Analysis
-
max time kernel
121s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 23:16
Static task
static1
Behavioral task
behavioral1
Sample
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe
-
Size
4.8MB
-
MD5
54ac82d747c7289f1ccbe0d34ec4e540
-
SHA1
0951c7f9d9b113a7e8acfc3b718dbfdd2010a72f
-
SHA256
38664597316cbc3770140cfca4b5ad3ee9355760ff9ea788f1355d43c9fdb95a
-
SHA512
46d92dd68ac1164086d6e960626c2e5a55a3eb6dfdafcb7cb8b26e95287be41ae466693ba820e58b188b899968d8611ce202deffbd6b1e417b2b00bb3fd9c0e6
-
SSDEEP
98304:DsPj6quMBYyuSFOMKykvYgS/ylTpHufHMpPbOZ39c7T3eeom2vJtPShU:APjzayuSgMKykQgSaTkvMxEYT3OfPShU
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
Setup.exepid process 1852 Setup.exe -
Loads dropped DLL 5 IoCs
Processes:
Setup.exepid process 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe -
Processes:
resource yara_rule behavioral2/memory/2612-1-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-7-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-8-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-18-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-19-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-20-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-22-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-21-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-11-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-3-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-110-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-109-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-141-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-142-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-143-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-145-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-146-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-148-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-149-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-151-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-156-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-158-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-161-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-163-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-165-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-167-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-168-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-171-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-173-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-175-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-177-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-179-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-182-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-184-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-192-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-194-0x0000000002900000-0x00000000039BA000-memory.dmp upx behavioral2/memory/2612-196-0x0000000002900000-0x00000000039BA000-memory.dmp upx -
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\V: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\Y: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\H: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\N: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\S: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\L: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\M: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\P: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\Q: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\E: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\G: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\I: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\U: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\X: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\K: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\O: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\T: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\Z: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\J: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\R: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened (read-only) \??\W: 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process File opened for modification F:\autorun.inf 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\autorun.inf 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Drops file in Program Files directory 12 IoCs
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe File created C:\Windows\e5738d3 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exeSetup.exepid process 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 1852 Setup.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Token: SeDebugPrivilege 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription pid process target process PID 2612 wrote to memory of 792 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe fontdrvhost.exe PID 2612 wrote to memory of 800 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe fontdrvhost.exe PID 2612 wrote to memory of 468 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe dwm.exe PID 2612 wrote to memory of 2712 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe sihost.exe PID 2612 wrote to memory of 2780 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe svchost.exe PID 2612 wrote to memory of 2956 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe taskhostw.exe PID 2612 wrote to memory of 3440 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Explorer.EXE PID 2612 wrote to memory of 3584 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe svchost.exe PID 2612 wrote to memory of 3760 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe DllHost.exe PID 2612 wrote to memory of 3848 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2612 wrote to memory of 3916 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 4008 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe SearchApp.exe PID 2612 wrote to memory of 4192 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 4240 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe TextInputHost.exe PID 2612 wrote to memory of 1876 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 4832 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe backgroundTaskHost.exe PID 2612 wrote to memory of 4880 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe backgroundTaskHost.exe PID 2612 wrote to memory of 1852 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Setup.exe PID 2612 wrote to memory of 1852 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Setup.exe PID 2612 wrote to memory of 1852 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Setup.exe PID 2612 wrote to memory of 792 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe fontdrvhost.exe PID 2612 wrote to memory of 800 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe fontdrvhost.exe PID 2612 wrote to memory of 468 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe dwm.exe PID 2612 wrote to memory of 2712 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe sihost.exe PID 2612 wrote to memory of 2780 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe svchost.exe PID 2612 wrote to memory of 2956 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe taskhostw.exe PID 2612 wrote to memory of 3440 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Explorer.EXE PID 2612 wrote to memory of 3584 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe svchost.exe PID 2612 wrote to memory of 3760 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe DllHost.exe PID 2612 wrote to memory of 3848 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2612 wrote to memory of 3916 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 4008 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe SearchApp.exe PID 2612 wrote to memory of 4192 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 4240 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe TextInputHost.exe PID 2612 wrote to memory of 1876 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 4832 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe backgroundTaskHost.exe PID 2612 wrote to memory of 1852 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Setup.exe PID 2612 wrote to memory of 1852 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Setup.exe PID 2612 wrote to memory of 4152 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 5124 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 792 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe fontdrvhost.exe PID 2612 wrote to memory of 800 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe fontdrvhost.exe PID 2612 wrote to memory of 468 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe dwm.exe PID 2612 wrote to memory of 2712 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe sihost.exe PID 2612 wrote to memory of 2780 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe svchost.exe PID 2612 wrote to memory of 2956 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe taskhostw.exe PID 2612 wrote to memory of 3440 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe Explorer.EXE PID 2612 wrote to memory of 3584 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe svchost.exe PID 2612 wrote to memory of 3760 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe DllHost.exe PID 2612 wrote to memory of 3848 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2612 wrote to memory of 3916 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 4008 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe SearchApp.exe PID 2612 wrote to memory of 4192 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 4240 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe TextInputHost.exe PID 2612 wrote to memory of 1876 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 4832 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe backgroundTaskHost.exe PID 2612 wrote to memory of 4152 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 5124 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe RuntimeBroker.exe PID 2612 wrote to memory of 792 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe fontdrvhost.exe PID 2612 wrote to memory of 800 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe fontdrvhost.exe PID 2612 wrote to memory of 468 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe dwm.exe PID 2612 wrote to memory of 2712 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe sihost.exe PID 2612 wrote to memory of 2780 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe svchost.exe PID 2612 wrote to memory of 2956 2612 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe taskhostw.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
\??\c:\cc19ef387239666029231fc7c7\Setup.exec:\cc19ef387239666029231fc7c7\Setup.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0E573A3A_Rar\54ac82d747c7289f1ccbe0d34ec4e540_NeikiAnalytics.exeFilesize
4.8MB
MD5cede02d7af62449a2c38c49abecc0cd3
SHA1b84b83a8a6741a17bfb5f3578b983c1de512589d
SHA25666b797b3b4f99488f53c2b676610dfe9868984c779536891a8d8f73ee214bc4b
SHA512d2d99e06d49a5990b449cf31d82a33104a6b45164e76fbeb34c43d10bcd25c3622af52e59a2d4b7f5f45f83c3ba4d23cf1a5fc0c03b3606f42426988e63a9770
-
C:\Users\Admin\AppData\Local\Temp\HFI3D29.tmp.htmlFilesize
17KB
MD5a54bf0a83e7b3c82cf5225aab4c3f0fd
SHA1d6363f213c804783c043b123e1cdad961acf9a87
SHA2561a2accb4a336c83d73aae6e0acd7902c4a9fecf39186f69f8da6a0567780424b
SHA5120133d8cffae00162e8ea45677680a4307bb90392bc10470f329ace8bf1c982b00a483bae16d6c237f93c725791824c4f5c51b5f378a2fe90617a5fe5f2e239ee
-
C:\cc19ef387239666029231fc7c7\1033\SetupResources.dllFilesize
16KB
MD5718ab3eb3f43c9bcf16276c1eb17f2c1
SHA1a3091fd7784a9469309b3edb370e24a0323e30ac
SHA256e1a13f5b763d73271a1a205a88e64c6611c25d5f434cfa5da14feb8e4272ffaa
SHA5129fa8a8d9645a9b490257c2dce3d31f1585f6d6069f9471f9e00dfaa9e457ff1db4c9176a91e02d7f0b61bae0c1fc76b56061eff04888a58aeb5ad2e8692fcf8a
-
C:\cc19ef387239666029231fc7c7\Setup.exeFilesize
76KB
MD59a1141fbceeb2e196ae1ba115fd4bee6
SHA1922eacb654f091bc609f1b7f484292468d046bd1
SHA25628563d908450eb7b7e9ed07a934e0d68135b5bb48e866e0a1c913bd776a44fef
SHA512b044600acb16fc3be991d8a6dbc75c2ca45d392e66a4d19eacac4aee282d2ada0d411d832b76d25ef505cc542c7fa1fdb7098da01f84034f798b08baa4796168
-
C:\cc19ef387239666029231fc7c7\SetupUi.dllFilesize
288KB
MD5c744ec120e54027c57318c4720b4d6be
SHA1ab65fc4e68ad553520af049129fae4f88c7eff74
SHA256d1610b0a94a4dadc85ee32a7e5ffd6533ea42347d6f2d6871beb03157b89a857
SHA5126dcd0ab7b8671e17d1c15db030ee5349ab3a123595c546019cf9391ce05f9f63806149c3ec2f2c71635cb811ab65ad47bcd7031e2eff7a59059577e47dd600a7
-
F:\tamix.pifFilesize
97KB
MD56a9d0d4a5708081a37bd966547369c58
SHA18d89eff3594e335572644e5c7c2dfe5ed50e9de6
SHA256c9d9ef1bece782a359e87762890280528112332fe649ff04b9de948691e78337
SHA51220588b06e81009100348651ee8fcb279c599bc976570d8b149475be2c4b16dbf153eaa4ac222b4a3f6a23d1f781d7ceb05e2bb2632befc4e0c8ac15c9352a7b1
-
\??\c:\cc19ef387239666029231fc7c7\1028\LocalizedData.xmlFilesize
29KB
MD57fc06a77d9aafca9fb19fafa0f919100
SHA1e565740e7d582cd73f8d3b12de2f4579ff18bb41
SHA256a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a
SHA512466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf
-
\??\c:\cc19ef387239666029231fc7c7\1031\LocalizedData.xmlFilesize
40KB
MD5b83c3803712e61811c438f6e98790369
SHA161a0bc59388786ced045acd82621bee8578cae5a
SHA2562aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6
SHA512e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38
-
\??\c:\cc19ef387239666029231fc7c7\1033\LocalizedData.xmlFilesize
38KB
MD5d642e322d1e8b739510ca540f8e779f9
SHA136279c76d9f34c09ebddc84fd33fcc7d4b9a896c
SHA2565d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9
SHA512e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d
-
\??\c:\cc19ef387239666029231fc7c7\1036\LocalizedData.xmlFilesize
40KB
MD5e382abc19294f779d2833287242e7bc6
SHA11ceae32d6b24a3832f9244f5791382865b668a72
SHA25643f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf
SHA51206054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e
-
\??\c:\cc19ef387239666029231fc7c7\1040\LocalizedData.xmlFilesize
39KB
MD50af948fe4142e34092f9dd47a4b8c275
SHA1b3d6dd5c126280398d9055f90e2c2c26dbae4eaa
SHA256c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248
SHA512d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9
-
\??\c:\cc19ef387239666029231fc7c7\1041\LocalizedData.xmlFilesize
33KB
MD57fcfbc308b0c42dcbd8365ba62bada05
SHA118a0f0e89b36818c94de0ad795cc593d0e3e29a9
SHA25601e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2
SHA512cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649
-
\??\c:\cc19ef387239666029231fc7c7\1042\LocalizedData.xmlFilesize
32KB
MD571dfd70ae141f1d5c1366cb661b354b2
SHA1c4b22590e6f6dd5d39e5158b831ae217ce17a776
SHA256cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331
SHA5125000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a
-
\??\c:\cc19ef387239666029231fc7c7\1049\LocalizedData.xmlFilesize
39KB
MD50eeb554d0b9f9fcdb22401e2532e9cd0
SHA108799520b72a1ef92ac5b94a33509d1eddf6caf8
SHA256beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c
SHA5122180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d
-
\??\c:\cc19ef387239666029231fc7c7\2052\LocalizedData.xmlFilesize
30KB
MD552b1dc12ce4153aa759fb3bbe04d01fc
SHA1bf21f8591c473d1fce68a9faf1e5942f486f6eba
SHA256d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3
SHA512418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623
-
\??\c:\cc19ef387239666029231fc7c7\3082\LocalizedData.xmlFilesize
39KB
MD55397a12d466d55d566b4209e0e4f92d3
SHA1fcffd8961fb487995543fc173521fdf5df6e243b
SHA256f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89
SHA5127708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b
-
\??\c:\cc19ef387239666029231fc7c7\DHTMLHeader.htmlFilesize
15KB
MD5cd131d41791a543cc6f6ed1ea5bd257c
SHA1f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA256e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
SHA512a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
-
\??\c:\cc19ef387239666029231fc7c7\ParameterInfo.xmlFilesize
8KB
MD546db5d342d306778cab61e413a84fece
SHA1d0885ae1f706e014015cacb0cd67ca786d0962c2
SHA256227bd903261486663665ba232b753781bafd7afba68b5614ad93d6d1f5a1e16b
SHA5125de734ce86888ae41db113be13b8b6652f67de8e7ff0dc062a3e217e078ccafacf44117bbfff6e26d6c7e4fa369855e87b4926e9bdfa96f466a89a9d9c67a5bc
-
\??\c:\cc19ef387239666029231fc7c7\SetupEngine.dllFilesize
789KB
MD5a030c6b93740cbaa232ffaa08ccd3396
SHA16f7236a30308fbf02d88e228f0b5b5ec7f61d3eb
SHA2560507720d52ae856bbf5ff3f01172a390b6c19517cb95514cd53f4a59859e8d63
SHA5126787195b7e693744ce3b70c3b3ef04eaf81c39621e33d9f40b9c52f1a2c1d6094eceaebbc9b2906649351f5fc106eed085cef71bb606a9dc7890eafd200cfd42
-
\??\c:\cc19ef387239666029231fc7c7\SetupUi.xsdFilesize
29KB
MD52fadd9e618eff8175f2a6e8b95c0cacc
SHA19ab1710a217d15b192188b19467932d947b0a4f8
SHA256222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
SHA512a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca
-
\??\c:\cc19ef387239666029231fc7c7\Strings.xmlFilesize
13KB
MD5332adf643747297b9bfa9527eaefe084
SHA1670f933d778eca39938a515a39106551185205e9
SHA256e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca
SHA512bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0
-
\??\c:\cc19ef387239666029231fc7c7\UiInfo.xmlFilesize
35KB
MD54f90fcef3836f5fc49426ad9938a1c60
SHA189eba3b81982d5d5c457ffa7a7096284a10de64a
SHA25666a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b
SHA5124ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160
-
\??\c:\cc19ef387239666029231fc7c7\graphics\print.icoFilesize
1KB
MD57e55ddc6d611176e697d01c90a1212cf
SHA1e2620da05b8e4e2360da579a7be32c1b225deb1b
SHA256ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
SHA512283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e
-
\??\c:\cc19ef387239666029231fc7c7\graphics\save.icoFilesize
1KB
MD57d62e82d960a938c98da02b1d5201bd5
SHA1194e96b0440bf8631887e5e9d3cc485f8e90fbf5
SHA256ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
SHA512ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67
-
\??\c:\cc19ef387239666029231fc7c7\graphics\setup.icoFilesize
35KB
MD53d25d679e0ff0b8c94273dcd8b07049d
SHA1a517fc5e96bc68a02a44093673ee7e076ad57308
SHA256288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
SHA5123bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255
-
\??\c:\cc19ef387239666029231fc7c7\header.bmpFilesize
7KB
MD53ad1a8c3b96993bcdf45244be2c00eef
SHA1308f98e199f74a43d325115a8e7072d5f2c6202d
SHA256133b86a4f1c67a159167489fdaeab765bfa1050c23a7ae6d5c517188fb45f94a
SHA512133442c4a65269f817675adf01adcf622e509aa7ec7583bca8cd9a7eb6018d2aab56066054f75657038efb947cd3b3e5dc4fe7f0863c8b3b1770a8fa4fe2e658
-
\??\c:\cc19ef387239666029231fc7c7\sqmapi.dllFilesize
141KB
MD53f0363b40376047eff6a9b97d633b750
SHA14eaf6650eca5ce931ee771181b04263c536a948b
SHA256bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
SHA512537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
-
\??\c:\cc19ef387239666029231fc7c7\watermark.bmpFilesize
301KB
MD51a5caafacfc8c7766e404d019249cf67
SHA135d4878db63059a0f25899f4be00b41f430389bf
SHA2562e87d5742413254db10f7bd0762b6cdb98ff9c46ca9acddfd9b1c2e5418638f2
SHA512202c13ded002d234117f08b18ca80d603246e6a166e18ba422e30d394ada7e47153dd3cce9728affe97128fdd797fe6302c74dc6882317e2ba254c8a6db80f46
-
memory/1852-154-0x0000000002DA0000-0x0000000002DA2000-memory.dmpFilesize
8KB
-
memory/1852-155-0x0000000002DA0000-0x0000000002DA2000-memory.dmpFilesize
8KB
-
memory/1852-153-0x0000000002DB0000-0x0000000002DB1000-memory.dmpFilesize
4KB
-
memory/1852-186-0x0000000002D80000-0x0000000002D81000-memory.dmpFilesize
4KB
-
memory/1852-140-0x0000000002D80000-0x0000000002D81000-memory.dmpFilesize
4KB
-
memory/2612-141-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-3-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-23-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/2612-22-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-20-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-19-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-18-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-10-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/2612-8-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-7-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-109-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-110-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-11-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-142-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-143-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-145-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-146-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-148-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-149-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-151-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-12-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/2612-21-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-9-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/2612-156-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-158-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-161-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-163-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-165-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-167-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-168-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-171-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-173-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-175-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-177-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-179-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-181-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/2612-182-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-184-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-0-0x0000000001000000-0x00000000014E8000-memory.dmpFilesize
4.9MB
-
memory/2612-192-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-194-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-196-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB
-
memory/2612-1-0x0000000002900000-0x00000000039BA000-memory.dmpFilesize
16.7MB