Malware Analysis Report

2024-11-16 13:17

Sample ID 240518-vjexcadg57
Target 0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.exe
SHA256 a68ff706938fc2c3006b6829b4a3addfb69bfb89252811da70555b944041f06f
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a68ff706938fc2c3006b6829b4a3addfb69bfb89252811da70555b944041f06f

Threat Level: Known bad

The file 0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Windows security bypass

Sality

UAC bypass

Modifies firewall policy service

Executes dropped EXE

Windows security modification

UPX packed file

Loads dropped DLL

Enumerates connected drives

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-18 17:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 17:00

Reported

2024-05-18 17:03

Platform

win7-20240221-en

Max time kernel

118s

Max time network

124s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
File created C:\Windows\f770cae C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
File created C:\Windows\f76a4b8 C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1152 wrote to memory of 1772 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 1772 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 1772 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 1772 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 1772 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 1772 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 1772 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1772 wrote to memory of 2172 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe
PID 1772 wrote to memory of 2172 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe
PID 1772 wrote to memory of 2172 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe
PID 1772 wrote to memory of 2172 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe
PID 2172 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\system32\taskhost.exe
PID 2172 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\system32\Dwm.exe
PID 2172 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\Explorer.EXE
PID 2172 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\system32\DllHost.exe
PID 2172 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\system32\rundll32.exe
PID 2172 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\SysWOW64\rundll32.exe
PID 2172 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\SysWOW64\rundll32.exe
PID 1772 wrote to memory of 2472 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76a67c.exe
PID 1772 wrote to memory of 2472 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76a67c.exe
PID 1772 wrote to memory of 2472 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76a67c.exe
PID 1772 wrote to memory of 2472 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76a67c.exe
PID 1772 wrote to memory of 2624 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe
PID 1772 wrote to memory of 2624 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe
PID 1772 wrote to memory of 2624 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe
PID 1772 wrote to memory of 2624 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe
PID 2172 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\system32\taskhost.exe
PID 2172 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\system32\Dwm.exe
PID 2172 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Windows\Explorer.EXE
PID 2172 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Users\Admin\AppData\Local\Temp\f76a67c.exe
PID 2172 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Users\Admin\AppData\Local\Temp\f76a67c.exe
PID 2172 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe
PID 2172 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe
PID 2624 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe C:\Windows\system32\taskhost.exe
PID 2624 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe C:\Windows\system32\Dwm.exe
PID 2624 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.dll,#1

C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe

C:\Users\Admin\AppData\Local\Temp\f76a3dd.exe

C:\Users\Admin\AppData\Local\Temp\f76a67c.exe

C:\Users\Admin\AppData\Local\Temp\f76a67c.exe

C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe

C:\Users\Admin\AppData\Local\Temp\f76bdc3.exe

Network

N/A

Files

memory/1772-1-0x0000000010000000-0x0000000010020000-memory.dmp

\Users\Admin\AppData\Local\Temp\f76a3dd.exe

MD5 c47dd693d8ca9e213f2bd7e4d1312d86
SHA1 cdbe66be963bc7aeb0989fbe11f9ef3376063720
SHA256 47648b9fd2462abbd0563361a19c05b47659dd3da5c0c4f269214c237cd5fac3
SHA512 6d2f6631b2694aadd76172b5335a326b47dc1cabe38b5ca44fd40a8311934cc55abb631deb1801c47fb1130cb1ee17b2b420e30f0950d9f5ef1524e5e5b4d297

memory/1772-8-0x0000000000170000-0x0000000000182000-memory.dmp

memory/2172-10-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2172-11-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/1772-31-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/1772-41-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/1772-49-0x00000000001C0000-0x00000000001C2000-memory.dmp

memory/2172-16-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2472-53-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1772-51-0x00000000001C0000-0x00000000001C2000-memory.dmp

memory/1180-21-0x0000000001B40000-0x0000000001B42000-memory.dmp

memory/2172-13-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-20-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-17-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-24-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-18-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-15-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-14-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/1772-50-0x0000000000790000-0x00000000007A2000-memory.dmp

memory/2172-40-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/1772-30-0x00000000001C0000-0x00000000001C2000-memory.dmp

memory/2172-59-0x0000000000390000-0x0000000000392000-memory.dmp

memory/2172-19-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-60-0x0000000000390000-0x0000000000392000-memory.dmp

memory/2172-61-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-62-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-63-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-65-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-64-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2624-80-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1772-78-0x0000000000170000-0x0000000000176000-memory.dmp

memory/1772-75-0x00000000001C0000-0x00000000001C2000-memory.dmp

memory/2172-67-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-81-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-83-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-84-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-85-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2624-100-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2624-99-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2472-93-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/2472-94-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2624-104-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2472-103-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2172-106-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2172-105-0x0000000000700000-0x00000000017BA000-memory.dmp

memory/2472-148-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2172-147-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2172-146-0x0000000000700000-0x00000000017BA000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 8a0c03f9fcd1228d07159c0d22bde3ad
SHA1 216f8abc9efed497ab3d1a90e4367939fce07b34
SHA256 5b7fa12b3bc92692b830080b83150ad3e19b5b124c995295b5d0e992cbd833b4
SHA512 8319f53cf899f3d8018d70a991be8f07c4741351aa9e231eb46374884aea6b767dde070d4e9eafc3c1226ce45bc880778fa32fbbe986d65f6269c442c6336576

memory/2624-184-0x0000000000990000-0x0000000001A4A000-memory.dmp

memory/2624-183-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2624-185-0x0000000000990000-0x0000000001A4A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-18 17:00

Reported

2024-05-18 17:03

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e572f8c C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
File created C:\Windows\e577fbf C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2356 wrote to memory of 3856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2356 wrote to memory of 3856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2356 wrote to memory of 3856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3856 wrote to memory of 4580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e572f4d.exe
PID 3856 wrote to memory of 4580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e572f4d.exe
PID 3856 wrote to memory of 4580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e572f4d.exe
PID 4580 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\fontdrvhost.exe
PID 4580 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\fontdrvhost.exe
PID 4580 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\dwm.exe
PID 4580 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\sihost.exe
PID 4580 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\svchost.exe
PID 4580 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\taskhostw.exe
PID 4580 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\Explorer.EXE
PID 4580 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\svchost.exe
PID 4580 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\DllHost.exe
PID 4580 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4580 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\System32\RuntimeBroker.exe
PID 4580 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4580 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\System32\RuntimeBroker.exe
PID 4580 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4580 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\System32\RuntimeBroker.exe
PID 4580 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4580 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4580 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\rundll32.exe
PID 4580 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\SysWOW64\rundll32.exe
PID 4580 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\SysWOW64\rundll32.exe
PID 3856 wrote to memory of 684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e573076.exe
PID 3856 wrote to memory of 684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e573076.exe
PID 3856 wrote to memory of 684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e573076.exe
PID 3856 wrote to memory of 2636 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e574b32.exe
PID 3856 wrote to memory of 2636 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e574b32.exe
PID 3856 wrote to memory of 2636 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e574b32.exe
PID 4580 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\fontdrvhost.exe
PID 4580 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\fontdrvhost.exe
PID 4580 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\dwm.exe
PID 4580 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\sihost.exe
PID 4580 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\svchost.exe
PID 4580 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\taskhostw.exe
PID 4580 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\Explorer.EXE
PID 4580 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\svchost.exe
PID 4580 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\DllHost.exe
PID 4580 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4580 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\System32\RuntimeBroker.exe
PID 4580 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4580 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\System32\RuntimeBroker.exe
PID 4580 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4580 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\System32\RuntimeBroker.exe
PID 4580 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4580 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Users\Admin\AppData\Local\Temp\e573076.exe
PID 4580 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Users\Admin\AppData\Local\Temp\e573076.exe
PID 4580 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\System32\RuntimeBroker.exe
PID 4580 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Windows\System32\RuntimeBroker.exe
PID 4580 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Users\Admin\AppData\Local\Temp\e574b32.exe
PID 4580 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\e572f4d.exe C:\Users\Admin\AppData\Local\Temp\e574b32.exe
PID 2636 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\system32\fontdrvhost.exe
PID 2636 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\system32\fontdrvhost.exe
PID 2636 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\system32\dwm.exe
PID 2636 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\system32\sihost.exe
PID 2636 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\system32\svchost.exe
PID 2636 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\system32\taskhostw.exe
PID 2636 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\Explorer.EXE
PID 2636 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\system32\svchost.exe
PID 2636 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\system32\DllHost.exe
PID 2636 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\e574b32.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e572f4d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e574b32.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b76861c541b49745b9bf714a0bdd660_NeikiAnalytics.dll,#1

C:\Users\Admin\AppData\Local\Temp\e572f4d.exe

C:\Users\Admin\AppData\Local\Temp\e572f4d.exe

C:\Users\Admin\AppData\Local\Temp\e573076.exe

C:\Users\Admin\AppData\Local\Temp\e573076.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\e574b32.exe

C:\Users\Admin\AppData\Local\Temp\e574b32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.105:443 www.bing.com tcp
US 8.8.8.8:53 216.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 105.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
BE 2.17.196.105:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.89.16.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\e572f4d.exe

MD5 c47dd693d8ca9e213f2bd7e4d1312d86
SHA1 cdbe66be963bc7aeb0989fbe11f9ef3376063720
SHA256 47648b9fd2462abbd0563361a19c05b47659dd3da5c0c4f269214c237cd5fac3
SHA512 6d2f6631b2694aadd76172b5335a326b47dc1cabe38b5ca44fd40a8311934cc55abb631deb1801c47fb1130cb1ee17b2b420e30f0950d9f5ef1524e5e5b4d297

memory/3856-1-0x0000000010000000-0x0000000010020000-memory.dmp

memory/4580-5-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4580-6-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-11-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-29-0x0000000000730000-0x0000000000732000-memory.dmp

memory/4580-18-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-27-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-30-0x0000000000850000-0x000000000190A000-memory.dmp

memory/684-35-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4580-34-0x0000000000730000-0x0000000000732000-memory.dmp

memory/3856-33-0x0000000000CB0000-0x0000000000CB2000-memory.dmp

memory/4580-12-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-10-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-9-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-28-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3856-24-0x0000000000CB0000-0x0000000000CB2000-memory.dmp

memory/4580-23-0x0000000000740000-0x0000000000741000-memory.dmp

memory/3856-21-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

memory/3856-20-0x0000000000CB0000-0x0000000000CB2000-memory.dmp

memory/4580-19-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-36-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-37-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-38-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-39-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-40-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-42-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-43-0x0000000000850000-0x000000000190A000-memory.dmp

memory/2636-51-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4580-53-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-54-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-55-0x0000000000850000-0x000000000190A000-memory.dmp

memory/684-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/2636-64-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/2636-61-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/2636-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/684-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/684-58-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/4580-65-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-67-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-70-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-72-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-74-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-77-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-76-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-80-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-82-0x0000000000850000-0x000000000190A000-memory.dmp

memory/4580-91-0x0000000000730000-0x0000000000732000-memory.dmp

memory/4580-86-0x0000000000850000-0x000000000190A000-memory.dmp

memory/684-106-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 52135f89e8081e6107046f17e7f510df
SHA1 805c2ffa6761b425afb884ec8b409ce96596c3f9
SHA256 65c8a46f8370bdafe4543cba76a4ccb01f10dd217a3fc2455ecc2094a735f89b
SHA512 40e785f67975c29537b9b695fe77a96b3ba530e05bfd593e7d3896c129f4192e05df6582c17527553899ad47de088b9e61f2e806d4f2666d2d25d4bbf04b9dca

memory/2636-123-0x0000000000B40000-0x0000000001BFA000-memory.dmp

memory/4580-102-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2636-151-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2636-150-0x0000000000B40000-0x0000000001BFA000-memory.dmp