Malware Analysis Report

2024-11-15 05:45

Sample ID 240614-b7glasvapn
Target 986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe
SHA256 e31469db6210a1270ffd7e1f0f53776f6b3e30b8a7f839010b77754f2c10f1d8
Tags
upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e31469db6210a1270ffd7e1f0f53776f6b3e30b8a7f839010b77754f2c10f1d8

Threat Level: Shows suspicious behavior

The file 986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx

Loads dropped DLL

Deletes itself

UPX packed file

Executes dropped EXE

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 01:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 01:46

Reported

2024-06-14 01:49

Platform

win7-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3008 set thread context of 2544 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 788 set thread context of 2368 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 3008 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 3008 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 3008 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 3008 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 3008 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1988 wrote to memory of 2728 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1988 wrote to memory of 2728 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1988 wrote to memory of 2728 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1988 wrote to memory of 2728 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 688 wrote to memory of 788 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 688 wrote to memory of 788 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 688 wrote to memory of 788 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 688 wrote to memory of 788 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 788 wrote to memory of 2368 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 788 wrote to memory of 2368 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 788 wrote to memory of 2368 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 788 wrote to memory of 2368 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 788 wrote to memory of 2368 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 788 wrote to memory of 2368 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

Network

Country Destination Domain Proto
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp

Files

memory/3008-2-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-3-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-13-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-9-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-7-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-5-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-11-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-23-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-21-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-19-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-17-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-15-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-25-0x00000000003A0000-0x00000000003F5000-memory.dmp

\Windows\SysWOW64\kernel64.dll

MD5 9b98d47916ead4f69ef51b56b0c2323c
SHA1 290a80b4ded0efc0fd00816f373fcea81a521330
SHA256 96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA512 68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

memory/3008-33-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-32-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-31-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-29-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/3008-27-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/2544-68-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2544-70-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2544-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2544-76-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA

MD5 f697e0c5c1d34f00d1700d6d549d4811
SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

memory/2544-74-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2544-73-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2544-78-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-86-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-100-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-98-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-96-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-94-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-92-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-90-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-84-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-82-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-80-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-88-0x0000000000110000-0x0000000000165000-memory.dmp

memory/2544-77-0x0000000000110000-0x0000000000165000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

MD5 a4ef93de80711124d4b7e080ccf42edb
SHA1 f4530f5e6d362781fa6dfa4982d25f3ad15dbf99
SHA256 9a09d2a2b23760cbc02ab362728b30783f943d90beebbdbd03c4e8b288492d24
SHA512 707c5a1a84a1cd490e3e0109c30b32724a69d27021653265bbd838065458e1eea20b470f145612f9ea5486711c47a59dcb515f9625829e63689a89af75901fa2

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 5b85700764c7f8ed2db3d99aba090ff3
SHA1 89521db8d1abb29e082628efdd23c547fa54ef44
SHA256 ade5e3636e8684f5845c18666a04a6b22d7a0f2631ea268a1aec910857c42e24
SHA512 00600e12dc1067eba53760eedfc4f408e88053a87462d55f01478887a9b4095138d471cc186684f0c14f4c2559da978e0ef3f78341910ecf1ca8caac9f67a642

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

MD5 fd1a69df1d37e13075e79ebcb161f096
SHA1 771fcf5423f8e0bd63f9771e88a8063ff9e3384d
SHA256 c0d736114a433a5c9c93fc8b03727d55c674f68ec6ee431b36514200c4d51329
SHA512 04acdce07c62cb85e82542a49aaed2cfb2b980e2c0035754cd0eda3e70e469ab9e5b30f1c62550e22c3ef92c7aff971bd38f8154edf9aad9424abacd207ce8f9

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

MD5 7315f09e63adabf25fb1e8a499a57a81
SHA1 134a68783f6b2e7106dc936b103969c5c0855db4
SHA256 afe5e8bbb3b9dbf4b9aeb5959360a99aa0c39114c48b912c1f7484798a8ba248
SHA512 f4451d9b87d5fa4734db37e4ec9944d51a18df33693a5406f565e14347fc61fa876f36f37b9e7478c2fd31f1f7fab500fb898ff4dec9bf68cf165378a42e8f33

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

MD5 0031d28219f905f778fe3c2daf89ef1b
SHA1 df7c79a1e660d744d6cb38287a90edf3cca105dc
SHA256 4a4461327b2d811d8535e40abf90a20298e0a54b9b9b066abf031fcd1830fcca
SHA512 a5f64edc270f500314e1e1f305bf7e458a3050a7bb52ef5273d9accd896fb80e4573a9357b1757f565c93a187e742470502380fce88650e96bfbdb00e9e2492e

memory/2544-166-0x00000000001E0000-0x00000000001E1000-memory.dmp

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

MD5 a4e97b7eaaef667d7a4d579fcbcbfa89
SHA1 451364eec93692017f7f51660bef9139463f635b
SHA256 943821f1d65be27c01835b14cda839f1a5f39ff4eb3e28432137b02f44deb4a7
SHA512 7b46acb6a5a5a6d7ee306518fb3ee280b305e6485cdcd05787ffcd8f38466cfa879a4f404d9a387e8d81d73e7606e35b29d0563c2e0cd825828cfca31e49c053

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

MD5 f0d4d2cd02a2dc511273710400401225
SHA1 a05f2c855225b624dc5a3a32c5d0576bc43386c4
SHA256 2570bb2b18d9bb9f1032cef04637203718c45b9fe20e788c7632bc86fd4a435f
SHA512 b4d993b888379b8891a850ae35688ecade48c7151d1c8cbb169150cda2e9c8c35dbb45174c901adf5c8bf29037a132bbfcf3bdd69d152525c9df17afe5796b37

memory/2544-250-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 01:46

Reported

2024-06-14 01:49

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4900 set thread context of 1104 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 2968 set thread context of 2304 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4900 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 4900 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 4900 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 4900 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 4900 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 4900 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 4900 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 4900 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe C:\Windows\SysWOW64\svchost.exe
PID 1556 wrote to memory of 2968 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1556 wrote to memory of 2968 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1556 wrote to memory of 2968 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 2968 wrote to memory of 4532 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2968 wrote to memory of 4532 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2968 wrote to memory of 4532 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2968 wrote to memory of 2304 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2968 wrote to memory of 2304 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2968 wrote to memory of 2304 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2968 wrote to memory of 2304 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 2968 wrote to memory of 2304 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

Network

Country Destination Domain Proto
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp

Files

memory/4900-13-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-31-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-33-0x0000000002170000-0x00000000021C5000-memory.dmp

C:\Windows\SysWOW64\kernel64.dll

MD5 eccf28d7e5ccec24119b88edd160f8f4
SHA1 98509587a3d37a20b56b50fd57f823a1691a034c
SHA256 820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512 c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

memory/4900-29-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-27-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-25-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-21-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-19-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-17-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-15-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-11-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-23-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-7-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-6-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-3-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-10-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-2-0x0000000002170000-0x00000000021C5000-memory.dmp

memory/4900-32-0x0000000002170000-0x00000000021C5000-memory.dmp

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 de5e42d8779e73d0e9ad0e26baf98044
SHA1 0c6346fc1f5b1158cad3606759c4c08fa0c90262
SHA256 75865a57ae5285034d324963b62b1028e260fc8a7cb8b5af70ff553ed8967644
SHA512 045547935db37cad73297abcba843839253d2f5965f12880d72ada98e646e7d2b90c696b02d2099804b2dd36afcc57b497ad7c20e713d0e61a1766791f911052

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 aaa9c44ef01ba2530203794669f188b3
SHA1 35952a3e9ca0736f54af1314d2dd60d4a724d790
SHA256 ee99c06a1b698b51e96b167902f05821290aeb604ed9b22d758adfd492326069
SHA512 1fa0f686ae43ca0384511a8e225738fcd16c0aa0ef51cb6d420360d2233b8dec8840e9f19ad580aff34789e8e38ea2a406383210b4b32fa201c29e49dc8aaf0f

C:\Windows\Web\606C646364636479.tmp

MD5 f697e0c5c1d34f00d1700d6d549d4811
SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

memory/1104-97-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1104-100-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1104-103-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1104-101-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1104-105-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-115-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

MD5 fd1a69df1d37e13075e79ebcb161f096
SHA1 771fcf5423f8e0bd63f9771e88a8063ff9e3384d
SHA256 c0d736114a433a5c9c93fc8b03727d55c674f68ec6ee431b36514200c4d51329
SHA512 04acdce07c62cb85e82542a49aaed2cfb2b980e2c0035754cd0eda3e70e469ab9e5b30f1c62550e22c3ef92c7aff971bd38f8154edf9aad9424abacd207ce8f9

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

MD5 a4ef93de80711124d4b7e080ccf42edb
SHA1 f4530f5e6d362781fa6dfa4982d25f3ad15dbf99
SHA256 9a09d2a2b23760cbc02ab362728b30783f943d90beebbdbd03c4e8b288492d24
SHA512 707c5a1a84a1cd490e3e0109c30b32724a69d27021653265bbd838065458e1eea20b470f145612f9ea5486711c47a59dcb515f9625829e63689a89af75901fa2

memory/1104-131-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-129-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-125-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-123-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-119-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-113-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-111-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-109-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-107-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-127-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-121-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-117-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

memory/1104-104-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg

MD5 9447e9b39545944dced82b229de151ad
SHA1 ec4290ab4d16cb85b1d4d027b51259f115758441
SHA256 18ecdf800a0117d467438f1ed4a55d76b0946ded2c490abcd55a5983147f791d
SHA512 62c3f3ea77a20d52ddce3f6032dc8f4fa67ac2aeb16233b3287d7218ccf211e70b54d5a2caba59ac39eac260050f88b5c1b8b61e95e1ab709d8c4e46c4066c2c

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

MD5 0511418665159520f5b765c1a992e6bb
SHA1 e2dced15b7e04778e6b5071d09b77f4845fbb6cf
SHA256 622836767d22d1dc31444106daedfe35e9b8922ff3625af5246874e0334e8021
SHA512 990717c47ae278611eecb488035ed1c246a2aedc337fbe629c98a17963c1ac64fb51f75fab4e9377fafba6ceeea8953ddccbf13fbb9c1a5f492ba5b6d3b14897

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

MD5 90be7200e28d83d9e1ec151f34956999
SHA1 b49426fa21da572110249568d42bbbead1952f49
SHA256 f862e42dfe696913495d53c3631aeba6b4193fd2216d454ac0e68fc6f7a058f5
SHA512 16582f4a811823807f02e6d86d7d11591b2940350a1dea66cf7c4b959a45078c2f526d93843cb1189e69ed053c130bfda5bdb4e53f48cd67194b229e63683621

memory/2304-197-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1104-245-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2304-246-0x0000000000400000-0x000000000042D000-memory.dmp