Malware Analysis Report

2025-01-17 21:09

Sample ID 240603-n8akladg6x
Target a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe
SHA256 df6469992e7a082ab74f8eae1c235f25aac9fbee1ef549a30d0939a63c5ef80a
Tags
upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

df6469992e7a082ab74f8eae1c235f25aac9fbee1ef549a30d0939a63c5ef80a

Threat Level: Shows suspicious behavior

The file a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx

Executes dropped EXE

Deletes itself

Loads dropped DLL

UPX packed file

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-03 12:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 12:03

Reported

2024-06-03 12:06

Platform

win7-20240508-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2124 set thread context of 2692 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\wininit.exe
PID 1012 set thread context of 1628 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFss1.ini C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD C:\Windows\SysWOW64\wininit.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\wininit.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs5.ini C:\Windows\SysWOW64\wininit.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\ok.txt C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA C:\Windows\SysWOW64\wininit.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\wininit.exe N/A
File created C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\wininit.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs5.ini C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\$$.tmp C:\Windows\SysWOW64\wininit.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs1.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs1.ini C:\Windows\SysWOW64\wininit.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD C:\Windows\SysWOW64\wininit.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\$$.tmp C:\Windows\SysWOW64\wininit.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wininit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wininit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2124 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\wininit.exe
PID 2124 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\wininit.exe
PID 2124 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\wininit.exe
PID 2124 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\wininit.exe
PID 2124 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\wininit.exe
PID 2124 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\wininit.exe
PID 2140 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg
PID 2140 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg
PID 2140 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg
PID 2140 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg
PID 1012 wrote to memory of 1628 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1012 wrote to memory of 1628 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1012 wrote to memory of 1628 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1012 wrote to memory of 1628 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1012 wrote to memory of 1628 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1012 wrote to memory of 1628 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe"

C:\Windows\SysWOW64\wininit.exe

C:\Windows\System32\wininit.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 0

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 0

Network

Country Destination Domain Proto
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp

Files

memory/2124-2-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-3-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-7-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-5-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-13-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-11-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-9-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-15-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-27-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-21-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-29-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-25-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-23-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-19-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-17-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-33-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-32-0x0000000000220000-0x0000000000275000-memory.dmp

memory/2124-31-0x0000000000220000-0x0000000000275000-memory.dmp

\Windows\SysWOW64\kernel64.dll

MD5 9b98d47916ead4f69ef51b56b0c2323c
SHA1 290a80b4ded0efc0fd00816f373fcea81a521330
SHA256 96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA512 68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

memory/2692-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2692-69-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2692-70-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2692-73-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2692-74-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2692-75-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA

MD5 f697e0c5c1d34f00d1700d6d549d4811
SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

memory/2692-88-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-100-0x0000000000130000-0x0000000000185000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFmain.ini

MD5 d0c40a30a848f67d3af538767d04f66d
SHA1 07a61656a63e1ce45f6aee178ee69673a97dba61
SHA256 80e2a5f804a203137d28af84add8f08bfd6a21fdef628364692928dc9fbfefd5
SHA512 c2d5987068f74b8e31ac1c6861b75e65dc97653206737ddea24cb7a741c5cb500431ffe2987e39e20a91b284b8b597033e25b2bd146a315ac0cb95bb630216f5

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFss1.ini

MD5 2056c975629bc764596c2ba68ab3c6da
SHA1 35e3da93ce68d24c687e8c972f8fa2b903be75b8
SHA256 8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7
SHA512 c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

memory/2692-98-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-96-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-92-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-90-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-86-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-84-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-82-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-80-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-94-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-78-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2692-77-0x0000000000130000-0x0000000000185000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\ok.txt

MD5 4bcb288391556ba45a887ba5926390f8
SHA1 5c2341b12d5d761e53a1257ec46ea490ecbbc51c
SHA256 352d9f15ec52e995a4ca93bbd40d2236e5ae6e395e16c0e7e37e5ecaf1009083
SHA512 90d7a5f6b0d50b7f5a2f63e5b31ba2a0f97cdb016ee11dbac81bc8d155edb060355215dc93a02f910a88a5d92f3da8fe7874b5be82a1653f4ed788c44031dbca

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg

MD5 0ecadef2f398bd9e2098ae9d43c254f5
SHA1 d6ecbebd170a2749843c8cb175ef5a6f34f57e6e
SHA256 a03d7e126d268fe43ce379a317c7ddfb6a71544722c385c523836e2099962353
SHA512 f3dde0f37beeaef48ccc8b41607d803b67a50f930a09eeaa2caea36971a3a471e55a94cdad941573fffd86f9a60703abec31420392e82bc48a9133d260f99ff9

C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg

MD5 aa416764f97d47882381aa1fcc98be37
SHA1 157a898b2c5838de52c194a05379422298350f33
SHA256 e69a54616bfa2d81a1ff632b42c2661013e4b97417a29d2fab9277f5041781f5
SHA512 9e8a0cc390470940d139a3ad37ba314632ee4b0f0876a7602089783c7f13565bad886ec57c435706ba4062a13b1997635d61432e245097dd69d1b6ff2b001546

memory/1628-172-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2692-222-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1628-223-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 12:03

Reported

2024-06-03 12:06

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 644 set thread context of 4940 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1956 set thread context of 2472 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs1.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFss1.ini C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\ok.txt C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs5.ini C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 644 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 644 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 644 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 644 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 644 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 3476 wrote to memory of 1956 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg
PID 3476 wrote to memory of 1956 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg
PID 3476 wrote to memory of 1956 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg
PID 1956 wrote to memory of 2472 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1956 wrote to memory of 2472 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1956 wrote to memory of 2472 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1956 wrote to memory of 2472 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1956 wrote to memory of 2472 N/A C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 0

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 0

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 30.73.42.20.in-addr.arpa udp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp

Files

memory/644-11-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-5-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-33-0x0000000000990000-0x00000000009E5000-memory.dmp

C:\Windows\SysWOW64\kernel64.dll

MD5 eccf28d7e5ccec24119b88edd160f8f4
SHA1 98509587a3d37a20b56b50fd57f823a1691a034c
SHA256 820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512 c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

memory/644-32-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-31-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-29-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-27-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-25-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-23-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-21-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-19-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-18-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-15-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-13-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-3-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-2-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-9-0x0000000000990000-0x00000000009E5000-memory.dmp

memory/644-7-0x0000000000990000-0x00000000009E5000-memory.dmp

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1C\KVEIFmain.ini

MD5 424add55797255227d3c386af612e933
SHA1 c28465b56733bd50c47871a6f6516763e9b68ad8
SHA256 5ede7e2aa6b3d37dea582bb2832ac6d2dec7a59a8fa00f84c23e70821ac0570b
SHA512 664aecb9fb8074b4fa2915729e54194d7ba66adfdbcc7dc9aa9f6595e7f518fdb8e77f964ef58528a66d4e7eeb95ecc593b7fe5310fcd8b5ea2bb039483362db

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1C\KVEIFmain.ini

MD5 19aca18ab379f927e272a5b9d30bd287
SHA1 9c91c8e0a30bc4f40596c952b2ae8e22f510b8f8
SHA256 e852e6c79ab9ced44a28323210f74f4175ecbc5bf3a5256397b27412fa8bccbc
SHA512 8ebd3f2b6570b9b60e2bbdce50770e3eb6f8716a3d8ade1efb4f7401af2d698531457544de7090ac1ce1cb49e752d0a1222d5d0d7a1224bae3d04c38fb81d4d0

C:\Windows\Web\606C646364636479.tmp

MD5 f697e0c5c1d34f00d1700d6d549d4811
SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

memory/4940-96-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4940-99-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4940-100-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4940-101-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4940-103-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-112-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-114-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-110-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-108-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-107-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-104-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-130-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-128-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-126-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-124-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-122-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-120-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-118-0x0000000003200000-0x0000000003255000-memory.dmp

memory/4940-116-0x0000000003200000-0x0000000003255000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\ok.txt

MD5 4bcb288391556ba45a887ba5926390f8
SHA1 5c2341b12d5d761e53a1257ec46ea490ecbbc51c
SHA256 352d9f15ec52e995a4ca93bbd40d2236e5ae6e395e16c0e7e37e5ecaf1009083
SHA512 90d7a5f6b0d50b7f5a2f63e5b31ba2a0f97cdb016ee11dbac81bc8d155edb060355215dc93a02f910a88a5d92f3da8fe7874b5be82a1653f4ed788c44031dbca

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFss1.ini

MD5 2056c975629bc764596c2ba68ab3c6da
SHA1 35e3da93ce68d24c687e8c972f8fa2b903be75b8
SHA256 8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7
SHA512 c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg

MD5 90c65e776b538fc7bdfe3a68066a1b52
SHA1 2127ed04116ca8c84766854f89dee75a27830bfd
SHA256 359456419c4a286b64ad3186f86090025d05f1ddd0d7676055ec674df3d0bea0
SHA512 7e59e78b02215fd7b353ec8bf3669e012c9661c4141d452930e97f48e077b8eb4a5793b2b6f850f3dc27593bd654af9d024defc1c7e297ba0641023e4e1b6b52

C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg

MD5 b9b1e142365bc476abc99c34f81e3880
SHA1 44aa1ed2df4198cda538de0e56e01f1c496a8866
SHA256 2291c22b47c3720a8e16344be3f23e88d8f69ba28393eec02bca30719f795ce7
SHA512 9f4cde59463e06ed1506a89dac1cd85fb28c104e41b065a77acf36c4c82ca9c22a4d0d30ead17d4b182efc147671f0ab2039b16777800010f531c611f6806cb2

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD

MD5 d36c4612e33fa35c6bce71942ce2056e
SHA1 98cd74cfdbfcd9117ae7359ab159635c40cc199c
SHA256 f08195a059b4c7f5b06de10eb6e4b94d6bd16a58c4a30427b05b91afdf535538
SHA512 0a62bdde5ed1e09529eed348d455b693a13f099184a7f56f2978ae06a0dc3629e60cbecb7e30030d958caea1447743877959781f0b557f7894397fac32974fb4

memory/2472-196-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4940-244-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2472-245-0x0000000000400000-0x000000000042D000-memory.dmp