Analysis
-
max time kernel
130s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 22:48
Static task
static1
Behavioral task
behavioral1
Sample
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe
-
Size
97KB
-
MD5
49060e183cfd3d439b4b212a894bb720
-
SHA1
0c44e1d146e2293b280361c8bae3e8c24c97646d
-
SHA256
ce10e12543e9dd43c86677dc7c22f450e0b620e3ac9252ed6fcbf02f7d13a590
-
SHA512
066fccdea1b836940f917de4ab82efc86b67033fa16c8e3e7de9e9d1e224bf588a3497038e560d9c0574e7cd80b2fcf67cea1a5d5f2821b4c8be49c9f5e6f1ad
-
SSDEEP
1536:Hk9voeVR22LooOcIrSDaIFEaeY6HbViKeeM+JoDOWVjfwxfORVGBIcjZGjaQH:qVmolIr8xeY65LZUIx2qZZGj
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/1012-1-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-3-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-4-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-9-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-6-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-7-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-5-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-8-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-11-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-10-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-21-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-22-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-23-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-24-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-25-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-27-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-28-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-30-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-31-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-32-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-35-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-36-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-38-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-41-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-44-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-45-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-47-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-49-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-51-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-52-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-53-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-61-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-62-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-63-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-64-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-65-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-69-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-70-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-72-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-74-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/1012-87-0x0000000000750000-0x000000000180A000-memory.dmp upx -
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\L: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\U: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\P: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\S: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\V: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\M: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\N: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\I: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\W: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\Z: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\E: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\H: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\K: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\O: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\Q: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\R: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\T: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\X: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\G: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\J: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened (read-only) \??\Y: 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification F:\autorun.inf 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Drops file in Program Files directory 12 IoCs
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process File created C:\Windows\e580eef 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exepid process 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Token: SeDebugPrivilege 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription pid process target process PID 1012 wrote to memory of 780 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe fontdrvhost.exe PID 1012 wrote to memory of 784 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe fontdrvhost.exe PID 1012 wrote to memory of 64 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe dwm.exe PID 1012 wrote to memory of 2512 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe sihost.exe PID 1012 wrote to memory of 2520 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe svchost.exe PID 1012 wrote to memory of 2752 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe taskhostw.exe PID 1012 wrote to memory of 3300 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Explorer.EXE PID 1012 wrote to memory of 3436 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe svchost.exe PID 1012 wrote to memory of 3700 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe DllHost.exe PID 1012 wrote to memory of 3796 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 1012 wrote to memory of 3924 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe RuntimeBroker.exe PID 1012 wrote to memory of 4004 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe SearchApp.exe PID 1012 wrote to memory of 3804 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe RuntimeBroker.exe PID 1012 wrote to memory of 400 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe RuntimeBroker.exe PID 1012 wrote to memory of 4460 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe TextInputHost.exe PID 1012 wrote to memory of 2032 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2304 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 3988 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2548 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2092 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2072 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 1980 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 780 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe fontdrvhost.exe PID 1012 wrote to memory of 784 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe fontdrvhost.exe PID 1012 wrote to memory of 64 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe dwm.exe PID 1012 wrote to memory of 2512 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe sihost.exe PID 1012 wrote to memory of 2520 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe svchost.exe PID 1012 wrote to memory of 2752 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe taskhostw.exe PID 1012 wrote to memory of 3300 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Explorer.EXE PID 1012 wrote to memory of 3436 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe svchost.exe PID 1012 wrote to memory of 3700 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe DllHost.exe PID 1012 wrote to memory of 3796 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 1012 wrote to memory of 3924 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe RuntimeBroker.exe PID 1012 wrote to memory of 4004 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe SearchApp.exe PID 1012 wrote to memory of 3804 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe RuntimeBroker.exe PID 1012 wrote to memory of 400 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe RuntimeBroker.exe PID 1012 wrote to memory of 4460 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe TextInputHost.exe PID 1012 wrote to memory of 2032 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2304 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 3988 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2548 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2092 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2072 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 1980 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 780 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe fontdrvhost.exe PID 1012 wrote to memory of 784 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe fontdrvhost.exe PID 1012 wrote to memory of 64 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe dwm.exe PID 1012 wrote to memory of 2512 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe sihost.exe PID 1012 wrote to memory of 2520 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe svchost.exe PID 1012 wrote to memory of 2752 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe taskhostw.exe PID 1012 wrote to memory of 3300 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe Explorer.EXE PID 1012 wrote to memory of 3436 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe svchost.exe PID 1012 wrote to memory of 3700 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe DllHost.exe PID 1012 wrote to memory of 3796 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 1012 wrote to memory of 3924 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe RuntimeBroker.exe PID 1012 wrote to memory of 4004 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe SearchApp.exe PID 1012 wrote to memory of 3804 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe RuntimeBroker.exe PID 1012 wrote to memory of 400 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe RuntimeBroker.exe PID 1012 wrote to memory of 4460 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe TextInputHost.exe PID 1012 wrote to memory of 2032 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2304 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 3988 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2548 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe PID 1012 wrote to memory of 2092 1012 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe msedge.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2520
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2752
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\49060e183cfd3d439b4b212a894bb720_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3436
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3700
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3796
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3924
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3804
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:400
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4460
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:2032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa00e22e98,0x7ffa00e22ea4,0x7ffa00e22eb02⤵PID:2304
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2272 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:22⤵PID:3988
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3200 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:2548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3412 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:82⤵PID:2092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5336 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:12⤵PID:2072
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5484 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:12⤵PID:1980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3848 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:82⤵PID:3576
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\jikfw.pifFilesize
97KB
MD512dc8c8f4c6ba2b7737d27ca718fc7b2
SHA1814f11d49e543ce1442555bce82d29422339e9bf
SHA256e8efd38c86283330c729a184c3ef76a82dea118d8e40fe181e83cb46d678296b
SHA512311b862365e99e1b36c3fe220e039b9f8dae48caec0896961aae603ade12565324976262856c84870cf06c2b722c8b8126b93bcb202dc38f6ce57ff7f3bb36db
-
memory/1012-32-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-70-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-4-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-9-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-6-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-7-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-5-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-8-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-18-0x0000000004380000-0x0000000004381000-memory.dmpFilesize
4KB
-
memory/1012-20-0x0000000001C50000-0x0000000001C52000-memory.dmpFilesize
8KB
-
memory/1012-19-0x0000000001C50000-0x0000000001C52000-memory.dmpFilesize
8KB
-
memory/1012-17-0x0000000001C50000-0x0000000001C52000-memory.dmpFilesize
8KB
-
memory/1012-11-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-10-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-21-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-22-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-23-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-24-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-25-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-27-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-28-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-30-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-87-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-3-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-41-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-36-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-38-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-35-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-44-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-45-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-47-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-49-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-51-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-52-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-53-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-61-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-62-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-63-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-64-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-65-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-69-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1012-72-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-74-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-1-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-31-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/1012-88-0x0000000001C50000-0x0000000001C52000-memory.dmpFilesize
8KB