8990fa416b300869d4807a8b97ec1a29ebed8b59c810dd1b771fc5837ab14284

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Size 91KB
Sample240611-pgtd3axbkm
SHA256 8990fa416b300869d4807a8b97ec1a29ebed8b59c810dd1b771fc5837ab14284
MD5 3499820196a6653c26e6d3ac98efe8f0
SHA1 a4ff97968073eb622de2cd854a6f2c73da3cb1cf
SHA512 e88ebf1bc67b17311381ccfc58e6bc0ffe65b857b8f219de566d5761c5837ca3a1948ec60c725208f61f6bb5bfeb4cfd315c1d438871b89bdd854497290b7044
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBiyJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIyvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 14 IoCs

pid	Process
1112	xk.exe
4976	IExplorer.exe
1460	WINLOGON.EXE
1772	CSRSS.EXE
100	SERVICES.EXE
4880	LSASS.EXE
2288	SMSS.EXE
528	xk.exe
2276	IExplorer.exe
4352	WINLOGON.EXE
768	CSRSS.EXE
1856	SERVICES.EXE
2492	LSASS.EXE
4332	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1496-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023277-7.dat	upx
behavioral2/files/0x0008000000023273-47.dat	upx
behavioral2/files/0x0007000000023277-52.dat	upx
behavioral2/memory/1112-55-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4976-59-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023279-61.dat	upx
behavioral2/memory/1460-63-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/1460-67-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000700000002327a-69.dat	upx
behavioral2/memory/1772-74-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000700000002327b-76.dat	upx
behavioral2/memory/100-81-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000700000002327c-83.dat	upx
behavioral2/memory/4880-89-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000700000002327d-90.dat	upx
behavioral2/memory/2288-94-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/1496-120-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/1496-121-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0008000000023273-229.dat	upx
behavioral2/memory/528-234-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023277-233.dat	upx
behavioral2/files/0x0007000000023279-239.dat	upx
behavioral2/memory/2276-240-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4352-243-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/1496-271-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000700000002327a-274.dat	upx
behavioral2/files/0x000700000002327b-278.dat	upx
behavioral2/memory/768-280-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/1856-285-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000700000002327c-286.dat	upx
behavioral2/memory/2492-287-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/2492-288-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000700000002327d-290.dat	upx
behavioral2/memory/1496-294-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	F:\desktop.ini	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened for modification	C:\desktop.ini	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File created	C:\desktop.ini	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened for modification	F:\desktop.ini	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\T:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\I:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\O:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\R:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\U:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\G:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\J:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\K:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\L:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\V:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\W:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\X:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\H:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\E:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\M:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\N:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\P:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened (read-only)	\??\B:	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shell.exe	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Mig2.scr	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\xk.exe	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\xk.exe	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
1112	xk.exe
4976	IExplorer.exe
1460	WINLOGON.EXE
1772	CSRSS.EXE
100	SERVICES.EXE
4880	LSASS.EXE
2288	SMSS.EXE
528	xk.exe
2276	IExplorer.exe
4352	WINLOGON.EXE
768	CSRSS.EXE
1856	SERVICES.EXE
4332	SMSS.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1112	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	89
PID 1496 wrote to memory of 1112	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	89
PID 1496 wrote to memory of 1112	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	89
PID 1496 wrote to memory of 4976	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	90
PID 1496 wrote to memory of 4976	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	90
PID 1496 wrote to memory of 4976	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	90
PID 1496 wrote to memory of 1460	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	91
PID 1496 wrote to memory of 1460	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	91
PID 1496 wrote to memory of 1460	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	91
PID 1496 wrote to memory of 1772	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	92
PID 1496 wrote to memory of 1772	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	92
PID 1496 wrote to memory of 1772	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	92
PID 1496 wrote to memory of 100	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	93
PID 1496 wrote to memory of 100	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	93
PID 1496 wrote to memory of 100	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	93
PID 1496 wrote to memory of 4880	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	94
PID 1496 wrote to memory of 4880	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	94
PID 1496 wrote to memory of 4880	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	94
PID 1496 wrote to memory of 2288	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	95
PID 1496 wrote to memory of 2288	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	95
PID 1496 wrote to memory of 2288	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	95
PID 1496 wrote to memory of 528	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	103
PID 1496 wrote to memory of 528	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	103
PID 1496 wrote to memory of 528	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	103
PID 1496 wrote to memory of 2276	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	104
PID 1496 wrote to memory of 2276	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	104
PID 1496 wrote to memory of 2276	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	104
PID 1496 wrote to memory of 4352	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	105
PID 1496 wrote to memory of 4352	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	105
PID 1496 wrote to memory of 4352	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	105
PID 1496 wrote to memory of 768	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	107
PID 1496 wrote to memory of 768	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	107
PID 1496 wrote to memory of 768	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	107
PID 1496 wrote to memory of 1856	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	108
PID 1496 wrote to memory of 1856	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	108
PID 1496 wrote to memory of 1856	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	108
PID 1496 wrote to memory of 2492	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	109
PID 1496 wrote to memory of 2492	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	109
PID 1496 wrote to memory of 2492	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	109
PID 1496 wrote to memory of 4332	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	110
PID 1496 wrote to memory of 4332	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	110
PID 1496 wrote to memory of 4332	1496	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe	110

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3499820196a6653c26e6d3ac98efe8f0_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1496
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1112
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4976
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1460
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1772
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:100
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4880
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2288
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:528
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2276
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4352
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:768
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1856
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 8ac9e58c76ece38bc12c13c21e743b9010f19ef87fde0312fa8041e2579848ad
MD5 3a1266ebfd82ea121c076eb366d59d34
SHA1 1a0af93d211fe7e0238a6ab55c10cd3f55cdd7c5
SHA512 70a1b8a2556b54b73b28882ec7d22789fb2647205357bce006041b756da2b3c9e22c4f1696e77a9ad14ed3acca842255e57745a62e5680aeb74bc99a6113e137
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBihJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIhvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 ee53b39aece681e2a05684163dc915a3f29d3684527b9663bca4ef97ad3ce6c4
MD5 c2b3dc3fdd5090f70d8f069c2e4d4485
SHA1 b06094835d676a6ec41feec40801192cdb796c1e
SHA512 14e067c30da9e72ec9609849020313ca0ac9afa458ca3309777da8a3c69db95d578c69aabd89c21457cca349a78a28ff61896e7f58346b8773a7f4b55f3469d6
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBi7JRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQI7vtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 bd7959e1b769cad2d09725e42f62a4a68fef8e9de1476a421ffb8446791a6382
MD5 70bcd91a2afaec2f782b911dc14ab9a7
SHA1 ff9dd2c0cb9280806607727973ca5b24cf495897
SHA512 a2345353c40ae8da425b585ab90cc19b29fba78939bc7c8e3efc59ebcc748a6d9062b1034557cfea8682acdc8217dd8a8a766dc2a51ce4c63de7928d95dd7c39
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBiYTJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIYTvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 a88eb3c6ab911552695b157c27a4afba929c4067de6720a7dcdff352d59b732b
MD5 38297289950fc570660968dcba7e5a40
SHA1 02eb53f395910c857b7d6d2f75a5959769cc2f26
SHA512 74e96c8e4b7650058f7769448457984f4dadbe898bec64f45fc492c4e3524c4081c7b41e024cda5f71cb5a1c9df70cff3e0f7a46d77e2da8d50d686bb82b4008
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBicJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIcvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 c3a729f80139ed5dfd03c4834a5600d8e59ca5525123393077b97cb42377e9e6
MD5 cdbaab6516c49bbe2923c2f9f4b64cb3
SHA1 f01dc8fa7ee9c4dabf9572ccca13fb62bb7fee35
SHA512 8ac00638031faf61c412f622b28e9ef947ddae3083f0f385f11c3373b87982088eb231bdfc2e4e86b33d0965236ddf0986a5a62037fc812fcfa4892d2b3c5ad8
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBi2JRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQI2vtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 240e1d44d2f97f7d5cb607be85fc1db2f1e5ae31af3cd67100cd937c3f114eb7
MD5 e12739cfc8c08dcc11d629b650fa3545
SHA1 12223d036ebc373ff45c992b9ed244ffce79535b
SHA512 70a922bef694e9cf622204d3f86b753b803d6682fb09c6efddaf17bb35a83b8b145fbe527f6d7779d23084bf1142552f9b7d98b1e33ffe8d1c8fc458970e2aa3
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBi3JRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQI3vtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 6bb89bbcb34c77463eebdbd07cd149f667859f6abc7762dbe41494443c565f2f
MD5 54a64c17d4599f44d4984802b5dc6964
SHA1 bb7704c84e0b8908113365fae5c7a229117061a2
SHA512 591a053ed52034b2d9e17a74704c50e7f9f98205b9a0c3ec00075999e54215365f8a8c739c682e7fecd443e85abf2a61934723d73c52692a4bda7e115180b119
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBi9JRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQI9vtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 dbeb7e1aa49048053883bbdab2f2b320b59f70cb41588df71aa3440295d77067
MD5 3d2b0b5f770935299b36b338c47a728f
SHA1 cfd329dab055fd38263f64bf09c342448c178133
SHA512 91a00c4ed2ab5780bd77c372f00b7556e11233c071f30a578fe41f7e0bd0d9fc7e16e8f853404682d45fb86e42c7675cb83929b3dd07dbf5bf6c38961badcfb3
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBiLJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQILvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 f48cc34d43ca199ca42c100a77101b0515eedceb5909b30ba92b52946f6cc90b
MD5 5a443db7d00361a621e248649ed4d326
SHA1 0c1fe0ad5b5d90f82fa47a04985dd52bddfceb89
SHA512 ad30195cd66d49d06406ba91a6820d9282a6a24bb6931b24170858acf875caa1edf55fb1d27364775a500a55c1e1d82483c7bc747851197b8940ee6cea089858
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBih9JRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIh9vtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 f37b978805f3575461f8289deae885dfce198a3d7bd11532f06ab7c4fb955d8c
MD5 58eced254c3a427a0e32e326081763d1
SHA1 4d02760fdae77b1b6c076c64f25c8594b31e84ff
SHA512 dd8002dcb81d79f23f4c8d3a253ab93d82d69109de6367cb59be3f4f530fba9ad2172c76e2dd915578a0466e3b4381b638c86cd3cd4d9988ab8282543a524700
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBi9iJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIgvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 9d8cb8acc85aa9be4fe1dc6689beb599d3035a8878741e23851a053942616f16
MD5 1568ac0f3ec4178a4f864bc0b3d8a220
SHA1 ea9b174f6f5ccdabd8ce884a72ed35d61c5843fb
SHA512 01a025280f621654a96e2b5e5a6dc7ec546598749cd1aeb0e4e79721cf9c30e357517993d0bdb2f1d7dae7aa230fe07216b85c147c7ae9e66b65a713b4ef54d7
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBizJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIzvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 855c8a681460b561d7d32671265d425baf8a290508165e4607a43834aeead55b
MD5 cd19b7b8071d62f408c7761562ed7d05
SHA1 05a0165a36b7275311cfa210dad62794cb3fffbd
SHA512 aefb657516fb311d01e468e397e9db508021672fa035feb3c5b4f8760f06d458edda99ddb1d26dc2cb3b58063b2f171693e4b2e9b9b1e8da157839a1cf0264e2
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBiQJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIQvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 8990fa416b300869d4807a8b97ec1a29ebed8b59c810dd1b771fc5837ab14284
MD5 3499820196a6653c26e6d3ac98efe8f0
SHA1 a4ff97968073eb622de2cd854a6f2c73da3cb1cf
SHA512 e88ebf1bc67b17311381ccfc58e6bc0ffe65b857b8f219de566d5761c5837ca3a1948ec60c725208f61f6bb5bfeb4cfd315c1d438871b89bdd854497290b7044
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBiyJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIyvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 8aea3b3c70aa4a9ca9a937b30897f7f800677063a56427088ddc6d89e5f2b878
MD5 bd3e6b81a09ebdfd16760cbaa24fb764
SHA1 b5dc26eef02ecf0ce76bedcbd73ce894bdab5e56
SHA512 d7dc6b9532cb1b41b96bf430d21f0b357e264125c427495e6eb9209707d9b28452e6f6223cda2f93a3bc180a923d0627d6ba5996a151883a160274b5966df56e
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBiqJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIqvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 0c1d9c35301514766a8c931a68a7e324e13a0c80df0d1df9b0f4bde243f7474f
MD5 9631472fa415e458577a4abfe5dae86b
SHA1 92d1c3dad3cc159daec89f2e1d5ec602450c5a25
SHA512 795650c4d88421d8ab6d0465b14c673626a6d0a23161082696d47e351ddce9fce55bc6e2e10a8853c62972ef877344070178c9577f7053945945325555761a72
SSDEEP 1536:XJRtlEnBHHIgabuYotV/JbJCX5SBiGJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIGvtYxOuYotvYQIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Folder.htt

Path C:\XK\Folder.htt
Size 640B
SHA256 fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061
MD5 5d142e7978321fde49abd9a068b64d97
SHA1 70020fcf7f3d6dafb6c8cd7a55395196a487bef4
SHA512 2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\desktop.ini
Size 217B
SHA256 52fb776a91b260bf196016ecb195550cdd9084058fe7b4dd3fe2d4fda1b6470e
MD5 c00d8433fe598abff197e690231531e0
SHA1 4f6b87a4327ff5343e9e87275d505b9f145a7e42
SHA512 a71523ec2bd711e381a37baabd89517dff6c6530a435f4382b7f4056f98aff5d6014e85ce3b79bd1f02fdd6adc925cd3fc051752c1069e9eb511a465cd9908e1
MD5 SHA1 SHA512

Submit Download

memory/100-81-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/528-234-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/768-280-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1112-55-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1460-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1460-67-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1496-121-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1496-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1496-271-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1496-120-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1496-294-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1772-74-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1856-285-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2276-240-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2288-94-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2492-287-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2492-288-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4352-243-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4880-89-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4976-59-0x0000000000400000-0x000000000042F000-memory.dmp

Download