ramnit | 04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe
Size

384KB
MD5

996c62c43013653ccb15711c62875d90
SHA1

d91ae854d03c95b5d05d42892d1f3d19fc5ced34
SHA256

04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e
SHA512

f83b01bc275db8c88079eaf330282784aea939cdfa0d4dbb68aae86a6fd2d588858ddd23f5ca9933b930a94ea1ab4ab67fb300bebaeb67ce4235e6815ecc9c0f
SSDEEP

3072:ZRbn3k0CdM1vabyzJYWq5yuUt9zeQDJBPQismhLqP46Ov3oG3fmJGHaMrayh4MJO:ZRD0LS6VKDzNde5w6G4s3haDYd8oI

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 5 IoCs

Processes:

04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exeWaterMark.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exe

pid process

2704 04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
1016 WaterMark.exe
4088 WaterMark.exe
1440 WaterMarkmgr.exe
1588 WaterMark.exe

pid	process
2704	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
1016	WaterMark.exe
4088	WaterMark.exe
1440	WaterMarkmgr.exe
1588	WaterMark.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2052-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2052-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2704-24-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2052-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2052-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2052-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2052-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2052-5-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1016-62-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1440-60-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral2/memory/1016-56-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4088-55-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4088-38-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/1588-76-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/1440-72-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1588-83-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4088-94-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 10 IoCs

Processes:

04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exe04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exeWaterMark.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px536F.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px5294.tmp	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px5294.tmp	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4820 4540 WerFault.exe svchost.exe
2036 1856 WerFault.exe svchost.exe
3928 3048 WerFault.exe svchost.exe

pid	pid_target	process	target process
4820	4540	WerFault.exe	svchost.exe
2036	1856	WerFault.exe	svchost.exe
3928	3048	WerFault.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115889"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4BC05268-3664-11EF-B1BC-6A62353F6641} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4BB90430-3664-11EF-B1BC-6A62353F6641} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "540541772"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "542885768"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "540385761"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "542885768"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "540541772"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115889"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115889"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "542885768"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115889"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115889"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "540229484"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "540385761"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "540385761"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115889"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4BC07978-3664-11EF-B1BC-6A62353F6641} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "542885768"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426463962"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

WaterMark.exeWaterMark.exeWaterMark.exe

pid	process
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
4088	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1016	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe
1588	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WaterMark.exeWaterMark.exeWaterMark.exe

description pid process

Token: SeDebugPrivilege 4088 WaterMark.exe
Token: SeDebugPrivilege 1016 WaterMark.exe
Token: SeDebugPrivilege 1588 WaterMark.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

1940 iexplore.exe
5064 iexplore.exe
2072 iexplore.exe
804 iexplore.exe
1808 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	4088	WaterMark.exe
Token: SeDebugPrivilege	1016	WaterMark.exe
Token: SeDebugPrivilege	1588	WaterMark.exe

pid	process
1940	iexplore.exe
5064	iexplore.exe
2072	iexplore.exe
804	iexplore.exe
1808	iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
804	iexplore.exe
804	iexplore.exe
1808	iexplore.exe
1808	iexplore.exe
1940	iexplore.exe
1940	iexplore.exe
2072	iexplore.exe
2072	iexplore.exe
5064	iexplore.exe
5064	iexplore.exe
4456	IEXPLORE.EXE
4456	IEXPLORE.EXE
4316	IEXPLORE.EXE
4316	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
464	IEXPLORE.EXE
464	IEXPLORE.EXE
4456	IEXPLORE.EXE
4456	IEXPLORE.EXE

Suspicious use of UnmapMainImage 6 IoCs

Processes:

04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exeWaterMark.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exe

pid	process
2052	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe
2704	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
4088	WaterMark.exe
1016	WaterMark.exe
1440	WaterMarkmgr.exe
1588	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 2052 wrote to memory of 2704	2052	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
PID 2052 wrote to memory of 2704	2052	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
PID 2052 wrote to memory of 2704	2052	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
PID 2052 wrote to memory of 4088	2052	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe	WaterMark.exe
PID 2052 wrote to memory of 4088	2052	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe	WaterMark.exe
PID 2052 wrote to memory of 4088	2052	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe	WaterMark.exe
PID 2704 wrote to memory of 1016	2704	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe	WaterMark.exe
PID 2704 wrote to memory of 1016	2704	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe	WaterMark.exe
PID 2704 wrote to memory of 1016	2704	04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe	WaterMark.exe
PID 1016 wrote to memory of 1440	1016	WaterMark.exe	WaterMarkmgr.exe
PID 1016 wrote to memory of 1440	1016	WaterMark.exe	WaterMarkmgr.exe
PID 1016 wrote to memory of 1440	1016	WaterMark.exe	WaterMarkmgr.exe
PID 1440 wrote to memory of 1588	1440	WaterMarkmgr.exe	WaterMark.exe
PID 1440 wrote to memory of 1588	1440	WaterMarkmgr.exe	WaterMark.exe
PID 1440 wrote to memory of 1588	1440	WaterMarkmgr.exe	WaterMark.exe
PID 4088 wrote to memory of 1856	4088	WaterMark.exe	svchost.exe
PID 4088 wrote to memory of 1856	4088	WaterMark.exe	svchost.exe
PID 4088 wrote to memory of 1856	4088	WaterMark.exe	svchost.exe
PID 4088 wrote to memory of 1856	4088	WaterMark.exe	svchost.exe
PID 4088 wrote to memory of 1856	4088	WaterMark.exe	svchost.exe
PID 4088 wrote to memory of 1856	4088	WaterMark.exe	svchost.exe
PID 4088 wrote to memory of 1856	4088	WaterMark.exe	svchost.exe
PID 4088 wrote to memory of 1856	4088	WaterMark.exe	svchost.exe
PID 4088 wrote to memory of 1856	4088	WaterMark.exe	svchost.exe
PID 1016 wrote to memory of 4540	1016	WaterMark.exe	svchost.exe
PID 1016 wrote to memory of 4540	1016	WaterMark.exe	svchost.exe
PID 1016 wrote to memory of 4540	1016	WaterMark.exe	svchost.exe
PID 1016 wrote to memory of 4540	1016	WaterMark.exe	svchost.exe
PID 1016 wrote to memory of 4540	1016	WaterMark.exe	svchost.exe
PID 1016 wrote to memory of 4540	1016	WaterMark.exe	svchost.exe
PID 1016 wrote to memory of 4540	1016	WaterMark.exe	svchost.exe
PID 1016 wrote to memory of 4540	1016	WaterMark.exe	svchost.exe
PID 1016 wrote to memory of 4540	1016	WaterMark.exe	svchost.exe
PID 1588 wrote to memory of 3048	1588	WaterMark.exe	svchost.exe
PID 1588 wrote to memory of 3048	1588	WaterMark.exe	svchost.exe
PID 1588 wrote to memory of 3048	1588	WaterMark.exe	svchost.exe
PID 1588 wrote to memory of 3048	1588	WaterMark.exe	svchost.exe
PID 1588 wrote to memory of 3048	1588	WaterMark.exe	svchost.exe
PID 1588 wrote to memory of 3048	1588	WaterMark.exe	svchost.exe
PID 1588 wrote to memory of 3048	1588	WaterMark.exe	svchost.exe
PID 1588 wrote to memory of 3048	1588	WaterMark.exe	svchost.exe
PID 1588 wrote to memory of 3048	1588	WaterMark.exe	svchost.exe
PID 4088 wrote to memory of 1940	4088	WaterMark.exe	iexplore.exe
PID 4088 wrote to memory of 1940	4088	WaterMark.exe	iexplore.exe
PID 4088 wrote to memory of 1808	4088	WaterMark.exe	iexplore.exe
PID 4088 wrote to memory of 1808	4088	WaterMark.exe	iexplore.exe
PID 1016 wrote to memory of 2072	1016	WaterMark.exe	iexplore.exe
PID 1016 wrote to memory of 2072	1016	WaterMark.exe	iexplore.exe
PID 1588 wrote to memory of 5064	1588	WaterMark.exe	iexplore.exe
PID 1588 wrote to memory of 5064	1588	WaterMark.exe	iexplore.exe
PID 1016 wrote to memory of 804	1016	WaterMark.exe	iexplore.exe
PID 1016 wrote to memory of 804	1016	WaterMark.exe	iexplore.exe
PID 1588 wrote to memory of 832	1588	WaterMark.exe	iexplore.exe
PID 1588 wrote to memory of 832	1588	WaterMark.exe	iexplore.exe
PID 804 wrote to memory of 2392	804	iexplore.exe	IEXPLORE.EXE
PID 804 wrote to memory of 2392	804	iexplore.exe	IEXPLORE.EXE
PID 804 wrote to memory of 2392	804	iexplore.exe	IEXPLORE.EXE
PID 1808 wrote to memory of 464	1808	iexplore.exe	IEXPLORE.EXE
PID 1808 wrote to memory of 464	1808	iexplore.exe	IEXPLORE.EXE
PID 1808 wrote to memory of 464	1808	iexplore.exe	IEXPLORE.EXE
PID 1940 wrote to memory of 4316	1940	iexplore.exe	IEXPLORE.EXE
PID 1940 wrote to memory of 4316	1940	iexplore.exe	IEXPLORE.EXE
PID 1940 wrote to memory of 4316	1940	iexplore.exe	IEXPLORE.EXE
PID 2072 wrote to memory of 2464	2072	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2052

C:\Users\Admin\AppData\Local\Temp\04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
C:\Users\Admin\AppData\Local\Temp\04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2704

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1016

C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
"C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1440

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 204
7⤵
- Program crash
PID:3928

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5064

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5064 CREDAT:17410 /prefetch:2
7⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4456

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
- Modifies Internet Explorer settings
PID:832

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 204
5⤵
- Program crash
PID:4820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
PID:2464

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:804 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4088

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 208
4⤵
- Program crash
PID:2036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:17410 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4316

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:17410 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4540 -ip 4540
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3048 -ip 3048
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1856 -ip 1856
1⤵
PID:1128

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe
Filesize
384KB

MD5
996c62c43013653ccb15711c62875d90

SHA1
d91ae854d03c95b5d05d42892d1f3d19fc5ced34

SHA256
04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e

SHA512
f83b01bc275db8c88079eaf330282784aea939cdfa0d4dbb68aae86a6fd2d588858ddd23f5ca9933b930a94ea1ab4ab67fb300bebaeb67ce4235e6815ecc9c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
eda5e3a600f594e99c2ec43eef199003

SHA1
fd0ab6372b227debea03d04406468712b027f440

SHA256
c0979c9bc3beb96221ee8118627db2c5599cadb0826b111a12cb6c831527d90a

SHA512
9a166a02ba821a5e2cbe4f4273bf9e0d943ba358b98ead07703666bbabe87f8bd33d85bf7d52c3bbd3d4cfada18e56a2081acb057631e54d6ccfcc2ccb6459a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
88dfe852ca35f5faa1cc10a6cc77562c

SHA1
16826dfe2a24292603f9a61e826b003b84adec7c

SHA256
2e31e47d69294b8e6d4bd95c98b4d4bd396632eb4fe80e6bd648ef52a6a765a0

SHA512
4f1ccc68e2981f564eeadb39736f03378bfc296c90429dcffacf132d49ab9a00b16b6a7cca435159f52103edee496ef075594dea0f1980db703be49d0d372727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
1f3c7e5e8833a1bf46623eb94dc6701d

SHA1
031c849e909627ad07e5bf2a0c751e5568580085

SHA256
9b2605a166b7b7931d81193fa13426a6584b53cc006b1d493266e00b5c824d0d

SHA512
47abc39c8aaa961438f22636f2b2972f33b53349a0cd661cba07ca3d031fe2c4d61663a43d47fd5f734d7c24b8cb3d260d5457dbffb6e5f00ffcd80b09828ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
1bd0c57f542c677279af01e940d6172f

SHA1
7adf1cc10f0ff34f93ee24bae1bcd85490eb0409

SHA256
5279c27a8f43d33c60fe0a9e291caa359c7b39dbbd9db358686906a3d6a657ab

SHA512
5c8297a6c3ea11fc7c56aec65f38ec198e067258f89059716260ea4a39726bcf8dd666e2fc61b18f2dfeb0c86b40bbde9ca6f05dc620f46e36fcb943951e77dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BB90430-3664-11EF-B1BC-6A62353F6641}.dat
Filesize
5KB

MD5
207f13b4472ac807fab1c8b0934a01f8

SHA1
bb1fd5e4375d356bdadb45299458d081bbffdd84

SHA256
b439cdc513c7e41369f14108cdc6af5499a89dd5be9a677cb19b5f425b5ed01f

SHA512
125d693478450b670f52e5ff5527341a6262a84d83a068d4e54fd98c70eee4ee3e9e0877558c150023e19a4f963a29b4506d303a7b767bcade69f6696a039474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BC02B58-3664-11EF-B1BC-6A62353F6641}.dat
Filesize
3KB

MD5
9d01dfae61b0fd2627f9f6bc5d3ca2cc

SHA1
3257cd3a431aff18b39f2e571a5911e204f55ee7

SHA256
bee84adb7beadbad4c25c7b22546db110e55439ccf42a153816b1c30e2e0a3e8

SHA512
752e5c979522a7dd574008f5507767ffa9102ccc42276ddc7fc4102113a5a177aea4c4988550232b0d3bcc5377836ba436cb3b1cb1582dad21829756942a69df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BC02B58-3664-11EF-B1BC-6A62353F6641}.dat
Filesize
5KB

MD5
2e6e830608e4873c7f7d2171d71c7347

SHA1
7546c3e33b394fafa0af5fff0a115ec501b6ec79

SHA256
07137ba6d095c8c8fa88ccfccfc4080089f2e51003a5fc6d159013cc96dd87e4

SHA512
5b85935d83b822f3eac221de23cad38a70959bbe572a9ccf343375312c53e49b60d93b57d2418a4d9b56f5e528dd97d1309edc8e5d6345e488c54acfc1c63d72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BC05268-3664-11EF-B1BC-6A62353F6641}.dat
Filesize
3KB

MD5
ff8bfaac502da77fc785b77ad8219e8f

SHA1
7ab97571d3e8f83f56388547d3717e1509487b16

SHA256
74b701210bc1ad33d62a759e77c2b29922c22bb9bc31531c4bdc339940f9ee9c

SHA512
33de73afe054c586a683214352db2e613e11c46047dbfc28145f1d21100df0cf074dc7ade7933e5bf75e67519f6b678a8c42f92884d050970ae8e9aaf5eaa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BC07978-3664-11EF-B1BC-6A62353F6641}.dat
Filesize
5KB

MD5
c9542766db6e49c050dad71a777bb984

SHA1
d878ee63ecfd5582372e33c47f7641ffd8a47e77

SHA256
1ffe6715c1b9a97ccdca0dfffadc9ecc131a268cd2f7928e6c0f63c81b13c683

SHA512
34fa69548e4d1ef2475c4ea9cef58cf429f224b2ca374fc7096a9d256ab76da0ce5f7c9474b4d2a5f563155f09cc1fc4f81687b24aa915b9c0af43272d2fe3bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD65C.tmp
Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\04ed3acbb8ab4546d3f0fdcf12ab7e64d8b772da82db356842c1a53b02963a5e_NeikiAnalyticsmgr.exe
Filesize
191KB

MD5
e2eb051d51dd5a956b7070c03fcf467f

SHA1
e5d9ce816454cddf643719ef71b6891fd8c0e429

SHA256
c05dc40a59dc4c41af052c5a9e02e72545f62bbe8b908ec9114183daef880576

SHA512
e09268688bc34ba899fffa8f42daed6916fabc2eaa8b5a8887fd4a27d3745dfb6c9f6bc05282371fe4b8eb2b1ff0c9e15a3d1abdaacb820a7ba89c285b5dc2fd

Download Submit
memory/1016-37-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1016-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1016-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1440-74-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download
memory/1440-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1440-72-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1440-73-0x0000000000416000-0x0000000000420000-memory.dmp

Filesize
40KB

Download
memory/1588-83-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1588-76-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1588-79-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/2052-16-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2052-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2052-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2052-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2052-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2052-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2052-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2052-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2052-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2704-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2704-24-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4088-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4088-86-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/4088-94-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4088-38-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4088-61-0x00000000776E2000-0x00000000776E3000-memory.dmp

Filesize
4KB

Download
memory/4088-54-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/4540-84-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/4540-85-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download