Analysis
-
max time kernel
34s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 01:56
Static task
static1
Behavioral task
behavioral1
Sample
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe
-
Size
287KB
-
MD5
a2a935649fbc3eb38195bcb7f218b280
-
SHA1
7ec45138f71822932423c3a012acff793c681a7b
-
SHA256
3cd43564b5be851aa99978593a1be701004072a51112efbee18d9bac9cfb2d6e
-
SHA512
c1bb2562809b28faaf7bfce008d8884da16ac84d06d079ee116640ff27eee24d32e105cab6a3bb18931b7534bedf9963d49c35acb6ed3f8b76ffca04dcd95173
-
SSDEEP
6144:TvEa2U+T6i5LirrllHy4HUcMQY6Z27Ox0+Meyb:TEaN+T5xYrllrU7QY6Q7ObMV
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Processes:
explorer.exea2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe -
Processes:
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 2800 explorer.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 2800 explorer.exe 1144 spoolsv.exe 4288 svchost.exe 2576 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/1332-1-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-4-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-9-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-5-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-6-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-12-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-23-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-16-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-11-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-36-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-34-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/1332-56-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/2800-75-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-72-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-84-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-83-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-78-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-85-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-77-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-76-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-74-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-88-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-89-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-90-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-92-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-91-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-94-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-95-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-96-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-97-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-99-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-100-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-103-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-106-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/2800-107-0x0000000003510000-0x000000000459E000-memory.dmp upx -
Processes:
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Processes:
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exedescription ioc process File opened (read-only) \??\N: explorer.exe File opened (read-only) \??\P: explorer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\H: explorer.exe File opened (read-only) \??\K: explorer.exe File opened (read-only) \??\O: explorer.exe File opened (read-only) \??\I: explorer.exe File opened (read-only) \??\J: explorer.exe File opened (read-only) \??\L: explorer.exe File opened (read-only) \??\M: explorer.exe -
Drops file in Program Files directory 4 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe explorer.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe explorer.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe explorer.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe explorer.exe -
Drops file in Windows directory 6 IoCs
Processes:
explorer.exesvchost.exea2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\SYSTEM.INI a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\explorer.exe a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exeexplorer.exesvchost.exepid process 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 4288 svchost.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 4288 svchost.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe 2800 explorer.exe 4288 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 2800 explorer.exe 4288 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Token: SeDebugPrivilege 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe 2800 explorer.exe 2800 explorer.exe 1144 spoolsv.exe 1144 spoolsv.exe 4288 svchost.exe 4288 svchost.exe 2576 spoolsv.exe 2576 spoolsv.exe 2800 explorer.exe 2800 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 1332 wrote to memory of 776 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe fontdrvhost.exe PID 1332 wrote to memory of 780 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe fontdrvhost.exe PID 1332 wrote to memory of 1016 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe dwm.exe PID 1332 wrote to memory of 2652 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe sihost.exe PID 1332 wrote to memory of 2664 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe svchost.exe PID 1332 wrote to memory of 2864 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe taskhostw.exe PID 1332 wrote to memory of 3524 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Explorer.EXE PID 1332 wrote to memory of 3696 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe svchost.exe PID 1332 wrote to memory of 3876 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe DllHost.exe PID 1332 wrote to memory of 3980 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 1332 wrote to memory of 4084 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe RuntimeBroker.exe PID 1332 wrote to memory of 1360 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe SearchApp.exe PID 1332 wrote to memory of 4012 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe RuntimeBroker.exe PID 1332 wrote to memory of 4444 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe RuntimeBroker.exe PID 1332 wrote to memory of 3888 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe TextInputHost.exe PID 1332 wrote to memory of 1204 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe msedge.exe PID 1332 wrote to memory of 2776 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe msedge.exe PID 1332 wrote to memory of 1324 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe msedge.exe PID 1332 wrote to memory of 1516 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe msedge.exe PID 1332 wrote to memory of 1980 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe msedge.exe PID 1332 wrote to memory of 2344 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe backgroundTaskHost.exe PID 1332 wrote to memory of 3812 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe backgroundTaskHost.exe PID 1332 wrote to memory of 2800 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe explorer.exe PID 1332 wrote to memory of 2800 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe explorer.exe PID 1332 wrote to memory of 2800 1332 a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe explorer.exe PID 2800 wrote to memory of 1144 2800 explorer.exe spoolsv.exe PID 2800 wrote to memory of 1144 2800 explorer.exe spoolsv.exe PID 2800 wrote to memory of 1144 2800 explorer.exe spoolsv.exe PID 1144 wrote to memory of 4288 1144 spoolsv.exe svchost.exe PID 1144 wrote to memory of 4288 1144 spoolsv.exe svchost.exe PID 1144 wrote to memory of 4288 1144 spoolsv.exe svchost.exe PID 4288 wrote to memory of 2576 4288 svchost.exe spoolsv.exe PID 4288 wrote to memory of 2576 4288 svchost.exe spoolsv.exe PID 4288 wrote to memory of 2576 4288 svchost.exe spoolsv.exe PID 4288 wrote to memory of 1160 4288 svchost.exe at.exe PID 4288 wrote to memory of 1160 4288 svchost.exe at.exe PID 4288 wrote to memory of 1160 4288 svchost.exe at.exe PID 2800 wrote to memory of 776 2800 explorer.exe fontdrvhost.exe PID 2800 wrote to memory of 780 2800 explorer.exe fontdrvhost.exe PID 2800 wrote to memory of 1016 2800 explorer.exe dwm.exe PID 2800 wrote to memory of 2652 2800 explorer.exe sihost.exe PID 2800 wrote to memory of 2664 2800 explorer.exe svchost.exe PID 2800 wrote to memory of 2864 2800 explorer.exe taskhostw.exe PID 2800 wrote to memory of 3524 2800 explorer.exe Explorer.EXE PID 2800 wrote to memory of 3696 2800 explorer.exe svchost.exe PID 2800 wrote to memory of 3876 2800 explorer.exe DllHost.exe PID 2800 wrote to memory of 3980 2800 explorer.exe StartMenuExperienceHost.exe PID 2800 wrote to memory of 4084 2800 explorer.exe RuntimeBroker.exe PID 2800 wrote to memory of 1360 2800 explorer.exe SearchApp.exe PID 2800 wrote to memory of 4012 2800 explorer.exe RuntimeBroker.exe PID 2800 wrote to memory of 4444 2800 explorer.exe RuntimeBroker.exe PID 2800 wrote to memory of 3888 2800 explorer.exe TextInputHost.exe PID 2800 wrote to memory of 1204 2800 explorer.exe msedge.exe PID 2800 wrote to memory of 2776 2800 explorer.exe msedge.exe PID 2800 wrote to memory of 1324 2800 explorer.exe msedge.exe PID 2800 wrote to memory of 1516 2800 explorer.exe msedge.exe PID 2800 wrote to memory of 1980 2800 explorer.exe msedge.exe PID 2800 wrote to memory of 2344 2800 explorer.exe backgroundTaskHost.exe PID 2800 wrote to memory of 3812 2800 explorer.exe backgroundTaskHost.exe PID 2800 wrote to memory of 3488 2800 explorer.exe msedge.exe PID 2800 wrote to memory of 4288 2800 explorer.exe svchost.exe PID 2800 wrote to memory of 4288 2800 explorer.exe svchost.exe PID 2800 wrote to memory of 4056 2800 explorer.exe RuntimeBroker.exe PID 2800 wrote to memory of 3840 2800 explorer.exe RuntimeBroker.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1016
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2652
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2664
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2864
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2a935649fbc3eb38195bcb7f218b280_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1332 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Modifies Installed Components in the registry
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2800 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe5⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2576 -
C:\Windows\SysWOW64\at.exeat 01:59 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:1160
-
C:\Windows\SysWOW64\at.exeat 02:00 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:1136
-
C:\Windows\SysWOW64\at.exeat 02:01 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:4396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3696
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3876
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3980
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4084
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1360
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4444
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:1204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fffde21ceb8,0x7fffde21cec4,0x7fffde21ced02⤵PID:2776
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2276,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:22⤵PID:1324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1836,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:32⤵PID:1516
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1716,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:82⤵PID:1980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:82⤵PID:3488
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2344
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3812
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4056
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3840
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:4228
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\mrsys.exeFilesize
287KB
MD5da51f0e8085d45233a02f497efe87fe7
SHA1b8ddd947a109c34b0422f1ac12d1ca36644c8ade
SHA25657e35c91b2ec6a8257b38d63d7ccd4d02051f01781a82d21ff9c3246b9ab3b7e
SHA512c3345f0daf0446b178a582dc4dfa94f8711db45c4e326c20884674ec3df6e1163cf3cf2318a839f78ba2fc2826f6038ce37b0bcdc90a7053a7b7fd131ddc19c6
-
C:\Windows\SYSTEM.INIFilesize
257B
MD594ac2b31a3deb7e8bd3788427b49d36d
SHA1cbaa30ece8285df84dd26b65c3e0ea02510ed4e9
SHA2565dca9767e3cd5ca851fbf1530edfedeece6adc103f3e7bb4c606e0ab1a3dae1b
SHA512bf69080842f13800a4d609252b1b7f1968637ebbfcd7ec8a2c5c30876b021e2f30b74a47fa8d4323d528299239eab287582bd542c14d386d2105ca120477988e
-
C:\Windows\System\spoolsv.exeFilesize
287KB
MD5b89f234063f05fcc0bf7dfb298d6a18d
SHA15d85ab08a1131ea043d1292dfc23732d348e7ca6
SHA256bcf2bb847bbf5e8ab3d4465378ba82127cbc6cb036c76751697858d1618f5cc2
SHA5126505f5a87d90ada83988d0ca7dd35181407eae2f60744571d77e6711ca9b57d750c2c7370eb4783b26d871b50bba3fc628aacf3944a45287bb9c45b848f5dbac
-
C:\Windows\System\svchost.exeFilesize
287KB
MD5fee23d97c0eb8477ada49e8fb9fa4db5
SHA1e9d63ac46f5562c78d29f8cb830be0e9a5f8fab7
SHA256bb2d0ecb9f66cbf9655920e12897050e0f44f326aee13f8608578a3247538480
SHA512487465f84d5e32ecdf42b67ca8aa6a7118558dc4d7351d27f97921851a1f2f7530919f5179129c4876dfb8475cb9a2ff59fd7288addbf08948076b39b0ee8a40
-
C:\hgmrxm.pifFilesize
100KB
MD5ae5f05da4a99025e4aafc9e40122c0f7
SHA1ff1745a6dbb9006d7d6f3f358153e32b5b261b7c
SHA2567c38a5770718ef93287b5f553a53d4f68fcc8bdbe55cf0a68c7dcf6bdf5e45ef
SHA5124079627626056dadf2234f36ce50d77c5c699226f0508bf35a9fbebdf374e29989c7d03fbfea9de7d0c32efc3ee37906cc01bc3a0c9b6ac2f10561d4714c3a8b
-
\??\c:\windows\system\explorer.exeFilesize
287KB
MD551bdbab684d561260b2b1dc5473785ca
SHA1f66e2a30fae04be0eb5bec2c32545107d05ee7f6
SHA25626537b21b8118671cc092d308aa2aafc16b9efdfd1c120690163bc921478627b
SHA51281685acb0975edf15072265c76d784455fb6b63a38b80dd4180ab18508df802b8bd9ce617639a1f3fd5d1050c709963a00dd93ffb52c8e055b3f38ed95fc3aec
-
memory/1144-57-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1144-33-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1332-16-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-36-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-1-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-23-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-15-0x00000000047D0000-0x00000000047D2000-memory.dmpFilesize
8KB
-
memory/1332-12-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-0-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1332-11-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-13-0x00000000047D0000-0x00000000047D2000-memory.dmpFilesize
8KB
-
memory/1332-6-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-5-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-4-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-34-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-17-0x00000000047D0000-0x00000000047D2000-memory.dmpFilesize
8KB
-
memory/1332-9-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/1332-62-0x00000000047D0000-0x00000000047D2000-memory.dmpFilesize
8KB
-
memory/1332-14-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/1332-70-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1332-56-0x00000000029C0000-0x0000000003A4E000-memory.dmpFilesize
16.6MB
-
memory/2576-53-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2576-49-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2800-95-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-107-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-106-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-83-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-24-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2800-84-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-80-0x0000000003290000-0x0000000003291000-memory.dmpFilesize
4KB
-
memory/2800-86-0x00000000020F0000-0x00000000020F2000-memory.dmpFilesize
8KB
-
memory/2800-78-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-85-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-77-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-76-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-74-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-100-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-88-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-89-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-90-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-92-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-91-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-94-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-72-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-96-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-97-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-99-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-75-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/2800-103-0x0000000003510000-0x000000000459E000-memory.dmpFilesize
16.6MB
-
memory/4288-44-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/4288-82-0x0000000004010000-0x0000000004011000-memory.dmpFilesize
4KB
-
memory/4288-87-0x0000000002ED0000-0x0000000002ED2000-memory.dmpFilesize
8KB