Analysis
-
max time kernel
126s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 01:42
Static task
static1
Behavioral task
behavioral1
Sample
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe
Resource
win7-20240611-en
General
-
Target
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe
-
Size
3.4MB
-
MD5
b9527864b1e0b4a603122d136bd479f0
-
SHA1
f0aa988aa2ba84d0fc676df9815ec1658a5b2728
-
SHA256
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7
-
SHA512
a86718bdec1719c7decaa4dd18224b28566833d9cbdab3025b79494f814f35173740bf20e2dfc19a6b7e79c17cef44fdc3a250df280398c79aef6b68f27b5035
-
SSDEEP
98304:tI8y0dxX9+H9ioFYyqiGKOsZgEWtEnyrtA7:a8F389vHOsZq8yrtQ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Loads dropped DLL 14 IoCs
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exepid process 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/1856-62-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-64-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-28-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-6-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-63-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-53-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-65-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-17-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-66-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-137-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-138-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-139-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-141-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-140-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-143-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-144-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-145-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-147-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-149-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-151-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-159-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-161-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-163-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-165-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-167-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-168-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-171-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-173-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx behavioral1/memory/1856-192-0x0000000003F20000-0x0000000004FAE000-memory.dmp upx -
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\V: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\W: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\Y: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\E: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\J: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\R: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\L: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\O: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\M: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\N: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\P: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\S: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\T: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\G: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\H: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\I: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\Z: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\X: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\K: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\Q: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened (read-only) \??\U: 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process File opened for modification F:\autorun.inf 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened for modification C:\autorun.inf 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Drops file in Program Files directory 5 IoCs
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exepid process 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription pid process target process PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2176 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe DllHost.exe PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe PID 1856 wrote to memory of 1116 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe taskhost.exe PID 1856 wrote to memory of 1168 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Dwm.exe PID 1856 wrote to memory of 1232 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe Explorer.EXE PID 1856 wrote to memory of 2848 1856 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe conhost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4783f77c301756d9d7f4e1e05f7c4d6672fd814ed43e4d1fa64a9719505c29e7_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1622449210-1925294778-89761166344252798-995134187-16252969049579706541543104410"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\hextr.pifFilesize
100KB
MD52099e7a738764441e96abd1f5cfb46f4
SHA1d325b98472a3a9713fb5c4f893a62ae7306d9c4a
SHA256772c05ad185c7b02e707f39010c6249b0c201008783a7fcd2d6462457a47d305
SHA51289b3d19e34d7fda9b3db7a8d2bc574e65134add60433ee8cf5755be1c0d786288c904c1ffbe6721d2298a28cdc6eab4023313dbe15c3bccf02bb7db82b0f0401
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\08b2d0f23c26f1819efabe6770bce185\Byte.dllFilesize
108KB
MD508b2d0f23c26f1819efabe6770bce185
SHA19bfabd5fa152776da0f8fe6301a397900f6aae13
SHA256d337b0851d151e769335d6935bdbafc02258c207e83f53e1340af7890be90614
SHA512a91dc7f6392d6ac6e2c9c98cc19754e84672c2274daacd3eab2c9b1ab5343733ae53dee291abdb885b7636654c00f06e578805fe64770358ba8b11ec11160d50
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\093e99f506efdfeda3e49656d5cfd64e\API.dllFilesize
20KB
MD5093e99f506efdfeda3e49656d5cfd64e
SHA185866e5eb3c3121fbd4853ec841e909525d61219
SHA2567cec0782bb552d46c9aba873b87da56db3caab4a2cde8e509f079d9a59926322
SHA512e75bab77110dd20e8e4fca70c993c7c5d00d2e422ea32a80adfecd6c9f8d0817da998eeb4481f8f833a42b15a16162ef44d3be1933c5cf14b98388c99dbb8365
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\0ca8ac2a328a9912f911f262be9f77c4\Unicode.dllFilesize
24KB
MD50ca8ac2a328a9912f911f262be9f77c4
SHA1b987f083decb908594f092cad7e584fe0b85cadd
SHA256500c002073656cd21aa64154e459c67a32062f1e141dc771e421b28c9fe110ce
SHA51258ee1b8495412801f7c3e457d26ad1823631526c9dca0627065d58a98d36db63fd015a1c1fb2200b65040e072089d2642517e9fe3bf28bdb78f1b5cbece67da7
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\1bcb5a06611a3509fa395d40edf46f91\Event.dllFilesize
44KB
MD51bcb5a06611a3509fa395d40edf46f91
SHA101b544b32d85f97d38b85608e2de6c5582194b92
SHA2564db33245560395d0d7aa6878085be7c77735b7ff7b8e15e373af9f6f2569862e
SHA512d9cc4fda4c27d2add04c6b8b8de32b521abf0e503ad40aab15da2f4e4fe983ba72881fbe16f62327d59a46d6839676d4396ad05c5ec5de85697aa126933ce78a
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\44126313885eaf8807ec01b9113f6704\perl516.dllFilesize
1.3MB
MD544126313885eaf8807ec01b9113f6704
SHA1455a82028bda2e7aa623d7dde6686968b496733a
SHA25679bcccfd032ad92d0d6ad2f4e38f0f038a800e4b04b1302daa6cb2e3cd5222ea
SHA5121ba74002bc92c0c2893895637289b1b7f281a57b810e3d165d88c0acf91ef85df1b415f00c1e51c8527ebfb6152ccf9e83e07857388d237c804f5694bb5e028a
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\6875a065bdba79a9ecfc842d80e53d9b\Tk.dllFilesize
572KB
MD56875a065bdba79a9ecfc842d80e53d9b
SHA1dea0051134275e96506fe8a62dcda0c310731abc
SHA25693f3ff02b96e6dbb9137b66e2bfe909f3ada62f07b20bd1bc0bf2ffb5a0e52f7
SHA512368c1d41ecd33b0d09b9a95355310a69ed1834c61c2c12b1792cb943e30e6d31161661835ae976158a53bad91e8cfb3e64cc34595b2c550938ddb6e53e3456fd
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\85ddabcba13d2102dd323169bcce8ea6\encoding.dllFilesize
24KB
MD585ddabcba13d2102dd323169bcce8ea6
SHA1f4db3ef18195de8eea0b8a681867a10a6e25202f
SHA256a1b3b5af569761f1e24d652eafa1d226cb00a9add48ca9b99dfac37f42a7de6e
SHA512969a75baa0588d418fd2cf38e04a15b00306f2a665b429d3bfa5914bf16deb30c342efd03d472b8c721b7916b5dba3e9b6e3ce274653659531787814729af411
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\a47179aca60dab96afa6872f74273a87\Util.dllFilesize
24KB
MD5a47179aca60dab96afa6872f74273a87
SHA152c95b72b96e2702409b468e828e639b5ca67b12
SHA2569ff175f4cd219881d83578c1f4323cca567dc1245c4873bb55e26725587ec70e
SHA5129b8a8aa884cf98aaee60b2e0bf9cb8d1ca4d4b0973580b4e7a8dc004b6da38a4379811710e0af68723877d2093c6306fa7733bc47db945c26f5bc74e355ab911
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\a83b2a96b86f51d35c9bfb01f2da3ced\Encode.dllFilesize
32KB
MD5a83b2a96b86f51d35c9bfb01f2da3ced
SHA115ebab956951d138aaa90f0ee3f592f70070af41
SHA2569abe849c507756a5a07dec517fac99bb77f529ec678bdd9e446ed8bc15c946a8
SHA512fb9c32e4a5610b6c82407d27e31c3e7b98c3e0ec3590c9ded381b4609f3f528909eed8ff2078f1f72186e9bc0785ff66fcac1bcf5bf4df860f3fcfb71e08239b
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\aa7919800012015d4e019f000cafc326\Socket.dllFilesize
28KB
MD5aa7919800012015d4e019f000cafc326
SHA12defca7373ae7d29b720bebb741fa8e00e81a4a1
SHA25697c6f2677b293d97c32553c0353faeeac114fec715a834999ca48530752049e8
SHA512c357a7d45ead6e320588252f9119b65765cd616dc37b1acaf81f3ac07585e80b98a6e3b820590a1e7cd69760adef61e08af53ac9a26598086f59f0496869bd45
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\cc4611ea2d2767f87799a1dd79bc4e7d\Symbol.dllFilesize
28KB
MD5cc4611ea2d2767f87799a1dd79bc4e7d
SHA14449eca0704d055a83dc52d394c64518a5119198
SHA2562cf9bb05c3d48e9454f03a872672d6d2dbc527ba079eeb84b8c1bcc7d727f390
SHA512c37a0084ffe505f29e907e6c899cd3a573a392201c84b520e6aefb8a694119bdaf6f02568ea5775b0cee6f2be8860b4be1d8b7896fc9532a5e12da5406428dbb
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\d7e05471892e97dba27ceb036fb3f94b\CN.dllFilesize
712KB
MD5d7e05471892e97dba27ceb036fb3f94b
SHA11fae8736f66ec385e41d74a68bbfd35e6b2070a8
SHA256d2a54c8a9306a08da8abb102fc6fc17e2d37dee4c45a10dce39ea6ba57c0359e
SHA51248fe17fa7eac236e014a874a5ae07371a954085547b48d0268d67ac281d0919327a748d2d48f57fd2c743a18d8d5cdb157321cd68234256a7e241e20a496841c
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\e76828203225d526e5d6ebb13a67e672\Cwd.dllFilesize
20KB
MD5e76828203225d526e5d6ebb13a67e672
SHA16571d8ebd9979a674d3be8b5ba2872f8ef579855
SHA2566b957981401148e2e45d89168e625fba61fc7b17eeda2065286f7fb51efe900d
SHA5124cb6de6af59307d0bd322b60ae18d9ce39bd37b0dc0c4308a66aa5c8bffd138de8a1f30e1b4873c8354ffac043728eca7d818b92df9e86a364ee5955de770ff5
-
\Users\Admin\AppData\Local\Temp\pdk-Admin\fd9d764dfb48405844de110a932ad3e4\Entry.dllFilesize
40KB
MD5fd9d764dfb48405844de110a932ad3e4
SHA15b627afb63fca62789019ab5a5d347cc34cd70f2
SHA25601b8eee999ea0cbb887a42b28717d2dbca9f6cd31b3e3d98e098a2f31cc1a894
SHA5126176ef2d716f0675a0e8c6114cecf8d2de26124b3f319a70f4a0da3b6ae1e055236dc79727381e83c737245ab8f60c3a7096306b74eb5b779af775c1c8081da6
-
memory/1116-81-0x0000000001F90000-0x0000000001F92000-memory.dmpFilesize
8KB
-
memory/1856-63-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-141-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-95-0x000000000F3B0000-0x000000000F440000-memory.dmpFilesize
576KB
-
memory/1856-17-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-101-0x0000000005070000-0x0000000005072000-memory.dmpFilesize
8KB
-
memory/1856-65-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-66-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-53-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-111-0x000000000EE80000-0x000000000EE8A000-memory.dmpFilesize
40KB
-
memory/1856-0-0x0000000000400000-0x0000000000770000-memory.dmpFilesize
3.4MB
-
memory/1856-6-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-89-0x0000000005070000-0x0000000005072000-memory.dmpFilesize
8KB
-
memory/1856-90-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/1856-92-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/1856-28-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-64-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-137-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-138-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-139-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-98-0x0000000005070000-0x0000000005072000-memory.dmpFilesize
8KB
-
memory/1856-140-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-143-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-144-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-145-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-147-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-149-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-151-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-159-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-161-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-163-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-165-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-167-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-168-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-171-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-173-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-192-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB
-
memory/1856-197-0x0000000005070000-0x0000000005072000-memory.dmpFilesize
8KB
-
memory/1856-62-0x0000000003F20000-0x0000000004FAE000-memory.dmpFilesize
16.6MB