sality | 81adb50b0f8123262466a57ed20a194250661612f9c69f5a2d4360b504d7b0cf

Analysis

max time kernel
31s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
Size 1.7MB
Sample240619-ml9whatanp
SHA256 81adb50b0f8123262466a57ed20a194250661612f9c69f5a2d4360b504d7b0cf
MD5 b5233c98424e7a457735b248c2be3b90
SHA1 b5eda4318a9db583fd3f11bce732c7f9434907cc
SHA512 bc91fffa8ca714fcff59e91b42fb8c0c31f2e924d7fd834fd7511975d563e0fc9e244d03fb106ae957c009450dc07acb66ed49161e75d17e5249eb71b211fb31
SSDEEP 24576:WIXW/8yw1ez54lI7F5SXYHjzGyzatThRiVk6jXRqbLGJv6plFh9iGa2oMYMgdsHI:h9bC4lIOcb8TjkXzJspDLoVMgdkLbQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sality backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rundll32.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	@AE3A88.tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	kb50145.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	@AE3A88.tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WdExt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	module_launcher.exe

Deletes itself 1 IoCs

pid	Process
4724	rundll32.exe

Executes dropped EXE 7 IoCs

pid	Process
1128	@AE3A88.tmp.exe
1800	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
4888	WdExt.exe
4724	rundll32.exe
2264	module_launcher.exe
5548	kb50145.exe
3776	injector_s.exe

Loads dropped DLL 2 IoCs

pid	Process
1128	@AE3A88.tmp.exe
4888	WdExt.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1128-13-0x00000000021F0000-0x0000000003220000-memory.dmp	upx
behavioral2/memory/1128-25-0x00000000021F0000-0x0000000003220000-memory.dmp	upx
behavioral2/memory/1128-331-0x00000000021F0000-0x0000000003220000-memory.dmp	upx
behavioral2/memory/1128-358-0x00000000021F0000-0x0000000003220000-memory.dmp	upx
behavioral2/memory/4888-379-0x0000000002270000-0x00000000032A0000-memory.dmp	upx
behavioral2/memory/4888-384-0x0000000002270000-0x00000000032A0000-memory.dmp	upx
behavioral2/memory/4888-958-0x0000000002270000-0x00000000032A0000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe"	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Admin\\module_launcher.exe\""	module_launcher.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	@AE3A88.tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	rundll32.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	rundll32.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	@AE3A88.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1128	@AE3A88.tmp.exe
1128	@AE3A88.tmp.exe
1128	@AE3A88.tmp.exe
1128	@AE3A88.tmp.exe
1800	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
1800	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
4888	WdExt.exe
4888	WdExt.exe
4888	WdExt.exe
4888	WdExt.exe
2264	module_launcher.exe
2264	module_launcher.exe
2264	module_launcher.exe
2264	module_launcher.exe
2264	module_launcher.exe
2264	module_launcher.exe
2264	module_launcher.exe
2264	module_launcher.exe
4724	rundll32.exe
4724	rundll32.exe
4724	rundll32.exe
4724	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe
Token: SeDebugPrivilege	1128	@AE3A88.tmp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1800	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
4724	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1544	4864	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe	82
PID 4864 wrote to memory of 1544	4864	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe	82
PID 4864 wrote to memory of 1544	4864	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe	82
PID 4864 wrote to memory of 1544	4864	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe	82
PID 4864 wrote to memory of 1544	4864	b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe	82
PID 1544 wrote to memory of 1128	1544	explorer.exe	83
PID 1544 wrote to memory of 1128	1544	explorer.exe	83
PID 1544 wrote to memory of 1128	1544	explorer.exe	83
PID 1544 wrote to memory of 1800	1544	explorer.exe	85
PID 1544 wrote to memory of 1800	1544	explorer.exe	85
PID 1544 wrote to memory of 1800	1544	explorer.exe	85
PID 1128 wrote to memory of 768	1128	@AE3A88.tmp.exe	8
PID 1128 wrote to memory of 776	1128	@AE3A88.tmp.exe	9
PID 1128 wrote to memory of 376	1128	@AE3A88.tmp.exe	13
PID 1128 wrote to memory of 2556	1128	@AE3A88.tmp.exe	43
PID 1128 wrote to memory of 2652	1128	@AE3A88.tmp.exe	45
PID 1128 wrote to memory of 2772	1128	@AE3A88.tmp.exe	47
PID 1128 wrote to memory of 3548	1128	@AE3A88.tmp.exe	56
PID 1128 wrote to memory of 3668	1128	@AE3A88.tmp.exe	57
PID 1128 wrote to memory of 3844	1128	@AE3A88.tmp.exe	58
PID 1128 wrote to memory of 3932	1128	@AE3A88.tmp.exe	59
PID 1128 wrote to memory of 4008	1128	@AE3A88.tmp.exe	60
PID 1128 wrote to memory of 716	1128	@AE3A88.tmp.exe	61
PID 1128 wrote to memory of 4132	1128	@AE3A88.tmp.exe	62
PID 1128 wrote to memory of 4448	1128	@AE3A88.tmp.exe	64
PID 1128 wrote to memory of 5360	1128	@AE3A88.tmp.exe	74
PID 1128 wrote to memory of 2452	1128	@AE3A88.tmp.exe	79
PID 1128 wrote to memory of 3740	1128	@AE3A88.tmp.exe	80
PID 1128 wrote to memory of 1544	1128	@AE3A88.tmp.exe	82
PID 1128 wrote to memory of 3720	1128	@AE3A88.tmp.exe	84
PID 1128 wrote to memory of 1800	1128	@AE3A88.tmp.exe	85
PID 1128 wrote to memory of 1800	1128	@AE3A88.tmp.exe	85
PID 1128 wrote to memory of 736	1128	@AE3A88.tmp.exe	89
PID 1128 wrote to memory of 736	1128	@AE3A88.tmp.exe	89
PID 1128 wrote to memory of 736	1128	@AE3A88.tmp.exe	89
PID 1128 wrote to memory of 4284	1128	@AE3A88.tmp.exe	91
PID 1128 wrote to memory of 4284	1128	@AE3A88.tmp.exe	91
PID 1128 wrote to memory of 4284	1128	@AE3A88.tmp.exe	91
PID 736 wrote to memory of 4888	736	cmd.exe	93
PID 736 wrote to memory of 4888	736	cmd.exe	93
PID 736 wrote to memory of 4888	736	cmd.exe	93
PID 4888 wrote to memory of 768	4888	WdExt.exe	8
PID 4888 wrote to memory of 776	4888	WdExt.exe	9
PID 4888 wrote to memory of 376	4888	WdExt.exe	13
PID 4888 wrote to memory of 2556	4888	WdExt.exe	43
PID 4888 wrote to memory of 2652	4888	WdExt.exe	45
PID 4888 wrote to memory of 2772	4888	WdExt.exe	47
PID 4888 wrote to memory of 3548	4888	WdExt.exe	56
PID 4888 wrote to memory of 3668	4888	WdExt.exe	57
PID 4888 wrote to memory of 3844	4888	WdExt.exe	58
PID 4888 wrote to memory of 3932	4888	WdExt.exe	59
PID 4888 wrote to memory of 4008	4888	WdExt.exe	60
PID 4888 wrote to memory of 716	4888	WdExt.exe	61
PID 4888 wrote to memory of 4132	4888	WdExt.exe	62
PID 4888 wrote to memory of 4448	4888	WdExt.exe	64
PID 4888 wrote to memory of 5360	4888	WdExt.exe	74
PID 4888 wrote to memory of 2452	4888	WdExt.exe	79
PID 4888 wrote to memory of 3740	4888	WdExt.exe	80
PID 4888 wrote to memory of 1356	4888	WdExt.exe	86
PID 4888 wrote to memory of 5856	4888	WdExt.exe	87
PID 4888 wrote to memory of 736	4888	WdExt.exe	89
PID 4888 wrote to memory of 736	4888	WdExt.exe	89
PID 4888 wrote to memory of 512	4888	WdExt.exe	90
PID 4888 wrote to memory of 4284	4888	WdExt.exe	91

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	@AE3A88.tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:376

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2652

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2772

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3548
- C:\Users\Admin\AppData\Local\Temp\b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\@AE3A88.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\@AE3A88.tmp.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1128
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:736
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:512
      - C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
        
        "C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
        
        "C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe" /i 4888
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
        9⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
        
        "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5548
        
        C:\Users\Admin\AppData\Roaming\injector_s.exe
        
        "C:\Users\Admin\AppData\Roaming\injector_s.exe"
        11⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0x.bat" "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe" "C:\Users\Admin\AppData\Local\Temp\a0x.bat""
        11⤵
        
        PID:3384
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
        5⤵
        
        PID:4284
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe"
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Deletes itself
        Executes dropped EXE
        Checks whether UAC is enabled
        Enumerates connected drives
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3844

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3932

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4008

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:716

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4132

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4448

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:5360

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2452

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3740

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:3720

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1356

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5856

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@AE3A88.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\0E573C4D_Rar\@AE3A88.tmp.exe
Size 970KB
SHA256 7f5df7922d82f03c8735fdc9f9cc1d787da8f1f13b1828f66aeb517422eb1e4b
MD5 8f1046ca47595761583046048791148f
SHA1 7e748ad90fd12006ad27a73de11df9bbca6722fd
SHA512 3424b17c5959678c4c5a629c8483d1fd19b78864ecdacdc7b2ef02b9a16ce1100a03e948854b2166764783e910579c6fa0e74b11d49cf72b71d75f6b6f8e0a51
SSDEEP 24576:1GRzatThRiV1bLGJv6plFh9iGa2oMYMgdsHGebx:o8Tj/JspDLoVMgdkLbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\0E574064_Rar\b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
Size 664KB
SHA256 201f53068429e57f2aefa89699e780375f39d41267173966c1c2adc3f62b0227
MD5 fe9261575638dec5742ddfba5b5fb19c
SHA1 4dc2e4f6556cfcf86d594de9bdd5f66fd9979cac
SHA512 b771afc81c4bdab04256a5e40097c6ff0ff06fb4f07d107a347f8397abd0504384cad1311d9591ca10ea8fd59b4afc40212a371de006d09003cef0ea82308951
SSDEEP 12288:DTyjXW+48qWywrU4kGFezOAVuJ5PIGww7F5DO3HYffY:fIXW/8yw1ez54lIYF5SXYHY
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdExt.exe

Path C:\Users\Admin\AppData\Local\Temp\0E5748B1_Rar\WdExt.exe
Size 970KB
SHA256 f7ca7918bfa6ac7201689345adc416e7b13f708457efdda0b50150a73577e62c
MD5 0ff28d215d5adee3b592dbf69f218ad4
SHA1 15762c649871be44d6a1e5f0fe772abad1b86ae0
SHA512 6dcd44a14c436ca6df5cb06d161be575eb3bed62751954e688543d947f544aeafddba86c89c8824346ed2e14bfbd184674a2edcab018847b9fcd37ba646132df
SSDEEP 24576:1GRzatThRiVZbLGJv6plFh9iGa2oMYMgdsHGebu:o8TjtJspDLoVMgdkLbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

@AE3A88.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\@AE3A88.tmp.exe
Size 1.0MB
SHA256 d594e1da162a7cd67be562c115b3f669c84040798353db154eb9f3ee305b5dab
MD5 46329f893d9543e37c0603b01751fa81
SHA1 4acdc019085b51f8c7860ab47a09b293c385c1d9
SHA512 3493b422291f0db77f27bf5498d966ac6ebc304d292c3fbd8f108caca501c3ba4f64ad599e89e3ac15133e3843e0a6b0be043be5a992a76c09cf4cda110e89f8
SSDEEP 24576:kGyzatThRiVk6jXRqbLGJv6plFh9iGa2oMYMgdsHGebx:I8TjkXzJspDLoVMgdkLbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

a0x.bat

Path C:\Users\Admin\AppData\Local\Temp\a0x.bat
Size 44B
SHA256 b1e4990bf84c402594a53a2a98011b8880239e790872de1f6c7b8b9cd1005cf5
MD5 804bb96081db73d249b1d21573d8ea59
SHA1 abf76e8d0702ce245bb7afbb513cdcc8bac6ab35
SHA512 d037dea300ffe466ab83c2a1c2c9a55693c36b546dbbcfa0a7a1ef477a3ea5c33f9831d71389466cf4c74192b417bf9ed0b7e0ad88d927f1ca997fcba254414c
MD5 SHA1 SHA512

Submit Download

b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\b5233c98424e7a457735b248c2be3b90_NeikiAnalytics.exe
Size 740KB
SHA256 c0eac92d2eae3b0e4b24c214b9ea35e3bb267cb2a3abc0cf7cad3abe1b0b4611
MD5 9887f7db7dc40ada587df7c33c42ff15
SHA1 d029cba559891ee96f15e410bc3b48b03afb92a5
SHA512 f4af32b4edce3635dac85b2867bd04e67cb3d287049e1e79c88a90f31dabaac8046a18f9ab517384de8ba7025fd24a066ccebbf68220a65039fecb32e65a779f
SSDEEP 12288:NTyjXW+48qWywrU4kGFezOAVuJ5PI3ww7F5DO3HYfftSw:RIXW/8yw1ez54lI7F5SXYHtr
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp493F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp493F.tmp
Size 121KB
SHA256 e1a25be30164e6aca9bf97454be217f2b49e6f65fa4d3ac710637f6ef8a213a0
MD5 864484e1394eaaa2e9a8a63f01c97be0
SHA1 d02a92d866232f22a8477ab99e6d27354fa310f2
SHA512 16919202ee3626ab829070dbe2f43bb5caa9bbaebf63f5de3fb9930825f71edd074855cac6349241705d6bf979203e0eb7f9df2c25d2bfab95ee210ac350568c
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyH:L
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4940.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4940.tmp
Size 131KB
SHA256 ba6a7655e3860d01201ffbce06398dff71fd97acff99e95ac8cd2a3e3161d1c0
MD5 ebc999a1ded4f76d648431350fe423bb
SHA1 b1a4abcb00364ede9185209d41e7e2532cd559a0
SHA512 aba5a33667e01857650f74ea5dd461c11a0ff121c22e08ab058b950b11b315119b00acaf0aaf7401a668a4131daf73d07717002c6dd55570a79ad5ba526e5ce4
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyn:z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4950.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4950.tmp
Size 99KB
SHA256 4a8ea33966592b337d31802f55ea7f901caec037b5b1bf18a9e2b6b044915781
MD5 88c497ace0db30cc47fc259b7806ad8f
SHA1 a486cedff64cb60e62ffbefd25ee5df79e6a9714
SHA512 1748700a158b8f999658eb532e5d4ed80c844b21c47d3bf0d8682de22be4b47a424350196ee3d0538d71a67aca906b781282eb3192031e93e834f417b8134346
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy/:r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4961.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4961.tmp
Size 172KB
SHA256 015caba690febdd5403ad86a04bb9763db7408a3b3f0be85f9c364580dac4649
MD5 b00a14a9f3b2c8ac19ada6992517ff77
SHA1 8469aa684cf86fcf627c828d40a9dc9688187173
SHA512 fea53117dc2efc23af186fae9ea8abc6ed15a516a820d62a5d312525447b0495fc0d81acf540017422427ea45754298fb7e334c9db8c47d49c4ce741f85bbf2c
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyn:r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4962.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4962.tmp
Size 76KB
SHA256 a1d30db63fcb26cfcc1e128f4b840ac1c822267a8f17de45cc2e2fc19147e41f
MD5 ccf05ce9abe252cc7d68b2ff8ab6cfb7
SHA1 8739e9e007b62d9434bd5d06d5d312d255496a00
SHA512 e2e56fa332b895fc54fd9a6ccd71952f11237f18d66b2342a47c7b707a65743d3f8b84efa5988257e657623cb748cb196e36a8839fb1cd5f600cb30623b2a29b
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyT:f
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdExt.exe

Path C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
Size 1.0MB
SHA256 a3729907062cccdbf648b1f8d028706f8badb3970c338394f1ce714bb818336e
MD5 42717159e5080a95b7b2bd6de61cf73b
SHA1 e0fb2e28133008a28ec2860e205b7720f0d4e9a6
SHA512 d2923ce7dcb1c18590ef834fd88f0bb5bf2a892f625ab771fe746310389328fc27c2a64fe8b546e6bb6019dfc4530d12deda6bc7b9bace0d8b3e288d77d8a6da
SSDEEP 24576:kGyzatThRiVk6jXRqbLGJv6plFh9iGa2oMYMgdsHGebu:I8TjkXzJspDLoVMgdkLbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

kb50145.exe

Path C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
Size 76KB
SHA256 048655d212b269073107e4636125ceeea262acce1d364fc512a0cc8f4783dcf7
MD5 8bf335774fbb62bbe1de03921dfe047a
SHA1 24fc750a20aebb52f23e84264d201f458106d95d
SHA512 aed95f1c37cc99cee23d250e395a80c9c45c7c1c017ec7baef2af860711dbd5b540bf077d372e94582c9758961063f4c166a03fffce3b17e7fb468ce174b7aea
SSDEEP 1536:4PvHSkIOrnToIfvl9ys325hnA2tQAxlLo6G41JJsi9eQ3:4PLTBfvl9ys32flG6G4H+Q3
MD5 SHA1 SHA512 SSDEEP

Submit Download

module_launcher.exe

Path C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
Size 172KB
SHA256 b4febd6c6fc42b7d86b575f6c44f0d49fbe9ec02e98d3be00cb26b3e32a3a6d1
MD5 6ff3155e619e2c601db536c88741e094
SHA1 c71bfc0a9b11db33c801035e06d31a03e2901dd0
SHA512 8a3047ff46833003464f0979702a4b4f0cf3998c3e4aa865b2f61cfd377689eae706fb9017c2ca97a2fee7f65d6c17c73ae37e86940a6aefdd06d8f0281bcebc
SSDEEP 3072:pzFKPt9YZEJiqtTBfwVVxt377g3zd3jceABCO0RC4R:pC7YZwiqtTBoRXKFGUOiC2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Admin0.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
Size 105B
SHA256 ff5e923c453d3d61a7989b2b0f978b0bba924a7052667311c9eed54852a20cfd
MD5 902a1098f800859502aec4eac3026495
SHA1 a6b209e9aa15087670e830af5de8179b31abc897
SHA512 cf7f0197c78f9c7db81068fbc702596a00c5d7c8280751641965917056c0e71265a3a89f3daf6a3600faa13034b54fbedea50ea583723abbfc286f2e7e79fe77
MD5 SHA1 SHA512

Submit Download

Admin1.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
Size 122B
SHA256 45664826d4ccef2fed844589b0908aa0f2e19c0a54681d0f6293e7a83f98f7f9
MD5 ac79fc2720ad39c1e03109e10febe306
SHA1 33c6e54cf1d8c2ba79197f67a0c6cc349e235179
SHA512 a399a4869128f6e78fa6960cb4dc3971c737cf9f3aaf703a88f83aed3a0b7f9e7b8fd4f8bb33c58173d950b5a99ff32c667cc8b787a93a6ac443674ee480e372
MD5 SHA1 SHA512

Submit Download

Admin1.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
Size 196B
SHA256 27413bee2cc64460ce727267079693032dc53c9f4982868bced9684e73817ae9
MD5 c2f57b825b1f1bca6fce290e639cf028
SHA1 f8abd1f55c86ed8dcd219ae0a4c08080976de395
SHA512 0a020f87c5329ef4239ed2e086afa76a1741328fa87f93818503e4e73ff59c7431b3c4cdcc8de6763eabfbac1394b6210a779506ec48abe5c386eaa8d830697b
MD5 SHA1 SHA512

Submit Download

Admin2.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
Size 107B
SHA256 bf1b95975082845d3d9d8948999d69d666dfe50d741a36cdf81fa180fa4c777b
MD5 85eb3280f9675f88d00040cbea92277f
SHA1 2fece0a30b2153b4a9fee72fe5a637dee1967a2f
SHA512 2641b1dfa67216ed86d0394dbc6dd78f6124978c23673c73e4e1da66a93f98364acafc13c3df017fab682ed3d9a2c993f3d9bb562e07b7a1b0a01576e1381298
MD5 SHA1 SHA512

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 388KB
SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83
SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3CrP:RyRznmnp5SedNJBCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

injector_s.exe

Path C:\Users\Admin\AppData\Roaming\injector_s.exe
Size 188KB
SHA256 22c5c5bcb256c1dcaead463c92a70107ba1bac40564fe1e7d46594c6a3936778
MD5 1d1491e1759c1e39bf99a5df90311db3
SHA1 8bd6faed091bb00f879ef379715461130493e97f
SHA512 ac6ca48acbd288011849e55b0c66faf9ead479e39dc2deaecc7ad998e764f02a1807bb9227e03f12ce1a0b1f5c5b3072c3b86b5bae336e84d95d7a3e42cf5a1e
SSDEEP 1536:ZcnSpj9lXZGDvgwT//05l4L3uWF+YqQFVGXOPTIaf:OSpj9+3/05l4LFF+3LXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

SYSTEM.INI

Path C:\Windows\SYSTEM.INI
Size 258B
SHA256 1aa164dbfad57a515916907ce7a558b14eb29b421e18c0ac4686de827a667167
MD5 4546cb493783d193e0a358f270456dc4
SHA1 53598864b5eec6099a18c6e373c2ab7fcd4ca93a
SHA512 0b5fffe1a54c055fbf45b9f9278a01b91de068882ded4ef709b251e76f12bf30741bee1df6025e789de2bc20615961efca511ea2aae008cc404ba5daca0da4ab
MD5 SHA1 SHA512

Submit Download

memory/736-577-0x0000000001180000-0x0000000001182000-memory.dmp

Download

memory/736-397-0x0000000001190000-0x0000000001191000-memory.dmp

Download

memory/1128-358-0x00000000021F0000-0x0000000003220000-memory.dmp

Download

memory/1128-331-0x00000000021F0000-0x0000000003220000-memory.dmp

Download

memory/1128-319-0x0000000000600000-0x0000000000602000-memory.dmp

Download

memory/1128-320-0x0000000003530000-0x0000000003531000-memory.dmp

Download

memory/1128-361-0x0000000000600000-0x0000000000602000-memory.dmp

Download

memory/1128-324-0x0000000000600000-0x0000000000602000-memory.dmp

Download

memory/1128-373-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1128-25-0x00000000021F0000-0x0000000003220000-memory.dmp

Download

memory/1128-21-0x0000000010000000-0x0000000010015000-memory.dmp

Download

memory/1128-13-0x00000000021F0000-0x0000000003220000-memory.dmp

Download

memory/1128-14-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1800-946-0x0000000000900000-0x0000000000902000-memory.dmp

Download

memory/1800-325-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/1800-950-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/1800-323-0x0000000000900000-0x0000000000902000-memory.dmp

Download

memory/1800-322-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/4284-578-0x00000000006A0000-0x00000000006A2000-memory.dmp

Download

memory/4284-399-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/4284-662-0x00000000006A0000-0x00000000006A2000-memory.dmp

Download

memory/4724-1119-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/4724-944-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/4864-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/4864-1-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/4888-401-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/4888-378-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4888-379-0x0000000002270000-0x00000000032A0000-memory.dmp

Download

memory/4888-384-0x0000000002270000-0x00000000032A0000-memory.dmp

Download

memory/4888-980-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4888-958-0x0000000002270000-0x00000000032A0000-memory.dmp

Download

memory/4888-576-0x0000000000870000-0x0000000000872000-memory.dmp

Download