Malware Analysis Report

2024-09-11 12:36

Sample ID 240611-r8pw3a1ckb
Target 38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe
SHA256 9fc2502ac0efde6f44a464fbb5c98edac22b9eef07385e333f1f89c6ca199cb0
Tags
sality backdoor evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9fc2502ac0efde6f44a464fbb5c98edac22b9eef07385e333f1f89c6ca199cb0

Threat Level: Known bad

The file 38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion persistence trojan upx

Modifies firewall policy service

Sality

Modifies visiblity of hidden/system files in Explorer

UAC bypass

Windows security bypass

Modifies visibility of file extensions in Explorer

Loads dropped DLL

UPX packed file

Executes dropped EXE

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-11 14:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 14:52

Reported

2024-06-11 14:54

Platform

win10v2004-20240508-en

Max time kernel

21s

Max time network

89s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PPS Accelerator = "C:\\Windows\\system32\\ppsap.exe" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PPS Accelerator = "C:\\Windows\\system32\\ppsap.exe" C:\Windows\SysWOW64\ppsap.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ppsap.exe C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\ppsap.exe C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e574d45 C:\Windows\SysWOW64\ppsap.exe N/A
File created C:\Windows\e57544a C:\Windows\SysWOW64\ppsap.exe N/A
File created C:\Windows\e575dc0 C:\Windows\SysWOW64\ppsap.exe N/A
File created C:\Windows\e5762e0 C:\Windows\SysWOW64\ppsap.exe N/A
File created C:\Windows\e57690a C:\Windows\SysWOW64\ppsap.exe N/A
File created C:\Windows\e576c27 C:\Windows\SysWOW64\ppsap.exe N/A
File created C:\Windows\e574297 C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2AD3A683-2802-11EF-9519-EABD73F69B33} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1540 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1540 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1540 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 1540 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 1540 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1540 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 1540 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1540 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1540 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 1540 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1540 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1540 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1540 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1540 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1540 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1540 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1540 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SysWOW64\ppsap.exe
PID 1540 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SysWOW64\ppsap.exe
PID 1540 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SysWOW64\ppsap.exe
PID 4320 wrote to memory of 624 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 4320 wrote to memory of 624 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 624 wrote to memory of 4888 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 624 wrote to memory of 4888 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 624 wrote to memory of 4888 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 4320 wrote to memory of 1948 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 4320 wrote to memory of 1948 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 4320 wrote to memory of 1948 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 1948 wrote to memory of 792 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\fontdrvhost.exe
PID 1948 wrote to memory of 796 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\fontdrvhost.exe
PID 1948 wrote to memory of 60 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\dwm.exe
PID 1948 wrote to memory of 2684 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\sihost.exe
PID 1948 wrote to memory of 2748 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\svchost.exe
PID 1948 wrote to memory of 2944 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhostw.exe
PID 1948 wrote to memory of 3404 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 3552 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\svchost.exe
PID 1948 wrote to memory of 3748 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 1948 wrote to memory of 3860 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1948 wrote to memory of 3924 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\System32\RuntimeBroker.exe
PID 1948 wrote to memory of 4008 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1948 wrote to memory of 3808 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\System32\RuntimeBroker.exe
PID 1948 wrote to memory of 4284 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\System32\RuntimeBroker.exe
PID 1948 wrote to memory of 4832 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1948 wrote to memory of 3768 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1948 wrote to memory of 4320 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 1948 wrote to memory of 4320 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 1948 wrote to memory of 624 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1948 wrote to memory of 4368 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\System32\RuntimeBroker.exe
PID 1948 wrote to memory of 4888 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1948 wrote to memory of 4888 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1948 wrote to memory of 2148 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\System32\RuntimeBroker.exe
PID 4320 wrote to memory of 724 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 4320 wrote to memory of 724 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 4320 wrote to memory of 724 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 724 wrote to memory of 792 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\fontdrvhost.exe
PID 724 wrote to memory of 796 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\fontdrvhost.exe
PID 724 wrote to memory of 60 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\dwm.exe
PID 724 wrote to memory of 2684 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\sihost.exe
PID 724 wrote to memory of 2748 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\svchost.exe
PID 724 wrote to memory of 2944 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhostw.exe
PID 724 wrote to memory of 3404 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 724 wrote to memory of 3552 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\svchost.exe
PID 724 wrote to memory of 3748 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 724 wrote to memory of 3860 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 724 wrote to memory of 3924 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\System32\RuntimeBroker.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe"

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://shop58477515.taobao.com/

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:17410 /prefetch:2

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 shop58477515.taobao.com udp
US 8.8.8.8:53 shop58477515.taobao.com udp
US 8.8.8.8:53 shop58477515.taobao.com udp

Files

memory/1540-0-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1540-1-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-8-0x00000000029E0000-0x0000000003A9A000-memory.dmp

C:\Windows\SysWOW64\ppsap.exe

MD5 38817c655fa113fe3a04e0711c0804e0
SHA1 eadd16e8495054c458244ec019f12bf69a021c88
SHA256 9fc2502ac0efde6f44a464fbb5c98edac22b9eef07385e333f1f89c6ca199cb0
SHA512 c8466223afdae7393bf380c0b205ccb57f8214e5afa186f3a537931e5ffe39f25f430ab2a2858bdafafef80aaa0617b16950168de3b59bc4687ea60db0b7da60

memory/1540-20-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-28-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-25-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/4320-27-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1540-10-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-21-0x0000000002070000-0x0000000002072000-memory.dmp

memory/1540-9-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-18-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-5-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-11-0x0000000002070000-0x0000000002072000-memory.dmp

memory/1540-3-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-7-0x0000000002080000-0x0000000002081000-memory.dmp

memory/1540-6-0x0000000002070000-0x0000000002072000-memory.dmp

memory/1540-32-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-33-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1540-48-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1540-37-0x00000000029E0000-0x0000000003A9A000-memory.dmp

memory/1948-62-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-64-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-54-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-82-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-88-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1948-77-0x00000000005B0000-0x00000000005B2000-memory.dmp

memory/1948-61-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-75-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-65-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-52-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-67-0x00000000005B0000-0x00000000005B2000-memory.dmp

memory/4320-66-0x0000000002B30000-0x0000000002B32000-memory.dmp

memory/1948-63-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-53-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-59-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1948-58-0x0000000002070000-0x0000000002071000-memory.dmp

memory/4320-56-0x0000000003520000-0x0000000003521000-memory.dmp

memory/1948-50-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

memory/1948-60-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 c9c057671b5d097892c2971a35d69081
SHA1 c4ddda64e2a4c8b56d30de539ccc6074706d5876
SHA256 2473a94475bcbbe596e68b5200140a5a55cbbcd6371bf9d29ef2e0fcba3faaf7
SHA512 6748cdc7f49c78f6a75a8e27973debc287d81a0e85c2308d809ed67992c94259d7ba4c4cdf32b8bf5d3b912f5b0eeb2e6116a0d56c68528283b1433053f4abaa

memory/724-90-0x00000000029C0000-0x0000000003A7A000-memory.dmp

memory/724-92-0x00000000029C0000-0x0000000003A7A000-memory.dmp

memory/724-97-0x00000000020E0000-0x00000000020E2000-memory.dmp

memory/724-96-0x00000000020F0000-0x00000000020F1000-memory.dmp

memory/724-93-0x00000000029C0000-0x0000000003A7A000-memory.dmp

memory/724-91-0x00000000029C0000-0x0000000003A7A000-memory.dmp

memory/724-126-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2636-128-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2636-155-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4380-189-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3584-198-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2836-215-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2836-218-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2280-222-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1056-226-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4772-230-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3312-232-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3312-235-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2352-237-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2352-240-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1980-245-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1980-242-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1628-247-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1628-250-0x0000000000400000-0x000000000041C000-memory.dmp

memory/412-252-0x0000000000400000-0x000000000041C000-memory.dmp

memory/412-255-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3772-257-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3772-260-0x0000000000400000-0x000000000041C000-memory.dmp

memory/5092-264-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3124-268-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3932-272-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1588-274-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1588-277-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4536-284-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4536-287-0x0000000000400000-0x000000000041C000-memory.dmp

memory/5036-289-0x0000000000400000-0x000000000041C000-memory.dmp

memory/5036-292-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2108-296-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4900-298-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4900-301-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2392-303-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2392-306-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3600-308-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3600-311-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4456-313-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4456-316-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3120-318-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3120-321-0x0000000000400000-0x000000000041C000-memory.dmp

memory/860-325-0x0000000000400000-0x000000000041C000-memory.dmp

memory/5108-327-0x0000000000400000-0x000000000041C000-memory.dmp

memory/5108-330-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3192-334-0x0000000000400000-0x000000000041C000-memory.dmp

memory/456-338-0x0000000000400000-0x000000000041C000-memory.dmp

memory/964-342-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2792-344-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2792-347-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1668-349-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1668-352-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1908-356-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3960-360-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3796-362-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3796-365-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4568-369-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1628-371-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1628-374-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1396-376-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1396-379-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2408-381-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2408-384-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4508-386-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4508-389-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3104-391-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3104-394-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4200-398-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2524-400-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2524-403-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1584-409-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2108-413-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4880-415-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4880-418-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2820-420-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2820-423-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3496-425-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3496-428-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2220-430-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2220-433-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4912-435-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4912-438-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3504-442-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3524-444-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3524-447-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4712-449-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4712-452-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3568-454-0x0000000000400000-0x000000000041C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 14:52

Reported

2024-06-11 14:54

Platform

win7-20240220-en

Max time kernel

26s

Max time network

129s

Command Line

"C:\Windows\system32\Dwm.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PPS Accelerator = "C:\\Windows\\system32\\ppsap.exe" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PPS Accelerator = "C:\\Windows\\system32\\ppsap.exe" C:\Windows\SysWOW64\ppsap.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\ppsap.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ppsap.exe C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\ppsap.exe C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f761610 C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
File created C:\Windows\f762d86 C:\Windows\SysWOW64\ppsap.exe N/A
File created C:\Windows\f763830 C:\Windows\SysWOW64\ppsap.exe N/A
File created C:\Windows\f763c64 C:\Windows\SysWOW64\ppsap.exe N/A
File created C:\Windows\f764154 C:\Windows\SysWOW64\ppsap.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A3C0971-2802-11EF-AD12-DE87C8C490F0} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 2340 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2340 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 2340 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 2340 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SysWOW64\ppsap.exe
PID 2340 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SysWOW64\ppsap.exe
PID 2340 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SysWOW64\ppsap.exe
PID 2340 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2148 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2504 wrote to memory of 2148 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2504 wrote to memory of 2148 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2504 wrote to memory of 2148 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2148 wrote to memory of 2508 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2148 wrote to memory of 2508 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2148 wrote to memory of 2508 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2148 wrote to memory of 2508 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2504 wrote to memory of 1468 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 1468 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 1468 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 1468 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 1468 wrote to memory of 1044 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\Dwm.exe
PID 1468 wrote to memory of 1072 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 1468 wrote to memory of 1100 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhost.exe
PID 1468 wrote to memory of 1796 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 1468 wrote to memory of 2504 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 1468 wrote to memory of 2504 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 1468 wrote to memory of 2148 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1468 wrote to memory of 2508 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1468 wrote to memory of 2508 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1468 wrote to memory of 2820 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 2504 wrote to memory of 2196 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2196 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2196 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2196 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2196 wrote to memory of 1044 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\Dwm.exe
PID 2196 wrote to memory of 1072 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 2196 wrote to memory of 1100 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhost.exe
PID 2196 wrote to memory of 1796 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 2196 wrote to memory of 2148 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2196 wrote to memory of 2820 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 2504 wrote to memory of 704 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 704 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 704 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 704 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 704 wrote to memory of 1044 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\Dwm.exe
PID 704 wrote to memory of 1072 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 704 wrote to memory of 1100 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhost.exe
PID 704 wrote to memory of 1796 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 704 wrote to memory of 2148 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2504 wrote to memory of 2976 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2976 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2976 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2976 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 1044 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\Dwm.exe
PID 2504 wrote to memory of 1072 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 2504 wrote to memory of 1100 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhost.exe
PID 2504 wrote to memory of 1796 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 2504 wrote to memory of 2148 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2504 wrote to memory of 2976 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2976 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2540 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2540 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2540 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2504 wrote to memory of 2540 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\38817c655fa113fe3a04e0711c0804e0_NeikiAnalytics.exe"

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://shop58477515.taobao.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 shop58477515.taobao.com udp
US 8.8.8.8:53 shop58477515.taobao.com udp
CN 203.119.144.58:80 shop58477515.taobao.com tcp
CN 203.119.144.58:80 shop58477515.taobao.com tcp
CN 203.119.144.58:80 shop58477515.taobao.com tcp
CN 203.119.144.58:80 shop58477515.taobao.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2340-0-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2340-7-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-3-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-5-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-8-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-9-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-4-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-11-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-37-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2340-36-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2340-35-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/2340-32-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/2340-31-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/1044-20-0x00000000001C0000-0x00000000001C2000-memory.dmp

memory/2340-6-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-12-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-10-0x0000000002560000-0x000000000361A000-memory.dmp

\Windows\SysWOW64\ppsap.exe

MD5 38817c655fa113fe3a04e0711c0804e0
SHA1 eadd16e8495054c458244ec019f12bf69a021c88
SHA256 9fc2502ac0efde6f44a464fbb5c98edac22b9eef07385e333f1f89c6ca199cb0
SHA512 c8466223afdae7393bf380c0b205ccb57f8214e5afa186f3a537931e5ffe39f25f430ab2a2858bdafafef80aaa0617b16950168de3b59bc4687ea60db0b7da60

memory/2504-46-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2340-45-0x0000000004370000-0x000000000438C000-memory.dmp

memory/2340-62-0x0000000002560000-0x000000000361A000-memory.dmp

memory/2340-61-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2340-59-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/1468-69-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-67-0x00000000040C0000-0x00000000040DC000-memory.dmp

memory/2504-66-0x00000000040C0000-0x00000000040DC000-memory.dmp

memory/1468-73-0x0000000002550000-0x000000000360A000-memory.dmp

memory/2504-103-0x0000000001BA0000-0x0000000001BA2000-memory.dmp

memory/1468-102-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/2504-94-0x00000000026E0000-0x00000000026E1000-memory.dmp

memory/1468-77-0x0000000002550000-0x000000000360A000-memory.dmp

memory/1468-70-0x0000000002550000-0x000000000360A000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 641ff4d89768f2da769c02318c2c7882
SHA1 e12b689f25d741834b6805c59c9a9c569033a79d
SHA256 628c12fb4764ce3b59fe3b855fb1adb93cb90743c1fd45020486c0c7a26d7e7f
SHA512 0b8ec97b9feb981680476b347e9fed18aaa8bd24c99eee6e1326448b8c6c41c0a265dadfd121e094510800ebc74dd009d153502a380a839a5d594ed5c125507f

memory/1468-78-0x0000000002550000-0x000000000360A000-memory.dmp

memory/1468-124-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1468-75-0x0000000002550000-0x000000000360A000-memory.dmp

memory/2504-128-0x00000000046D0000-0x00000000046EC000-memory.dmp

memory/2504-127-0x00000000046D0000-0x00000000046EC000-memory.dmp

memory/2196-130-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2196-170-0x0000000000400000-0x000000000041C000-memory.dmp

memory/704-176-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-175-0x00000000046D0000-0x00000000046EC000-memory.dmp

memory/2504-174-0x00000000046D0000-0x00000000046EC000-memory.dmp

memory/704-221-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2976-242-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-241-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2504-240-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2976-263-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2540-270-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-269-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2540-273-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2064-280-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1664-287-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-286-0x0000000005820000-0x000000000583C000-memory.dmp

memory/1664-290-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2452-295-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2452-299-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1748-304-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1748-307-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-312-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2832-314-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2832-317-0x0000000000400000-0x000000000041C000-memory.dmp

memory/288-323-0x0000000000400000-0x000000000041C000-memory.dmp

memory/288-326-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-333-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2268-334-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-332-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2268-337-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2868-352-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-351-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2868-355-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2228-363-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1740-369-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1740-374-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2480-382-0x0000000000400000-0x000000000041C000-memory.dmp

memory/380-389-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-388-0x0000000005820000-0x000000000583C000-memory.dmp

memory/380-392-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-399-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2196-401-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2196-404-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1068-413-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-411-0x0000000005820000-0x000000000583C000-memory.dmp

memory/1068-416-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1304-423-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1976-433-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-432-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2504-431-0x0000000005820000-0x000000000583C000-memory.dmp

memory/1976-436-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1624-447-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1624-450-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1732-453-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1732-456-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2188-461-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2608-464-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2608-469-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2524-472-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2524-475-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2456-478-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-477-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2456-481-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-483-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2960-486-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2720-488-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2720-491-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-493-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2504-492-0x0000000005820000-0x000000000583C000-memory.dmp

memory/1012-496-0x0000000000400000-0x000000000041C000-memory.dmp

memory/376-507-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-506-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2504-505-0x0000000005820000-0x000000000583C000-memory.dmp

memory/376-510-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-512-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2504-511-0x0000000005820000-0x000000000583C000-memory.dmp

memory/1260-515-0x0000000000400000-0x000000000041C000-memory.dmp

memory/784-522-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-521-0x0000000005820000-0x000000000583C000-memory.dmp

memory/2504-520-0x0000000005820000-0x000000000583C000-memory.dmp

memory/784-525-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2504-526-0x0000000005820000-0x000000000583C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabD923.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarDA52.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4dca3068a7ca237977c13b1b57f3a1a8
SHA1 5e86950474ab7c0a9aa1c48e1a543f9f8e7bbdfb
SHA256 c2c64f70730f78ca6c005fac86cc7bc4ca36d058dd0174df6894110477a3f840
SHA512 e68d82ca0380e78cfe02f5e10e444228dec3867d9b706a3c744162ead315d1e016776b1a50e0fe9e610b1d413bfd826c8476379c52317fb3c2e292d42b743599

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7314ef2a7c50cd44a748009119e0bb42
SHA1 8842b4866847a16eb5bc216a7967abe338527dd2
SHA256 ccf19a5ef7e684482ef2a22370eabf2f2f23958731b29f44685e25412b26bdf8
SHA512 b5997fd5ce2ae01bb7bd37b9eccedbe3af1d744de24cd35fd51ab560525483d15f37c6c0e8b4d5770c35088a02fcca9ecf216c5dd734cb091df6250f24c0e96e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1cfea30f8e01098d50fed6b814432a46
SHA1 2bf9e8e6371bc4dd3618fc15c2047e48c1d83b68
SHA256 14557f69065d99802e4b33c50a6502e4eef408e2eeb037999d83ec2c0559d8e4
SHA512 89ef0f6a92a236946dbdb1d29057e66b3c75ecc55e174bcc2462120f81e327f88efd1f872bfb38f6cc1bcb531ebf7bbe248f82094dbfde138ada9eee25ec9618

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6643937dc175b73b98ea5713dc73456
SHA1 f73c271445f47e541fa7c429f8c488abf4250df2
SHA256 3c116bce1b26ff4c607e7db521e42a9031de8cd0c0b88ff13d7d5c02fa4d36ba
SHA512 afc6416492e4199380aee29bb7702b64859f1ed9036c2ac486d161a8ca0fc73a23d0b8276314bda9becfecb398b75658c25a82cafe9928d44182bf158847f5a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 967d145a438f64c2d96ba82ebc053fb7
SHA1 5d236bfd894f9b2dfa25b00bcc3aa2441a5dbbd6
SHA256 0e9482eb57783ae33a5b74d5b2e816c867c8627c51620b44382b9b0161f31622
SHA512 1f44f155b1253234aafa6d09324a89e2c4d3ad186b349f07ecafd69bfbc005a6e4d6e44cb045834c1e0e36238a609aa1c6d7b085caeba74ea35eaab7a7467aaf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 222905c5be0208d585ced15653f33dbe
SHA1 d192465239b8327d4737b7bd0b487a3e8ba3ee5a
SHA256 e89857cd01a66e7008d6a6cbfb2beb5d84de15252c07591a0606729f9d3fff4e
SHA512 fd38d829bae5105446fffd7728b34d9ba742c3271153584a8ad6f4c184c281977cdcc57772ff417a7bd58850453f588c0f196d8b9ef3054bd8f86af0e6e17af1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f675fd167aa8721c672de04d6ff9677b
SHA1 4eb50df075271bbdf376f747ae3712060e30cd2f
SHA256 0f6902bfda1ba79ce2fb9416afe6a67ffd4e52076c14b5ce38763feeb14a5eca
SHA512 730d3debf519a1bae3822295dc6940a776a2f936f115cefd9ce2e04105b8477be2ea1c9f929f2a9e619eb2176914c68ffd4feceba6382c28374715bf557de02c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 904201e1e812f5df54471cdd167ceba8
SHA1 9fa3dc92ced1c0cb7f43ae942e0dfe034beebef6
SHA256 15ec9184b52420f60fa0ac39dcaebb4818b9e613d26a1584014218bbee8e8bd9
SHA512 e1b1b30b4fb97e01792a5d50ed8561ad74c9d8a8c59073a71fc1411d6e1616b20cee85bb1298c649e83be26c734c89c2d4938a6db1a81b61504f20834e4f82ce

C:\ovxmvq.pif

MD5 68686f02a562f32704fab39a67832336
SHA1 a0fafe4d548831122710fa6fa201f9bfc1f7bd06
SHA256 099d70834ed56550414be911ffb13deb21a06cdf944350418d4d52009fb9e0e5
SHA512 c9918297f9ea0afe6848deb6ea22b488ad249be6ccb68fede7014a0ce9cc6f2f9bb9d101cfd62044bbee334186c8f85d405e060dab411265490ae44fa17b764c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 64af93b3feab66aea91fb1595880f668
SHA1 d090e074f9459fede34cca3e76b8afa5efb6267f
SHA256 5930de91411cc5c70699eb4c48a64ae497f1367c5c2bca0afa931217c49ed694
SHA512 1573c0256129878e041c892d04e0b5172fe81dfdfbaa6196797f59010595c0d92861dd01750351a9cf54378f16777ddd0904de335741e2c3a00641af6c7b2a69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb6c4c6e6a1bcf52ffcba3440183ff3d
SHA1 fd029dac0e11c997994eeca330bc0b6664df30d1
SHA256 1f07f59c36413cdfddbae3865e86da063093056c2826759d67ae46e15b89fb25
SHA512 ddbfefc987d9e60de2f48ddcd53b5988535babd419c60720ee665b6bcb5bb27e77f3b656e51bf24e2338afbd866a00d79196691870f4d1c569f659abe64aa815

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fa8c394c2bfcccbfe665f77a07fdd6e8
SHA1 232eca4cc070eb925a74745aa62030a664af3ef6
SHA256 2b37630e1a998585cc02a9000299d864f454ed9c1fee0e352b56c5a3016bb6d2
SHA512 863da1f67a93dec0a2bb142e60d0ae90af1fef5ea6c11bee8735935afde41050a391d967c86ac9cd44dad5754e1fd6005d47a051d95ecf5285f6bc4f9ff9c46b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e9c3cb7e9af76a2701b162dbbe60f36
SHA1 48d5beda84e28a7126d46eef5ce9934be37e773f
SHA256 939a9cd90059ac3b782d738d274d6a3b1d2c1b70a8b7336fe57e6e8271674f8d
SHA512 8998faee7c64b909edfd1900685ff37713d0cb4c4de9d41af4e1edbaf6e8077a5f58c5d33b3aa6ececc61d9c488ba8be71c932b39c54e84eb79256b36452cccb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b35641b419074766360171b9370db5c7
SHA1 dabe6dde2f82e5ea1dbca11eea630181e2007e01
SHA256 f786befb5729ada374b21891cea8c8a89b91cfb418c43c6b6ff2f4d7cf8fdd93
SHA512 57db74eb3f8739b955df85b2b78c34a89365567ea101caef220156dfc7ce0f2757c5148aa3aa875fc3aa288aa3cd80172a13a3b7f272de5b4731be712eba7fb3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61de5f992c4a33c35ba11311a0d4ccc6
SHA1 7d6c942201d102494ce085fb021ab5c7adce38b0
SHA256 07144f77f027929dccd8fec44bbe6d4d9798b909ed79950f0878f7ecc340d531
SHA512 726b3d48d704938dd6141747bd7da63c38532632612240d4d7ce0eb733aa4829f34416fe8a8a88005f087ad31f5db103a0aec47ceed5321ecd7e42bf01f9653e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 14e4b0e707e8de81a71101eba1347c07
SHA1 9eecfbb10a4a73800aca4c610331e52b86820a8a
SHA256 e5753b197177de65f8bff7aacfabf71b53cbff3731781ba068eb1b10f4f61d00
SHA512 591804b381257a8f7992200a8b6c3efa21a5077cd5f10ebf2f0f0f26d4d4d42fd6eb010a3e2b853d5901665b6552ae5b16b2708fcf65032611951ddaf3687a37

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87746d4e60c83fddfb7f4e3d2cc7d54d
SHA1 33f9241e89222b222e70bfb6cfda6deaada91928
SHA256 adabf7016551db481076a1cf1ec97c83440fc3a37c7174f448aa78d853bf89b6
SHA512 4433b4ff7e787477128fe717c8adddfb2cbfcc1a9b85251c914ebd07bb383f6a7bbbe3f40035ba9bc79336e5c9f0dccfb9296c76c00a8422c2d47d59d7b59fb3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3e5b3e6a3188eab5c9109f2fa3cd1e6
SHA1 72433a08974a22e06379424bb400b509df9816ae
SHA256 bec4135624a2fc9987defe4335a052cb982f056788f4740bac79c99c328d008a
SHA512 5e949411d4f7bc2ffcc5372e0da27ea9709514705ecd278281bc211b187f3326f849d26160621a951f6d6697f3517b01fdcf6e90f7ea8b82bc99b540018bb6a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ad4c218dabc3db49b67dd43fe3a9c07c
SHA1 f17e543b515506ba290a349cc1c6fdd6f5d207c8
SHA256 fb05fa30f7835e39021b7b313128f9ec84a358aced28d9b2fcfd72884824991f
SHA512 49f69b90758714bb5dc102be87fb06fd6708a5a0d0ff6bcf6f550b1fe989d5e880cabb4685fe85b4d8148b26e8c740e9ec51de699949d9fe54da989ea88f7cab