Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 06:36
Static task
static1
Behavioral task
behavioral1
Sample
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe
-
Size
65KB
-
MD5
a4666123c7a1d1cf7cf638e422427580
-
SHA1
e0e38edfdf00933902670513985f65e0adf448c4
-
SHA256
065140dc583932b91eede855166d1a9a8f6ab72e0b9dcc37d53b99f53a3fa363
-
SHA512
181da4c96afadc4007ed423a88bc2d24e29e17882d3c92cd8efbdef6122ec182647eeeec326fb212c0d6770d23496e90ed9b76d2f9794f5979e0d323c59f6af6
-
SSDEEP
1536:YAbGIEJb/TXtmM0FAVGVWacZRiNQomkivOV1hK0e:CIaz4MQAVQWacniOjfvF0e
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/2252-1-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-4-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-16-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-5-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-18-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-19-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-3-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-20-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-21-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-23-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-22-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-24-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-25-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-26-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-28-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-29-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-30-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-31-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-34-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-42-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-43-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-44-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-50-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-52-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-55-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-56-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-57-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-59-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-61-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-64-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-66-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-67-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-68-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-70-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2252-73-0x00000000007D0000-0x000000000188A000-memory.dmp upx -
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\M: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\O: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\R: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\S: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\T: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\Y: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\G: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\I: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\N: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\Q: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\V: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\W: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\E: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\L: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\K: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\X: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\P: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\U: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\Z: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\H: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened (read-only) \??\J: a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification F:\autorun.inf a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Drops file in Program Files directory 13 IoCs
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zFM.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process File created C:\Windows\e57e3d8 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exepid process 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Token: SeDebugPrivilege 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription pid process target process PID 2252 wrote to memory of 788 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe fontdrvhost.exe PID 2252 wrote to memory of 796 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe fontdrvhost.exe PID 2252 wrote to memory of 1020 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe dwm.exe PID 2252 wrote to memory of 2768 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe sihost.exe PID 2252 wrote to memory of 2816 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe svchost.exe PID 2252 wrote to memory of 3064 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe taskhostw.exe PID 2252 wrote to memory of 3436 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Explorer.EXE PID 2252 wrote to memory of 3568 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe svchost.exe PID 2252 wrote to memory of 3776 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe DllHost.exe PID 2252 wrote to memory of 3868 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2252 wrote to memory of 3932 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 4016 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe SearchApp.exe PID 2252 wrote to memory of 3460 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 2208 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 3852 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe TextInputHost.exe PID 2252 wrote to memory of 4928 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 3136 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 2100 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 3920 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 1064 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 2088 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe backgroundTaskHost.exe PID 2252 wrote to memory of 1352 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe backgroundTaskHost.exe PID 2252 wrote to memory of 788 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe fontdrvhost.exe PID 2252 wrote to memory of 796 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe fontdrvhost.exe PID 2252 wrote to memory of 1020 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe dwm.exe PID 2252 wrote to memory of 2768 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe sihost.exe PID 2252 wrote to memory of 2816 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe svchost.exe PID 2252 wrote to memory of 3064 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe taskhostw.exe PID 2252 wrote to memory of 3436 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Explorer.EXE PID 2252 wrote to memory of 3568 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe svchost.exe PID 2252 wrote to memory of 3776 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe DllHost.exe PID 2252 wrote to memory of 3868 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2252 wrote to memory of 3932 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 4016 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe SearchApp.exe PID 2252 wrote to memory of 3460 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 2208 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 3852 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe TextInputHost.exe PID 2252 wrote to memory of 4928 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 3136 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 2100 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 3920 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 1064 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 2088 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe backgroundTaskHost.exe PID 2252 wrote to memory of 1352 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe backgroundTaskHost.exe PID 2252 wrote to memory of 828 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 4804 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 4780 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 788 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe fontdrvhost.exe PID 2252 wrote to memory of 796 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe fontdrvhost.exe PID 2252 wrote to memory of 1020 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe dwm.exe PID 2252 wrote to memory of 2768 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe sihost.exe PID 2252 wrote to memory of 2816 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe svchost.exe PID 2252 wrote to memory of 3064 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe taskhostw.exe PID 2252 wrote to memory of 3436 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe Explorer.EXE PID 2252 wrote to memory of 3568 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe svchost.exe PID 2252 wrote to memory of 3776 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe DllHost.exe PID 2252 wrote to memory of 3868 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2252 wrote to memory of 3932 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 4016 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe SearchApp.exe PID 2252 wrote to memory of 3460 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 2208 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe RuntimeBroker.exe PID 2252 wrote to memory of 3852 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe TextInputHost.exe PID 2252 wrote to memory of 4928 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe PID 2252 wrote to memory of 3136 2252 a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe msedge.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2816
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3064
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a4666123c7a1d1cf7cf638e422427580_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3776
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3932
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3460
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2208
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3852
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:4928
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffdcbddceb8,0x7ffdcbddcec4,0x7ffdcbddced02⤵PID:3136
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2144,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:2100
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1964,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:32⤵PID:3920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1852,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:82⤵PID:1064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3916,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:82⤵PID:828
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2088
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1352
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4804
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4780
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2788
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\sxee.exeFilesize
97KB
MD5027b7ed82f3a1cd63df15e969cae14fe
SHA1b0ac4ba3758a052a2d6453416706e18e21544106
SHA256cfe709f15ad8b4de827f535cc87b403c8835c04902d1efa001f4ec9b23885ac3
SHA5123b9dcac1fb5b392bf5b8ba87fb1a1f575989b5c9a977bd4075e4c71488d9e9db99285eb4ce97b90fd6a5958e367c11500e6b8295dfd3fae91432fec3ebba43bf
-
memory/2252-31-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-67-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-8-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-17-0x0000000003AB0000-0x0000000003AB2000-memory.dmpFilesize
8KB
-
memory/2252-16-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-5-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-10-0x0000000003AB0000-0x0000000003AB2000-memory.dmpFilesize
8KB
-
memory/2252-7-0x0000000003D10000-0x0000000003D11000-memory.dmpFilesize
4KB
-
memory/2252-6-0x0000000003AB0000-0x0000000003AB2000-memory.dmpFilesize
8KB
-
memory/2252-18-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-9-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-19-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-3-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-20-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-21-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-23-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-22-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-24-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-25-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-26-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-28-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-29-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-76-0x0000000003AB0000-0x0000000003AB2000-memory.dmpFilesize
8KB
-
memory/2252-4-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-38-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-36-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-37-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-34-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-40-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-42-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-43-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-44-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-50-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-52-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-55-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-56-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-57-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-59-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-61-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-64-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-66-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2252-68-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-70-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-73-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-30-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2252-1-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB