory of 2384	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	90
PID 4172 wrote to memory of 2384	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	90
PID 4172 wrote to memory of 2384	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	90
PID 4172 wrote to memory of 936	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	91
PID 4172 wrote to memory of 936	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	91
PID 4172 wrote to memory of 936	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	91
PID 4172 wrote to memory of 3192	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	93
PID 4172 wrote to memory of 3192	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	93
PID 4172 wrote to memory of 3192	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	93
PID 4172 wrote to memory of 3108	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	95
PID 4172 wrote to memory of 3108	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	95
PID 4172 wrote to memory of 3108	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	95
PID 4172 wrote to memory of 2164	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	96
PID 4172 wrote to memory of 2164	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	96
PID 4172 wrote to memory of 2164	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	96
PID 4172 wrote to memory of 4952	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	97
PID 4172 wrote to memory of 4952	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	97
PID 4172 wrote to memory of 4952	4172	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe	97

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9bccf2661d8cba99d3b07dfdbce1bcd0_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4172
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4820
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1276
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4412
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2620
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4544
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4508
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:224
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1012
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2384
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:936
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3192
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3108
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2164
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 fbf3d88624fe3153681bd85582f8161282afcf7754297e49b18bdcda3ddedf0e
MD5 acd56b470af982852b88844224facf1a
SHA1 7a8a8ab43abf1c1cea8f2cd08f0a05d7637f6e6d
SHA512 d938964b6606bb2a922f67302a9251d7383c03c072b12cd5a0960ed81c7acff7aa29024f58e529ce64dc569b285c882b99e0a3d852306b2ca3c45904bf8193ab
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuE3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4dT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 b246eb0013df737c5a71cfea0dff9873fa4c5bac1f8bc86a0b3351bc3e19e856
MD5 14f63fecad41863531ff94710d259c7f
SHA1 de866f3eb2b20b40b2aef6d70101650c13477a73
SHA512 3e264df5542591e5a7b66331410a9cbb0a956698952e400aba2eec37334019628b0a6dba0a990c1096b924cf2ea5b4e875f3460f122812559c4a0acf1185d107
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imu9c3gRYjXbUeHORIC4q:uT3OA3+KQsxfS4vT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 7c8fcae8d9671d4d62aa350725cc0de86df7bb83629a8da25dfe34b7a0887780
MD5 b37063046333efd1ccf6bc68b72a9ac6
SHA1 52dcba2a61ffe9785d24c9f4124569c9d645ee44
SHA512 7ccee29c5e58b50c18692954c7dbac1b9fa5d73f5b18e18bf16df4f5256b8ce121133054749fefc5e37b6566917af3dfe94d8b5d3782f15fb87c966d99daa637
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imus3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4ZT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 9a9e4f26bf94028ea730e87bd1b20b2bc013f516ccbe90691485e7dd7c82bc11
MD5 a7bdd8eef31f136604e7dcc8dfa28532
SHA1 c3fc509fd5c538cd2faca084868cb9edbd019766
SHA512 93d2a87e94fa6cf71c2cb9268735e2960f3b1e03a4958f1a27eb61088a5887c48ff626e0431519290198560c585e45b151b732f33a351e9353198355014f34d2
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imuf3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4GT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 11779cdf706137e1beeb4c440b6eb3bf029776474c04f7f9b844a94f7f0ef05d
MD5 07a498ee688d33434c942161d4c3dc77
SHA1 5f92df15dbe94aa6aa4ae1ca2e8abd0e2edf9557
SHA512 9d353b47cffaa82742b54fbcdcfcfbae22cad6df757bd51264d62b883edd47933b72450dc2a56fa9faebbca5262b288f6f961b835ef6c6e8fe57247426c73769
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuI3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS49T3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 ccb073add20c4ecfb97cb21aca90ccdb9b4e7df1eabaa50f8c66678acced81ee
MD5 06cf82ff91a724dffaccf5d871f6337c
SHA1 ea0f31513bb657d5b553841243cd973cb128a4d5
SHA512 f5f6e880be7fae8c078fbf83bcdc0b63a4f119dde4667907bb4f18beb31654cec0a97e615ae060683520b28a47367a5a718a8d0782d01089d790de9b2e205811
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuT3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4eT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 aaef240600b0f5191a2f36315b5e352c06e413fb838a8024cb69dec5643e69c9
MD5 8d12596d008b382b24481975263289c4
SHA1 40da685787d6f87b8998904ceebf68a9f89ef1e3
SHA512 2b4cd6d8ebc628950a871291e879945507d8f21651ae474182e95e3df13244f7005af13e8ff95116a6749605db6dff9a44c01bd959f388ab6d81a6c490dd3638
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imui3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4/T3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 91KB
SHA256 cd0e51ba7193321712a8052927061bc54d88be46e0fb94b10c29f4d4f61f214e
MD5 9bccf2661d8cba99d3b07dfdbce1bcd0
SHA1 1bde34be4e86ba91e32a44ab9598950895a081d1
SHA512 48e42bc8c8689c605115eb65187fd321ef842a077555257115ec24df75d1f1b2631ef0850c123f2d61f6307a83879327d5ac51f3c6596ed011e5300bca04e16d
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuZf3gRYjXbUeHORIC4q:uT3OA3+KQsxfS40T3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 c3c611150f23f4e0a0f770c7ae67dbd7ffd58e55c7a5998f8a210c257f3f42b1
MD5 4f7a6598eebaf520e78e1f414f104eff
SHA1 82d1c0b79405adcfe2ffee199effdbe2f8bf0347
SHA512 3996bd2b6ce087755afba6df20aeaedde691ec870c827489baf28f59e7865b7e455b60b79d43dd29107c6397122568d8af862ae5bb10fa7bd5c350fc86bd11d0
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuQ3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4NT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Size 91KB
SHA256 7ee8f1eb87f8c08724fbd6a727dec38037e38ef4d8efd70e7665211a936d3b0a
MD5 99178e7fb8a885add85464482681325c
SHA1 5b21ecb7cb01c19181940ecbbb4800d5253e2c0c
SHA512 024ce4377d244ff80057b4235a3837be9ef7345f03cd3ae4876c7a8f9c19b13907f8e755cdffc056f0365c4e94879fae0df6e440a8bfa558231d25391d9b805f
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imui3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4rT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 9126a7c0d7b2eb3f186b598d816b6be07278b4b45b01eba0bb218f2084861d99
MD5 f56fa58b9b8cc7bd128ebb0e4b163136
SHA1 cb45f6c2f2e62636f78ed58a9778e4b353b27779
SHA512 8539add3021da1708ae6a9de988bd9b676b903b685c08277a18643b1772f43191bc4d2fb39cf62cb4feffdff311b46527345d654c717e70022894c69c1956439
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imueb3gRYjXbUeHORIC4q:uT3OA3+KQsxfS4pT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 0464b8bbeadd5f523f3d0d7d5538f5e4b7c325f10729855b1566ff147e4adaec
MD5 29a7905eac27db8aee5da44be71c55d1
SHA1 e82fa14f5c84048bc635a6ac0067b96b11e247f6
SHA512 af49a454ddaebbbc459d8c57e8dcfa99057cfe7d7d5d3ae286e851c4eaaaf910c12fc4cadbde59161d7623ffd54cc3fad9b158c1dc136bf2df0776822af82d07
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imua3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4LT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 9c13f977a5d55444b5ac9210952ef5676c5c6ec497abeb693f389c1b23476f41
MD5 6594e37d95dd22daccc8e5a7bcca7b6a
SHA1 43c5b821b43f09fecad93c1da58c92b2d5cf4e99
SHA512 0eba1dee6b5e6f8d9ad3e512e46da47888c2011c25c86e8a2b6bc4cc8ee7517f8e8886d7b5717e3638fb5a7f4ceed25dcea34fad604a3d4b6a94782d68b92f85
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuM3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4dT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 ce10a0c3887bc4e22dcbda12c099a16e3767c81665eee211bbe0f2caced5df3a
MD5 16fa9dfffe6de49d7ad6a165abf5c5b4
SHA1 30387796448b5084c24f7ca0752786b2c18525a9
SHA512 1fa5b8aee2f67e6c52488fc17c7264a339e840151c18b237240f040b74b0456349be258b9fa17eacec3449e7c99572e13d9ade41a3d9aea56e9a4061b88c0e7c
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuFN3gRYjXbUeHORIC4q:uT3OA3+KQsxfS4ajT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 df62b9f4fd198b94a7a788904a857477f00b72797b85af148249f36973cd5208
MD5 49e3f019ded27303fbd78e93e4b3f249
SHA1 45bc1c0ca04e18b414e7f6758e46ac968585dc41
SHA512 7b3dd5061b28d3b25af157d44f916b6b41240175a3831032140ea1f57c5a0cf76855fedc197886c7531da153a9075b6f5d09c7ec293f5930ff4493bb078f5395
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuJ3gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4wT3OA3+KQsxfS45W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-183-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/224-171-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/936-240-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/936-245-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1012-224-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/1012-233-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1276-130-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1276-123-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/2164-271-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2164-266-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/2384-239-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2384-230-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/2620-149-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2620-142-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/2620-141-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2620-147-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3108-263-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3108-257-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/3108-261-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3192-254-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3192-249-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/3192-248-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4172-305-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4172-308-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/4172-3-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4172-307-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4172-6-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/4172-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4172-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/4172-146-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/4172-2-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/4412-137-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4412-132-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/4508-167-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4508-162-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/4544-153-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/4544-158-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4820-111-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4820-115-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4820-113-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/4820-120-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4952-274-0x0000000075050000-0x00000000751AD000-memory.dmp

Download

memory/4952-279-0x0000000000400000-0x000000000042C000-memory.dmp

Download