Malware Analysis Report

2025-08-05 09:42

Sample ID 240611-bprcsaygpn
Target 2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe
SHA256 5be1459cb89a7426a91707678653b5a593bd53b5eed0a6f4817668971af3847d
Tags
upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

5be1459cb89a7426a91707678653b5a593bd53b5eed0a6f4817668971af3847d

Threat Level: Shows suspicious behavior

The file 2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx

Deletes itself

Loads dropped DLL

UPX packed file

Executes dropped EXE

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 01:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 01:19

Reported

2024-06-11 01:22

Platform

win7-20240215-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1660 set thread context of 2460 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 2240 set thread context of 1740 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File created C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1660 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1660 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1660 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1660 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1660 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1744 wrote to memory of 1768 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1744 wrote to memory of 1768 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1744 wrote to memory of 1768 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1744 wrote to memory of 1768 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1948 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1948 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1948 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1948 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 2240 wrote to memory of 1740 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2240 wrote to memory of 1740 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2240 wrote to memory of 1740 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2240 wrote to memory of 1740 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2240 wrote to memory of 1740 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2240 wrote to memory of 1740 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

Network

Country Destination Domain Proto
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp

Files

memory/1660-2-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-3-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-13-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-11-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-9-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-7-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-5-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-25-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-15-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-29-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-27-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-23-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-21-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-19-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-17-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-32-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-33-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1660-31-0x0000000000220000-0x0000000000275000-memory.dmp

\Windows\SysWOW64\kernel64.dll

MD5 9b98d47916ead4f69ef51b56b0c2323c
SHA1 290a80b4ded0efc0fd00816f373fcea81a521330
SHA256 96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA512 68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

memory/2460-68-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2460-70-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2460-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2460-74-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2460-73-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2460-75-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA

MD5 f697e0c5c1d34f00d1700d6d549d4811
SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

memory/2460-88-0x0000000000140000-0x0000000000195000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 a9fa595fb25e867a9dd5776aa5ca015e
SHA1 40cc22c96280ea61aaf603650f5d4b4884f1a6ad
SHA256 3846d7b4e93c2e6f2de01ed7be252359855fbed36dfee4a34170d0439b619ae1
SHA512 36046a9a9567a15cd6ae99b9cc7803ce4a42ee9eed82d94bbda436c05cfc2cf6f0715a70bae463a6f13259f24dec5f508ae969fa2fb170a4c86436ed04bcd0d2

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

MD5 1ee836a55c14e46ea1e0a75c52875d90
SHA1 ce5feca843f7c3efd0997e99ff41b2e182a66566
SHA256 4d8d08b98d3c324868b3459a807d64572666c114d84651daede007b0d561abee
SHA512 51369c1a734f0d3cdf32d2d6424214f4e04bb12d3cf703e4dd97176b8aab51bb57c237776efb2b4e1d6c98caa7cc1accec4461de8a791a90c3d3e5cccae69c8b

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

MD5 2056c975629bc764596c2ba68ab3c6da
SHA1 35e3da93ce68d24c687e8c972f8fa2b903be75b8
SHA256 8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7
SHA512 c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

memory/2460-100-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-96-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-94-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-92-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-90-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-86-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-84-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-82-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-80-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-99-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-78-0x0000000000140000-0x0000000000195000-memory.dmp

memory/2460-77-0x0000000000140000-0x0000000000195000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

MD5 f59d05bfa438a9df7f33099947c33ee9
SHA1 3df8e9135698a7b6be3d54d62e9915e0db739939
SHA256 e7777250da6a8ccfe88ae8ae667dce036e4ee88d2ea21f41da5bd9e886c95b3b
SHA512 65d49c61a9098ce9d9d3a923d690986d18572f49f1481faf198279de29be9d78e0b0251256175a689c42c8f8a5079ac4ebb40f5640a0ec84820c9ef08d5fc9e1

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

MD5 72fba22c5e4e21fbac362d086fa57574
SHA1 06efaddee633e06ec2ab08a6118d9aae17683a86
SHA256 bea65abf17679fc1c808ada8df2c2ac4a04dfa5f82fa83bec9edcf724f014422
SHA512 b531625077f10766ae1f647153d7c9758749543a34c578ee770eb3fb2f4748388c10e1dc77832712c0dbb258e0d881e5942cd91eb1ed0de1eef6e49a2a1ee2a0

memory/2460-166-0x00000000003E0000-0x00000000003E1000-memory.dmp

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

MD5 c7152b3a4b58894eeadc0f569be45d1f
SHA1 6c6daff6f308e65680c8eb49f3ae6c04fed4990b
SHA256 1786e7fdc5b7f2b8516756303281ecc1fcfe38a78165a80e6631bd4ceb352f8b
SHA512 7ee7cb167c505108cb08d052e32dd6f65606697d1881e6cd0aa60fa2803eb68a0b789265777a795afa32295fd5f95a9977bd7a81ab1e5cee2993c4ffbaf681f0

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

MD5 9cc6401dc698476c774c152701d5fd3a
SHA1 ab34a6b205e06f6f677139d3d73300d64bae2101
SHA256 628a3851d7ede8f27e3ad4a0a6a8b426922dba7c43a2dbb6a9497476a7fcbf88
SHA512 71ead35de9aa724f3f08bb6cd6ca1ef54585b0c30da174c38a3d82e34d647575ae6f9232f8963f2b416f25b92f31aeba0bbec308d6f9b3e6c42f859b081ee8aa

memory/2460-251-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 01:19

Reported

2024-06-11 01:22

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 232 set thread context of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1508 set thread context of 1920 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
File created C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 232 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 232 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 232 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 232 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 232 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 3724 wrote to memory of 1508 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 3724 wrote to memory of 1508 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 3724 wrote to memory of 1508 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1508 wrote to memory of 1920 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1508 wrote to memory of 1920 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1508 wrote to memory of 1920 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1508 wrote to memory of 1920 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1508 wrote to memory of 1920 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

Network

Country Destination Domain Proto
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp

Files

memory/232-12-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-25-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-29-0x0000000000590000-0x00000000005E5000-memory.dmp

C:\Windows\SysWOW64\kernel64.dll

MD5 eccf28d7e5ccec24119b88edd160f8f4
SHA1 98509587a3d37a20b56b50fd57f823a1691a034c
SHA256 820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512 c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

memory/232-33-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-32-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-31-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-27-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-22-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-15-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-23-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-19-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-17-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-9-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-5-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-13-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-3-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-7-0x0000000000590000-0x00000000005E5000-memory.dmp

memory/232-2-0x0000000000590000-0x00000000005E5000-memory.dmp

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 c804c651a3bc36e599bcecba92b03100
SHA1 eeeda9bf66c4dbf38ca0c517be40ffa49aee177c
SHA256 2d3c236ef650dcb0c36355ce8754d74a5aa1622a1aa0a3dfaa313cd6bf25e267
SHA512 b6cc86f17f459bb4ecabc503b1ae52e77da76d4f616d267bad153b4f2e8d94d449cc1d9b6a50a49fa859d71678fbf8ad698770070c618523ef71b385444c5cd2

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 83699f7219191e054ca6784721d4f935
SHA1 b19428f7b4c0c5d9bdae93d57ddfab46121cd2d3
SHA256 36d818e09cc931c79a4feea7691e347f01d0143d31e8d949a10b0662a4a151d1
SHA512 1ee037e881d63a83a61a1354ab3299c8e3674a5a5adb7551b5db74104bd8a884d41b262265f7c9fa0c7d417004cd2e7efe75c625c0062d0711812f7244989237

C:\Windows\Web\606C646364636479.tmp

MD5 f697e0c5c1d34f00d1700d6d549d4811
SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 6d65868e4682271c711206ae15310e7f
SHA1 7455c6c26bb070fd8a1fe97a9578466b1896d254
SHA256 4857526a301f7e80d18e4976fb12be47b5a21430492d842d01446193e8d5f1ba
SHA512 d134d2c5879b3700e9fc7c6b4ff7719c2dfc9fdd8224f298a13d23da46c76c2d546ceb9db4d832d37f728cf9dfaefc2138cdd9adb4ab036a4b75e630f57b5746

memory/2228-96-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2228-99-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2228-102-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2228-100-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2228-110-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-112-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-130-0x0000000003150000-0x00000000031A5000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

MD5 1ee836a55c14e46ea1e0a75c52875d90
SHA1 ce5feca843f7c3efd0997e99ff41b2e182a66566
SHA256 4d8d08b98d3c324868b3459a807d64572666c114d84651daede007b0d561abee
SHA512 51369c1a734f0d3cdf32d2d6424214f4e04bb12d3cf703e4dd97176b8aab51bb57c237776efb2b4e1d6c98caa7cc1accec4461de8a791a90c3d3e5cccae69c8b

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

MD5 2056c975629bc764596c2ba68ab3c6da
SHA1 35e3da93ce68d24c687e8c972f8fa2b903be75b8
SHA256 8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7
SHA512 c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

memory/2228-128-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-126-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-122-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-120-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-118-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-116-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-114-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-108-0x0000000003150000-0x00000000031A5000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg

MD5 bd93621194a0aaa76285066cf0d856b3
SHA1 449ce542c3c2f8d93e91d926d0f17b4fc6498e05
SHA256 cba88ab4a618c3444cb1a9bef70b9f6219df049a0b0d98a3c58ee58a1240f38f
SHA512 9370cea2ba96fd29932f0274b630e3e0c9f310cd0312ed7d26d62275420158dbccfc51d0ba2a9e3d8a333a66269cfef0d92ae887a4a9a8f4ad3eacea6c537807

memory/2228-124-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-107-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-104-0x0000000003150000-0x00000000031A5000-memory.dmp

memory/2228-103-0x0000000003150000-0x00000000031A5000-memory.dmp

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

MD5 8c94e87782606997f08b1031644f7c14
SHA1 a3e1419bf62dbac557fbf0cbb5ea81a5a390736c
SHA256 7499a7b41eed3bffd46ffb61722173cb496f933a40a41f35dcca68025c7c97b3
SHA512 6190ae598d0fd0fd46f947aea649a26e60a4c1527694cc09b9a3095b0407ca82704a94e336d4f506fbcb984ad72d4e6b053a5ac59920a159f35fa586415e669a

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

MD5 05018897e2ad295b6324b9bbd71bcd35
SHA1 ffc28d6e23b63f322c0f1c24e521a9bb65dba330
SHA256 2d43c455ccfb47f96fcc1e03b57a9e039fe9f1e1631991dd0851541a4c45922c
SHA512 0a88eae844008aceb1e47669a3b1d8d6fa674cefe02e2a0a435921c37bce0d5254c254bed3820409710c782f2821e362c222803aa5ba1d077ceda4e3c7b7ea2c

memory/1920-196-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2228-244-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1920-245-0x0000000000400000-0x000000000042D000-memory.dmp