Malware Analysis Report

2024-07-28 05:07

Sample ID 240605-jfnvasaf28
Target 49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe
SHA256 4c51c8a0301ba5420577be8dc475883e42b35a3908105f00a490cc667b1729cb
Tags
adware evasion persistence stealer trojan
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

4c51c8a0301ba5420577be8dc475883e42b35a3908105f00a490cc667b1729cb

Threat Level: Likely malicious

The file 49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe was found to be: Likely malicious.

Malicious Activity Summary

adware evasion persistence stealer trojan

Downloads MZ/PE file

Checks computer location settings

Installs/modifies Browser Helper Object

Adds Run key to start application

Checks whether UAC is enabled

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Browser Extensions
T1176
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-05 07:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-05 07:36

Reported

2024-06-05 07:39

Platform

win7-20240221-en

Max time kernel

124s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe /onboot" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\contexts = "243" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetAll.htm" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045ff0770eff8de4f826a0d957c3daafa000000000200000000001066000000010000200000000c2038869d1dc30172318c8d30d85fe7cb0c9b67cd56a7de2781b3809cc079f8000000000e8000000002000020000000cbd3e0d4c90a64920f22e0b4ce1f0432ea9f7ed95197d21fcf566655f883462a200000003b78ba908c76e7d91c55bfdc33a2137d317ddd8d58be04b80f4fad841b0542b2400000008ab58810b707e412ad5cdc58f224ab563321e8fa70f62fa485a8076dee23a42957c69395f3eb33685b27ad6d1ea6e51e7807eaafe9e5eabc51b31a35b17d65a8 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\ C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06eac3a1bb7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045ff0770eff8de4f826a0d957c3daafa0000000002000000000010660000000100002000000048e05f9fefe23b8a4437fbaf2f5e2fe9f61cfff8a7ff5ee14215832f44f6ed86000000000e80000000020000200000000e80202d08bf614c75616453875818be70dfbdf99e82e38c83a55752d35c39d390000000ba7383111e749bf8995771226713d802d9f38499eff80a09b724cf40be47198e42e034743fd6dc859ce5b2a2ac976edeb126174e96b1556a6c784c8095e729a8900193d676cc9e8d2f95e6e46592dd6f6d2e1ad0f0f245acf485b3ae80a23ef5b32f4044c5dc95db4f42501fa7b278767bff281be787583851b3d9370dfd4ece4fffea06545ef702fde964a9aba7590a40000000c985c31dfd50fde6463e6b06dff61099eb83ea1e2b404f33137da957a9e88c6717fd979896b69da1be8f3c7612ca671e4fce280b85bd3e8aa53a9e2fcc84ec65 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423734887" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM\contexts = "243" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64A03D01-230E-11EF-BEEC-D20227E6D795} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Download all links with IDM C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetVL.htm" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\ftp\ C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\http\ C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\https\ C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "156" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2124 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2124 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2124 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2124 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3024 wrote to memory of 2700 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3024 wrote to memory of 2700 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3024 wrote to memory of 2700 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3024 wrote to memory of 2700 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2124 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2124 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.internetdownloadmanager.com/welcome.html?v=604

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.internetdownloadmanager.com udp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 www.internetdownloadmanager.com udp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 mirror2.internetdownloadmanager.com udp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar37BA.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\idmmbc_1\idmmbc_1.log

MD5 668ee55231fa9579f84a4a6c64bbf6a1
SHA1 92499a177d4e82b3ef3696a06bdf1e1852026b3e
SHA256 4348833106ce4300fe2485049f7dbe96b35a50766f0db5ae3ca024da6266e773
SHA512 50a851b0f8a0578ea954f5e7ce8527589611ec76e7f5ab46f6d84fb4953565936fcd83dd84ee5903303d67141b3a916642b7b9c613ca4d29290bae9d97a21bcd

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UP6HDZB7.txt

MD5 32281a825a57a8b1c218f6c24048c657
SHA1 c453a6ef65a01478b4cb5b73764022a77a3c758a
SHA256 e5dad278f9f76bba9b98570627284ada47e2c885475b5a05b08ad8bc8084b109
SHA512 73cd25f9e69147a331dcf73a8cf9bc62cb7a36325281e1fabae4e83f0ad88e70b845c9c26ce25493caafb1bad64bde2cb120f777f8996583c974318f03b98a9b

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\Uninstall_2\Uninstall_2.log

MD5 99bf18fbf5fda29d343258948cc1f101
SHA1 4c8a6a879edf93e50f7120ccc21427d72473d7a7
SHA256 aa3587a0b849d1a730691eaff2a2a5ce368a4614b425e0e7d0b69f2cc1a54ad9
SHA512 7bc8366c9286fc5410879843f63921a9bdba6902b039ffcd33f8bc008bb907677767781c7fcb4c79d51d384a2a178ee53887a865075e82255dcbd92c2b122697

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\Uninstall_2\Uninstall_2.log

MD5 ddb8515e4fecffc3350900eb24e3cab8
SHA1 39ed1f35df77659c97b2bac9410f389daadfc415
SHA256 e7ae80b2bb7b22c7d5986a6fe2d60a7bdbcf8c4356615534049e14ebccdc4ea3
SHA512 1b847814650426bc6b6af232b8039805d1a047ed7cd7d3b85932871fa73f39d505075322bc7b74324a7394be232b7f3bb80452baedd8d6fd08e1689344f2d62b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e278a10cc268f1fcb36b1a8a9385e210
SHA1 1fc5eb61e97fb161e9069958ff6eae82a0e314d8
SHA256 91b7b11173fdea09381e1a5df1a49d0a7e94f11a315b7fed6493077e6bc44d91
SHA512 610ed45d65d2b1bdce815c8444dab18ed7d3e49e1240ad78bef637c30cc64f20c0e45bb6e7253af1298696a03147c27a406ee4f09a9d5a99f6d6f7c17b07a9a4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 56c0b2cc0fb200fc9c02b0d06a7e5d2f
SHA1 8b4fbee1bb0c38d591f272e504b9171f5cac2225
SHA256 24016f3e7bfa8ef654ee2cac36160dafd8d27ca2716e182a12847d6ad021101d
SHA512 499e4580500a52efc42897f8e0443b4d3f55b5892db2286e1da79c258f5a0659db63e5fab01372a158cf4e1f369c4a9836c497d6ebe3d78de4d7c962e9ef7fc2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c723bca91ecb0031716304490f8ed7df
SHA1 f5528f4edaa37d637f88ece7fd402f12332c9aea
SHA256 32e94e496ca65a81f40c0218ef21bda0c957a622428fc637d43facdb0d9d6c07
SHA512 6cd8fc4c5c0d11a8a43a1427ef5e75f57ac6a777870424f0864a3bd2196222d45f1c02906cd74eeff0424da22bcc826fb291ffeb2dd388cc4842bd5ebf840970

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 414430897a430edc5d55b1b083481964
SHA1 76ab92300544ecb7b722013f7fce37a31930c5c7
SHA256 01e8d6a20d8d0ec15e3832fcff97fb4b64101adbefecf0eca7c8433365ef99d4
SHA512 3bd3c0c3dbbd78d93cb9609d027b9151a41da366f438f396a5329041ef37683d3f828b940586f1588d00f0beb30d1b8847ce683518e0c41db7ac65f91b8f31d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ac8e232a92c59f89bbd940978e12f655
SHA1 5a929e7d73d51165963245c6a4589f280ce64824
SHA256 aa52d62675268452be161185feac1770f0e5036c1cde45913d6eefa895b9140a
SHA512 1cf652745bb29a2584b6e6c141417201e42ffd8ef79517fc630a553d68838d18d6d6ea357a497dcbf4408a71f08b7e529e6a25277bc081fb08c69c94687a0e19

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a178f52fa4c7162764815b1337f1bcf8
SHA1 82ccee88832bb3b9bfb8770951f3d7abd8377866
SHA256 2ec030885f0de1e5d58c75212bf82e6ece4370f8516cdc060443185ac96512b9
SHA512 bc550350a5dc68ab4e4caa1354404a0906c24deb8786100adb0fc748470b633bb374a063402642f37e789b9b76e5e7f2541c58961b6660729924cb5fa23c4ff5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 55247cea01e8f8c4040745025939f4b2
SHA1 f3bba8a62d176d57060fa6bac71b0449d7e9070d
SHA256 d72fdc66b906ab629013d0811527fb9c18aaa8b97ed0225ba7baa86fc657f968
SHA512 c8794b7b01097229ecc958ac57168702448677d3815f6a41683b314de566f4dda32a12d60a6ec237d570167e5cf32a4342f9a72d2550c17d291b6e1bc7200059

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 991735f9477c3d0feabe00e5d4b8170b
SHA1 c414072af5464c18b7f87ea58564dbad30357889
SHA256 3049a4c264c55a5893ebb9b5cd05e757b8ef37ae1409675c30ba1d1a90b4c5df
SHA512 a8277cc7a84fd195590f727e93ba9c9e797cf995d0f87f0a6fec0015c739da03cd7b66a7c5416412a9af662afad871e6f3b1cd516e9a8915407c8d0b03c48e1f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 05db47f689562db7ebe13c4665640731
SHA1 e1b4876d1859c7f89d9a034d7d03f8c700665725
SHA256 f784847e2efff75c6d0c9813122e5bccd654f7f6c73329d969a1caedb7aa9d8d
SHA512 470f552bd9d434ad497ed922726959b5eea99d2e81d6a0cf5c4dcfd910d3283f54c4732e4ae1c399be79566758a2922ba7ebc4b2463c28de494acb799404989e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 179a7958ef951203bab23c643047783a
SHA1 e087d4d02713e86300042c00b2ce255beedd0f18
SHA256 39ab24e45b7138336ca43b81e99a86f02f9f48b4e170126cc569f2b4123e20f4
SHA512 de57b5d460f09e00f05f458c9e74d4c551f557887e7eb6223f7b81a6baff2a0a4a37fd10e425423667b6d8205a3a98a9bc5e7887da543f84778be52f46a7d428

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\update601_3\update601_3.log

MD5 7cb095369147911d84b9602e682fdaa0
SHA1 1943baceb44d5faafdd7d9c04146e6e08a0663ab
SHA256 160c16dc9fe672149566d22d6c3fd29b54a47fb7c6120eca5adb197c1527cba8
SHA512 1e548eb4c1b6d06b5595ec36f64ef76b39ed1e3b33972547bc2d128e75648ed22303419f7ccfe835de10a119116b0f1b8a336892d58331acd12ce8b19cdb9bcb

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\update601_3\update601_3.log

MD5 533c70398453e9fbc1a0c492efba0fc9
SHA1 0fc26d751438863b45ccf0c8767aee183018c02a
SHA256 3420dd33004ea818a575050b5b19cf61a5c0114ff858ad3b07094600648d5ad9
SHA512 fdcc30297ecb9795d9810d31ab4d5597ec9fe47b247112a5bd78342f4b02fe1e5c50448dfe323ffbf81defe9d86b1bccdbf9a0815f0902c2ab11d9b2f40eefcc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4bf33c23954936f3bffa5e9739b96fa6
SHA1 d2e2ea6edd7146f1055216957defaea0d6fc7ef7
SHA256 b77ff514f9f2a78b4d366632f341a013e0debc7121bca63881af71bb1fac4c36
SHA512 cdbf3713eb18a4d1b2e5f14ca728aeb9a5958f1e3588ae741cf95c5ccd8c1b8ba6249f7c424d3e90152dcd5488d31fac350fff2bdc03f6b58e5835ea6a57756f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1baacf7346e8d6ff85c79e2a41741388
SHA1 0d0f1ad37b258b1e9c19622cd949972e5be0dc43
SHA256 c91cbdce898d3d037cf70ec26bca1a467b70644507d2e3d2e3e4a16042488007
SHA512 a7825a3d0596c002ef79d1d384b0c7ee2b55ab256d20f713c0be1349ca093f858c38e730d55c7eab0fc5990792c16f880c171fa2bb417ae6ded670282c139bf1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9478f5f2b405f88f1cd5292a097b4da0
SHA1 38a2b059cc337e9610cf68c81ddd094f96fdbb70
SHA256 29851a9480cd225bf4816064ded1940b23eb66ee6d45861c996322dbc4b54692
SHA512 c319b090f0eb8b2a8efb011a9bb84c26470dba3a76fab5cb54fc9e8ff2284b8ea3d636507c589630de53422a046c31809081267b7bdd0d8905549b13b2f5217f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1784d6f22cc7b05345e27e790b61de49
SHA1 a2d3336861d71fba8bc9f96f9754ee9bb918d80d
SHA256 a68441763d6e4149fae426b4993d31e60cfdd96dd999654f28cf0f78ae3cfbf8
SHA512 0e5e259e1364acf7f4dd9e4aa8adfbe7a246710af88507ac5d6f4f872ae9851392fc9f97a29c5df4e46e838cf474ad7bae82c6874a8764ad874a3e75135b6b24

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 49dfa797368f4b89558d223b640c7d24
SHA1 a8d9e898a6dc5f3107f6435992e618844063ee26
SHA256 05e28969985d9fbc8b7c58a7a56b74b5e2e8f1427bae94b85bae87e933db53a7
SHA512 2c194c5b8254df7ded687c1c0ca4e53c45d676d949616154a3884925aad1a95825dd2d71cd755a19bf94b4cbf48904a076baf7ab53c11a230faedae6856c8e52

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 261691176695550a95a729afae0ded3c
SHA1 f999616047c48f512759c1dee9624510b434f37f
SHA256 5dbd06623cb60ba07f994c77d04dfa490bdcc750d133b287d7c54e860301b891
SHA512 1d7f0dd8f434c73e5eee4c88eacb466b30fb829ae43180125e7726e7c4bd0fadfdf9a207066b2ffbddb177f11b3cdeb6684c3934d8f378bd6d7e49652ad033bf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f46f42fd2ff970ef28289122c1f32ac9
SHA1 9009087c5b0ef08b46b1fd14bc2454007ecf0399
SHA256 2f15e0db97f2b9a7dc2727ebe45e5962d5a2c69dc8327a67542791b6bc5830dd
SHA512 e5eeab8e56d36607d344b0a7da003dbfcf1fd6b72b0ed0e90f3af9c3185324b1e0f0cfe2780c085f4ecf74f9de8ad1867b71aeb5ed30364f29855e8ffffeec94

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c0b55670cf7fead36cbd67e937036f08
SHA1 cfa8b7bb7aed1ebb3aada1f036d68641ea54f7a9
SHA256 57646f0ac5606fa765c489c7a7ab03c72f41ee4177a9b7bc342316c829e4935f
SHA512 b925cd3942150fe9f7e4303e4fa9cceb508828f7d35203e73896e876a0620a6b9990b659766e260c678be445536e9ecf65a235d753c315852889d2a0adcbc257

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 842439b3b22f97805b0f7d43f4344979
SHA1 73ff333dfa9592f5a69b2e9a73396adb8106bbc6
SHA256 eb7af194c03164b2059f25aeeff95409f193bfc3128fefae441e223e017329d6
SHA512 8e4e62efef4bf8077a3058a1367a02cae8e51e202b51570db1d15582ea5d7b78326f348c49ed83b59653a35adc1f0ba70001ca2ced1ebbc139bdbf34f71e5bef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 caa2ff927c3e260b66ee133e3159b16a
SHA1 7eafc3a976651907998821b2190e9b53bf656aaa
SHA256 ac6a7739db5208faf97152f5a17cf72f39fcfc595ac656675825d8feee929762
SHA512 2ea40d65dd923774da3021fadfca6e61543269645ce15024fc3ca417672068373ea3856af3fc0841a2ad74a9a2b7a6a3c1e43e26df3ce4dc3ad7afbdc4c3bfdc

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-05 07:36

Reported

2024-06-05 07:39

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe"

Signatures

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe /onboot" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetVL.htm" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM\contexts = "243" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetAll.htm" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\contexts = "243" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "156" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\https\ C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\http\ C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\ftp\ C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4400 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4400 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 2284 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 2284 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4400 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4400 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4400 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4400 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4400 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4400 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 5012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4400 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4400 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4400 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4164 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4164 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\49254a23f8b22dcccdcb0095c13557b0_NeikiAnalytics.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/welcome.html?v=604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f55b46f8,0x7ff8f55b4708,0x7ff8f55b4718

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1839926755601070288,14642604863332113123,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 www.internetdownloadmanager.com udp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 133.27.61.169.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 23.62.61.57:443 www.bing.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 57.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 mirror2.internetdownloadmanager.com udp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 8.8.8.8:53 77.113.127.174.in-addr.arpa udp
US 174.127.113.77:443 mirror2.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 169.61.27.133:80 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 169.61.27.133:443 www.internetdownloadmanager.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

\??\pipe\LOCAL\crashpad_4164_MXACXPVYCHNDGRIY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 68069d3342f410314a40fc241d7e892c
SHA1 81b4b8661997dea8f73ac3090e75bb0ed754a291
SHA256 2dfbd3733a3e09e9662fb91a72a3feffe3beab8c8c68d56c543c52fa44f5517f
SHA512 880853e47c60aec198e1abb0c5c285c9230fadda93ebe770c9baa3c6b1e476a0aa4dd607a81c7c2d09bf3918286e325fd36af0debdfcdb8ffe0c7fb119ede343

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\idmmbc_1\idmmbc_1.log

MD5 a469e5dafce7bdecf6ee79844ad8bfe5
SHA1 73557268c502a2916d77d0e8eb6832f49b2f6d4e
SHA256 a6c7819fa04d5538e60c28f0ef41cbc5e66ae2940fe01932d7efba08bbb8fcc3
SHA512 f8599eeee0f5ad0e08e76c4549089b26e3fcdb70f733452044321d5b531c9c637a40c0e43182e51a60e0919940aa0d4ca03042407b22d9bd33805aa724625fe7

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\idmmbc_1\idmmbc_1.log

MD5 a9da8e037ecd4c8586a1de0d7acc566e
SHA1 8d3fcab24b01de297089d9275c6870d9f845ca8e
SHA256 709cb17b921e2dff515d30266a880352cd3cd5a1a763981eec138b31c0520c50
SHA512 0d5556275b7b55787584f51900d7d2e152bd393bb094c24b22fe774bbdbe1f4b353bb8cc08e3f5fed1d142e8c1b75edc5ca5de580042150c57ee930af48ece79

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\idmmbc_1\idmmbc_1.log

MD5 c5e062d7048d00c5e4d5e12ce3f04486
SHA1 7cbda9990a332d1fcf503bc746d5cb1f0a22aacc
SHA256 199541eebd9b772a7d04cca78cac68ae73ff2ef1c9408106c39b37c6edc182b5
SHA512 2718e3af0b41ef14fd79ee36c859f938f88f508f13b5eb0e6d4a86cccebbd92b1ffae61a46d73d2ad409b4fd65fcbb9f23ec988e5587179e8cfccd52f457e6cf

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\idmmbc_1\idmmbc_1.log

MD5 a010504b9b0379b728f5a8cf1a2957f8
SHA1 11f52508a09f148a1ff9354a864d150ee2458c52
SHA256 063c8bff99c46361d3c4caa2b891fc59a15cc37f2cd14186b5fab3bf26081ede
SHA512 fc599b4258b7f0739a3ab40a32d56157c248e6f67a019aa2407373a2bed44de4163f62769911459b54a95e4c2d8bcbcff96caf18f0165b08120d68af0023a49d

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\Uninstall_2\Uninstall_2.log

MD5 c2ef3f236250dbfa1400408727056eed
SHA1 aa5d54ca4845754b85afde23e11a1f02a7eb3a65
SHA256 dbbe27bc40f4d6bf38738dddcf8422c903bea1a828c8ed989750943e20da98c9
SHA512 2a00d0acdb9e2f333bf0705ab8d17ea0d6c853bf11129411e559760f38ee30a0da48257ceeebd2e5134f46751175e6b637fcf5d0769ab214746b887d2067fc4f

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\Uninstall_2\Uninstall_2.log

MD5 38215dd0e7e57b3a416e92b06634fad8
SHA1 1f09858ec1b550d2d2e58f3a1e361b0ae79fe622
SHA256 080faa01902b0b3161ecf2f82a09e489a80dee298b0958c0a1b17a5b921394d9
SHA512 d4fad4fb60c7707937a9cea29a389060c737e675a000a7aff68da568f8146203bf0c16d8e1e2bf85cd901ca073909b9377fe82af73176079cc98e0c44edef43c

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\Uninstall_2\Uninstall_2.log

MD5 c7ee9bbe7d70df8a99eb4b26921021a1
SHA1 0d74eab33058ced16c4cc9fb545bf21138d0324e
SHA256 8a88373c2fb0134ce32f71cdd804174d3bd6b6189a3673c1910ce9757c71fde0
SHA512 4867864c193008c5b1a6602ee4e88dba1d104bd76442c39724fe28269640fb5b1496c997a73f86cc45641b79fffcdebe82299b98907fabc0de818e91b6e9237e

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\Uninstall_2\Uninstall_2.log

MD5 6e82258defda5d2b32c165d3389b13e9
SHA1 a0f3c704053b8d3cfbbe925f26926d1c4dea60c2
SHA256 613a40547ac5c7fa93516551af909489c3dffc1ddd02ddd5530a32e3afd5fa42
SHA512 4b6482795b4d626a5f069e39a71c5bfa31aff3d1aa380ad5c85c97e3fb1e91fdf3e6d19ab67e685a53aa687d5a010e60fe9adee10c0ea6154e96e9342efe9298

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\Uninstall_2\Uninstall_2.log

MD5 edace817d0e1c9c489ed870901998f70
SHA1 5d95ee55f8097f9486055fda5d08e8a5435d9a86
SHA256 2f0935236d0bc55b09996969522e984546d2c5169920b57819089677c2ab8e5a
SHA512 74dfe39345d4e6292ceb25e70f6c3fb83e1fdfa3f0ccb8b133af8c6828453d548a7900e7c54f077652597bf8a45246cfdb489cf8ef9b63377aa865cb1f62ff98

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDManTypeInfo_3\IDManTypeInfo_3.log

MD5 1290d3b2d80ed8fcdb7c407f91bdb23a
SHA1 bfc1d985a73be7293033b768288407994cc2f7a3
SHA256 5049eead62d7a31ae27f80a07897823027a4c1bf3e6bb61358a9e8e9232734e1
SHA512 1dbbdf35f85ce9644b8a5fdfba40e03bad53170f10e7217c38df1e6f57c098727dbd3a8865782b343c5f4a4a1c8433e2e6804310f097138536c5b34af0bb5bfc

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDManTypeInfo_3\IDManTypeInfo_3.log

MD5 d9a9a72c876368e66a7744845ed6d3d8
SHA1 d766e6ce819d8907f7fad1c4c81a2656557a8428
SHA256 f3ec0f228cb86b72e84eb916ec264244b60972ae7ff3775293b2b9272904bdb5
SHA512 4578d89934bdba7150b177cf723a8a7d987bef3cc0cca25e902821855a4e9a70fdb1d0b5dab4825474f2084431648a1be0a94bef54bf0ec10f0ef625256ae6dd

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDManTypeInfo_3\IDManTypeInfo.tlb

MD5 c4d899de5101be56b68a1f08b4849134
SHA1 8ccab67a609ada6c75315e64e361a2321563f3a2
SHA256 7e40c6ac42047ea44723c684e0772f1cb87e85e291ed531e0a7957403bc088bf
SHA512 12016abcccb366645255616ecbcc1b381b3dab2453e5ba0ea9c385241be640d74f572d5cc2eba132b8acc6c1d60c914e491d8da166b8cdba002b9319d04a43e1

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDManTypeInfo_3\IDManTypeInfo_3.log

MD5 8833c4379fc901daebf951cba7bd7fcd
SHA1 60fb6b2fff504d53f3c2e77a743f598189296b63
SHA256 35f8bd57c0391dd5188dac4e71ec3abafcb7cb9c5673f0036bef33c7fc6da0a8
SHA512 00c33fe0b22f795c24528c95bf8622bb9f8b3aef8ee4e582b3b96e601efffa5339801991c0c7d4363b4f5985fdf90115179b8711b2012030f1f1e2b40b8c19d7

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDMIECC_4\IDMIECC_4.log

MD5 3d3bd44f0669dfd051aaa4599baf8e64
SHA1 246241d1b3aa75a980c9b85a4d4e93f56088a6ce
SHA256 8307512cb25449d1712f15cb9a5f02dba65e8926a929e0c43fa6408b621f4b50
SHA512 d020a48d5ab84c8c025708956a8ea91582a3a8efef46a307804c6c0c7e684fc45a2218e3fc60da97537f8112b508141ee7bf279178a8c0f878bafdf848faf67c

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDMIECC_4\IDMIECC_4.log

MD5 9f0146438e8eaa629b71702416890fca
SHA1 2537bb225ccb67d3f9dbad6fa406b3127992479d
SHA256 887be84adb20fd9939902d74e0b556826636e3c7a2eabcc7906dc1a317511be0
SHA512 5c972f38b4425a6ee16655f7f298e8869199da73717791e11060aff881e3000f889d29fa9990b63f7536243775d1747a9e5b8d0ae023f1231abb053b7dc81760

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\idmmkb_5\idmmkb_5.log

MD5 5c68aae673630a2eea59efd131ef3a57
SHA1 871b515c449ad4519bc4d6ff0f5781404debeda9
SHA256 bd6cb1c3bd7c0a02aa81b5dff31ae8d103f3a81abe404092e49532a23c6b5e2b
SHA512 931103f9aeb47832a8713e5147dfecc44fd16eb7286dfadece367a396695749c1c53736384276f2924f11bf6342b6f13998b1f68ee2d80b863a02a5dcc83b5ea

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\idmmkb_5\idmmkb_5.log

MD5 34831f5a1c0bceaf8597292a08475cd1
SHA1 992b3a812476e8089366ef9b60ab1dfaa818356d
SHA256 4d3e31a940636b14f98169df2a25ef78f5708bef542aec067a53511410d912ff
SHA512 1ef1975b5d18d9720d8c8676f8700183d38cde769ecf90727b3d926d601b7cf1c19a87af7afee6bd016180b26b8c48307c65043f19275f66c539d0b10fcd4bfd

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDMGetAll_6\IDMGetAll_6.log

MD5 2ac22e48664200a09ced49a015f72380
SHA1 b813ac6dab2abe1c2bf752e6dae000ef4230f194
SHA256 60eb784c7eb6e0c0c77d95bdda28cdd4abe2607a17ace0a9250284ed40fb7590
SHA512 85f4c0d3e6d6b800f0fdb253e86852b001ebf0b0b75ff1e71c05c48221c663c5058a790e8b779918c94dcbccd74ece9bd9d410d0d037eb649aa82365ce48c34d

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDMGetAll_6\IDMGetAll_6.log

MD5 f5e6126c4285db1f57a8a68f46aa19eb
SHA1 5cfdb502e1d5ca3ad0aead9756f3d11654501edb
SHA256 8497009c2c0a3633fc1567fbf8d91b70cee5e5df982bafe3cb7a8a1430d546ab
SHA512 91e18c3b935a73e6a6fd71d01f8d0a78e92634d11cf0e09cb5d75fb2f2b3e643056495dc9fb04c32dc1981966405510aedecce87385de416d1195e4164ab71a7

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDMGetAll_6\IDMGetAll_6.log

MD5 7b86767e06d64fc8638daa3fe6c3c305
SHA1 cd00ff6bf5eb0aaca2c1da4e319c4accf52eb43b
SHA256 c54e6a2389451f056cac88ba95fa5f94d937f982451ac2a79c4893c19c384534
SHA512 a327cb82fc3d7d517890f4e2180257cfc71cd4067617ae4ab9365028856a7a5c4aa50367ef91bfea7d3e412fb4bb845974115dfdd71326f3bd11699d382ce179

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDMGetAll_6\IDMGetAll_6.log

MD5 85842ae1010b19113e48d1b01f535452
SHA1 8e7b89f3b99a709e450ab90e40529840b29fb992
SHA256 f9ce1e1ac31fa4b184211dbff83b8bee18762e6181dc7f5a4b4ee5ca85c557e4
SHA512 da2736e2dc40612b8b90617c8fd37343e0a1b8654a9723b0e7f711b838d8815c495b3a3ba034ddaaae596d0034b3440bf6da1ffe08c48a0c92e68f285cb93e15

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IDMGetAll_6\IDMGetAll_6.log

MD5 7d8a4689002e6b09d06705b9a7ab35e5
SHA1 fb5f392a5b2bc2bb5b646d940488b24760c4e918
SHA256 56ff59e3a4fff081a02f709247969587a1b8eeded137ce6e6e6d54f9a9e03496
SHA512 f3fc41cacd682f85c6304ab50cf708afe756e269c87fcdfa004fbf913ee0b2ce674bacd41d54e9f6d57e4e8be8d913cd67777930611fba273de96f98c043d848

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IEExt_7\IEExt_7.log

MD5 8f09788ce04e22b6b95c7a583f7891af
SHA1 bcde531d79722a500cf80e25c89f76bcf60dadc4
SHA256 0b9cedbc7f001a67c681a6bb6379061481a23681d514b2a5f2b4a1a68c7507a3
SHA512 17f51746151b751abf50839a9001690e923cfc563e7cb378af2e3107e5586ff8509c79979288bd1468d2a77551fd3212f3c86ab1771e1634904451b24f6b6eea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6df2ab09ffcb42ba2c758cd6d84087d1
SHA1 6ba2992f6b4042793e06b06fe711a54be318a318
SHA256 8ed00e3d4b8be3c047b9db041715b09ccfb4e3ae4b5a4a322e0f4d22748a1d97
SHA512 4e2b2aac802927c7386874d848e7e9ec6a0ac255f4f39d831247dbe2d8f2e0f3d8439da918a7b9ff4e4c4b8eade1e0eb238876157faee6fcc9e3e8d607c33b58

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IEExt_7\IEExt_7.log

MD5 c84f514d8b9f7bb7b5c1cb8fdaef3455
SHA1 018b66013268ae86c29a1f4762de7c7faf1cdac3
SHA256 19eec2d78a5dd7037ea3ab8aace8794b5b7a02918a01b6b5bfb3a29c64ca8607
SHA512 90aefba9e23b0fe70ff5202c61270543b18badc6903347f649a3d592cae0b5d379017a1e80a5b3d619d50e1153c7662c04293996e9ac2eae04627733fa1a2ab7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d55558fd1884b2146af325ddd0e6c87b
SHA1 126ccab79d3f3198677bee9022e9233bc4071f0f
SHA256 07aec1ae60755f8caf3759858892efe54591267257b7bf905e15408769aec373
SHA512 bcc5be0aca2c7ab6d1a67499272b36e60c954c666511407ca8eab6aac19c57500597bc9b921f6ed6a38dca9b226d339ffbd3280eae2c5e2d2526adc00c36bd08

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IEExt_7\IEExt_7.log

MD5 57064862750ed79ee2e6176681295c10
SHA1 29a025adcd3ad92e71b3028d9551704d4e353fc1
SHA256 5daf1aa8f1305fd82ccf40b7370de31b63eedc3c28d7ef7ab9f3ca184b6139eb
SHA512 9c3579748527546f8d2330e1ef4ff388738ea6ddda21b52ea8c744a374fb69e6ad048ccc970365b1bbaa8fb32d0bd74ef21d997a6ebd3d7735f8f8d84d1cc66a

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IEGetAll_8\IEGetAll_8.log

MD5 fc92be02e07e403d04c0846ccab4202f
SHA1 4fd77b1155ff193189eb4804f11597615a1147ec
SHA256 d5ec6a353f7665be4cc9ca80e6d616a42c8030a12d889a9b48f1076c9fee7d0e
SHA512 a3a6f08cbab531f1f4347c5911dc7e97ebb8152bb77b450f65ac542e479c2d167b3f408eae10e0b60fdd98e4a2a2a35c3358654ccadc84fd23e9a51e4cb1b6b4

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IEGetAll_8\IEGetAll_8.log

MD5 2d926845755bbcde92181c0c4aaf4ca6
SHA1 31641b3410b51b4d30c1fb5777edef297bbf70d2
SHA256 0a5c9953917cbde508cd46fb676aaa277b0ca2c76117384be0930429d0cb8490
SHA512 eef06834747f2ebf0d86225aa5cd9c99b692464a6ad043fb4462c47698efc7608660cdf3d7593bad1228d1057d87fb1c34f3b56cda4c02c3d11cd8ba3ef7cffa

C:\Users\Admin\AppData\Local\Temp\IEGetAll.htm

MD5 648e7b2602158d2ff9197d664f59b28b
SHA1 6ff2653314ddad254ad252b1867d0925b30bb196
SHA256 47937f8f34ba56718d4bd3b97bfd9e42468d6b7615c745b7841272a2e3d39e57
SHA512 c24d7059acf8d5a8ca5de77a165f95e4b6a685a62ddf8a3446ed465c4064d33a057c9f8e985bb73d41f1b0984cf8065c0c5d1a7e9123521d962befaf49edc3a0

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\IEGetAll_8\IEGetAll_8.log

MD5 e7dcac7c81fc416cc4cc2866f5f08930
SHA1 4ca476dce72075bd67bceaefb5d63eda54745028
SHA256 466308e6a8d2315f0ba5fcc9c71c76d03f99e4d25c43e5970d6f458be66424e4
SHA512 2c52ce44eb82cda1dd2ca2e079f8addb21637c851e8a46e66b64c88edcd1cdd5d2a82fd9bd33eb7f744a2c617f5a3740758bdbfbdf48b389e24509f9d953d68f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 db1deae670dfd0d02a03b64d86c8f227
SHA1 ddffc660fbc9e0fe497c84498363d0f4a6c5a6a9
SHA256 27e415321fe06fc51e08c8a04a6803ad86112b893f4107a4dc7e75dc9eb71662
SHA512 5efa4d0709414ad502ce9b2ad770d0bd1072454c2f98a1ad191eb5ee3e74ba7e6e3e1335f8f672fac81e69c084fbeb85580d84571608ebc4d5d15ad82a5d68e9

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\update601_9\update601_9.log

MD5 513a4970f359b976b1137c33aff23d90
SHA1 b595f409f284917eb07a75b156779493afd6a54e
SHA256 0c31db3198eaeaf3931153323f621f8252a0208499c27c69789896e384773b7a
SHA512 3ac128723ab073ccda3de68d2150d2c61393c4e21ba0ddab3be4c3c323228ab0b7152a6732cc778f91367719ab85ac9328e52a0f61f56a6f4b85ff1938ecef79

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\update601_9\update601_9.log

MD5 4d06fbbd2b9239c11adea61ae5280cca
SHA1 b9262569048a9ad94ff6eca7a8ac15e711e9b811
SHA256 5c68b461d1fb1ce2a62381110d78aed9ce8a5f042f67abaab2c4165e2088d5c6
SHA512 51960548001c3ef95a6aa6741dee04eeda23ec0c9256c05236e9567455ccb5c28f8b79039bfc4faeb2ba07f6f0e5f880da8cb39767270c9a27ba2b56f9f9c583

C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\update601_9\update601_9.log

MD5 2b7cecdd56e8f4faa79d4a483f3e8161
SHA1 3277726b5adea37004dc93bbf69f20cf88a2c5e0
SHA256 318e1de4cc57374b13cd13190e2fb7e0871b7d6d1a3b94206abe18e3e5f29d96
SHA512 516edac9bc9291426f3048a98c0a1c444f68348d891f98bea384c16f6f2537cba1b3e63a4379274f3c15c7df3e62c2165dd2f543e26717283d767bdf5fe0e09e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 cc952a0ec78aee2c6bc393212307f9aa
SHA1 6b295f8f7b0254124afdc515bca325fdb3b48e6a
SHA256 9efb98c82acfd9249755e0be0107a0f8909e34dfe9ee23d2c7b5042f21bf7592
SHA512 a9eb04e158cebe1121bfa2ac57a3b4135068310f956d65dbfee319ba3da225962761d9af03e5acbc6b375182df29a437324f789f6ad759a5df6bb122fe8ebd30