Analysis
-
max time kernel
22s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 08:05
Static task
static1
Behavioral task
behavioral1
Sample
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe
-
Size
1.8MB
-
MD5
22c3b92d4a7b00c09b9a01dc41c5484f
-
SHA1
a68380980141c691745c3079b84269a7fc571a79
-
SHA256
13c4cb31e54f93e0a642d03cfec51b59c1f99a735b82771e60d0c309d4fda40a
-
SHA512
bf7fd781ca0d30849989e633a1d94ac3899b9e07014affde0140002ea001f0817230ccd61803c93620879d8eb764b1d3e723bbac6e37bbf4ae73295edac0ee51
-
SSDEEP
49152:2BHTZQBIGoA5nN9615Z9VTNIeUOPI5E33uLkv4:2JZgoiN9615YeUfauYv4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exeireA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ireA.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ireA.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ireA.exe -
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exeireA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ireA.exe -
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exeireA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ireA.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\ireA.exe aspack_v212_v242 -
Deletes itself 1 IoCs
Processes:
ireA.exepid process 1972 ireA.exe -
Executes dropped EXE 1 IoCs
Processes:
ireA.exepid process 1972 ireA.exe -
Processes:
resource yara_rule behavioral2/memory/4932-1-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-4-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-17-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-22-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-21-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-23-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-11-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-10-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-34-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-9-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/1972-53-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-58-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-56-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-59-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-55-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-62-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-54-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-51-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-57-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-60-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-65-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-66-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-77-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-78-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-79-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-81-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-82-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-83-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-86-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-87-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-95-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-98-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-100-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-102-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-112-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-114-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-117-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-148-0x0000000006120000-0x00000000071AE000-memory.dmp upx -
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exeireA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ireA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ireA.exe -
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exeireA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ireA.exe -
Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ireA.exedescription ioc process File opened (read-only) \??\I: ireA.exe File opened (read-only) \??\J: ireA.exe File opened (read-only) \??\K: ireA.exe File opened (read-only) \??\L: ireA.exe File opened (read-only) \??\E: ireA.exe File opened (read-only) \??\G: ireA.exe File opened (read-only) \??\H: ireA.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ireA.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe ireA.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE ireA.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe ireA.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe ireA.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe ireA.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe ireA.exe -
Drops file in Windows directory 1 IoCs
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exeireA.exepid process 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 1972 ireA.exe 1972 ireA.exe 1972 ireA.exe 1972 ireA.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exepid process 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exeireA.exedescription pid process target process PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe ireA.exe PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe ireA.exe PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe ireA.exe PID 4932 wrote to memory of 756 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe fontdrvhost.exe PID 4932 wrote to memory of 764 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe fontdrvhost.exe PID 4932 wrote to memory of 336 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe dwm.exe PID 4932 wrote to memory of 2912 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe sihost.exe PID 4932 wrote to memory of 2984 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe svchost.exe PID 4932 wrote to memory of 2848 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe taskhostw.exe PID 4932 wrote to memory of 3432 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Explorer.EXE PID 4932 wrote to memory of 3576 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe svchost.exe PID 4932 wrote to memory of 3756 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe DllHost.exe PID 4932 wrote to memory of 3856 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 4932 wrote to memory of 3920 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe RuntimeBroker.exe PID 4932 wrote to memory of 4004 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe SearchApp.exe PID 4932 wrote to memory of 3692 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe RuntimeBroker.exe PID 4932 wrote to memory of 1904 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe TextInputHost.exe PID 4932 wrote to memory of 4280 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe RuntimeBroker.exe PID 4932 wrote to memory of 4172 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe backgroundTaskHost.exe PID 4932 wrote to memory of 2528 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe backgroundTaskHost.exe PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe ireA.exe PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe ireA.exe PID 1972 wrote to memory of 756 1972 ireA.exe fontdrvhost.exe PID 1972 wrote to memory of 764 1972 ireA.exe fontdrvhost.exe PID 1972 wrote to memory of 336 1972 ireA.exe dwm.exe PID 1972 wrote to memory of 2912 1972 ireA.exe sihost.exe PID 1972 wrote to memory of 2984 1972 ireA.exe svchost.exe PID 1972 wrote to memory of 2848 1972 ireA.exe taskhostw.exe PID 1972 wrote to memory of 3432 1972 ireA.exe Explorer.EXE PID 1972 wrote to memory of 3576 1972 ireA.exe svchost.exe PID 1972 wrote to memory of 3756 1972 ireA.exe DllHost.exe PID 1972 wrote to memory of 3856 1972 ireA.exe StartMenuExperienceHost.exe PID 1972 wrote to memory of 3920 1972 ireA.exe RuntimeBroker.exe PID 1972 wrote to memory of 4004 1972 ireA.exe SearchApp.exe PID 1972 wrote to memory of 3692 1972 ireA.exe RuntimeBroker.exe PID 1972 wrote to memory of 1904 1972 ireA.exe TextInputHost.exe PID 1972 wrote to memory of 4280 1972 ireA.exe RuntimeBroker.exe PID 1972 wrote to memory of 2528 1972 ireA.exe backgroundTaskHost.exe PID 1972 wrote to memory of 5048 1972 ireA.exe RuntimeBroker.exe PID 1972 wrote to memory of 4472 1972 ireA.exe RuntimeBroker.exe PID 1972 wrote to memory of 756 1972 ireA.exe fontdrvhost.exe PID 1972 wrote to memory of 764 1972 ireA.exe fontdrvhost.exe PID 1972 wrote to memory of 336 1972 ireA.exe dwm.exe PID 1972 wrote to memory of 2912 1972 ireA.exe sihost.exe PID 1972 wrote to memory of 2984 1972 ireA.exe svchost.exe PID 1972 wrote to memory of 2848 1972 ireA.exe taskhostw.exe PID 1972 wrote to memory of 3432 1972 ireA.exe Explorer.EXE PID 1972 wrote to memory of 3576 1972 ireA.exe svchost.exe PID 1972 wrote to memory of 3756 1972 ireA.exe DllHost.exe PID 1972 wrote to memory of 3856 1972 ireA.exe StartMenuExperienceHost.exe PID 1972 wrote to memory of 3920 1972 ireA.exe RuntimeBroker.exe PID 1972 wrote to memory of 4004 1972 ireA.exe SearchApp.exe PID 1972 wrote to memory of 3692 1972 ireA.exe RuntimeBroker.exe PID 1972 wrote to memory of 1904 1972 ireA.exe TextInputHost.exe PID 1972 wrote to memory of 4280 1972 ireA.exe RuntimeBroker.exe PID 1972 wrote to memory of 2528 1972 ireA.exe backgroundTaskHost.exe PID 1972 wrote to memory of 5048 1972 ireA.exe RuntimeBroker.exe PID 1972 wrote to memory of 4472 1972 ireA.exe RuntimeBroker.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exeireA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ireA.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\ireA.exeC:\Users\Admin\AppData\Local\Temp\ireA.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2efb64ab.bat" "4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NCVVYLW7\k2[1].rarFilesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
C:\Users\Admin\AppData\Local\Temp\2efb64ab.batFilesize
183B
MD5585f3ced36ac9f664c3e5e3fb54cd3ee
SHA13f4e743a92ba3c75ad85ebbfe77c460cadf113fb
SHA256c30e6a6d7f22acd0a640c42f8114fc812863f76db681518075b2f1ba099c6a9f
SHA51281e8d89531d729edbdf247dad4e1978ad3ed0a5e78bb61d6c5e2e3a38dab6cad2490d27ca39de2e51cca5a1d6570d416493afdf81a0888088216c48e937cbdc5
-
C:\Users\Admin\AppData\Local\Temp\75EE2519.exeFilesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
C:\Users\Admin\AppData\Local\Temp\ireA.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Windows\SYSTEM.INIFilesize
256B
MD5ee489fa138324db5e1a94c52a9413799
SHA1b2e8502e3b882018c5068972fbf8d43d1684a062
SHA256a628c6206c0bf9f4b0ac6a44e8f38640cae23f3791fe80623e379d59205f594c
SHA512fad2549978609b46008cf729177083cdedfd7cb7ac93555ac6b8c5576108d48c2965686e2599bb3b82c3bb1bd5dee6aa2b25b4b3355e63e68ba6811a3bb7bace
-
memory/1972-79-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-18-0x00000000007C0000-0x00000000007C9000-memory.dmpFilesize
36KB
-
memory/1972-54-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-148-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-61-0x00000000007C0000-0x00000000007C9000-memory.dmpFilesize
36KB
-
memory/1972-117-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-25-0x00000000030D0000-0x00000000030D2000-memory.dmpFilesize
8KB
-
memory/1972-116-0x00000000030D0000-0x00000000030D2000-memory.dmpFilesize
8KB
-
memory/1972-20-0x00000000030D0000-0x00000000030D2000-memory.dmpFilesize
8KB
-
memory/1972-114-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-112-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-102-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-16-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/1972-100-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-98-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-95-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-87-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-81-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-53-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-58-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-56-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-59-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-55-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-62-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-86-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-83-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-82-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-51-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-57-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-60-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-65-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-66-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-77-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/1972-78-0x0000000006120000-0x00000000071AE000-memory.dmpFilesize
16.6MB
-
memory/4932-9-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB
-
memory/4932-0-0x0000000000400000-0x00000000005CB000-memory.dmpFilesize
1.8MB
-
memory/4932-13-0x00000000006B0000-0x00000000006B2000-memory.dmpFilesize
8KB
-
memory/4932-11-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB
-
memory/4932-21-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB
-
memory/4932-17-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB
-
memory/4932-4-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB
-
memory/4932-14-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/4932-22-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB
-
memory/4932-19-0x00000000006B0000-0x00000000006B2000-memory.dmpFilesize
8KB
-
memory/4932-34-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB
-
memory/4932-37-0x0000000000400000-0x00000000005CB000-memory.dmpFilesize
1.8MB
-
memory/4932-24-0x00000000006B0000-0x00000000006B2000-memory.dmpFilesize
8KB
-
memory/4932-10-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB
-
memory/4932-23-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB
-
memory/4932-1-0x00000000023D0000-0x000000000345E000-memory.dmpFilesize
16.6MB