Malware Analysis Report

2025-06-15 20:06

Sample ID 240515-m38d1aeb8t
Target cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics
SHA256 276d8a997289099d704a5ce94f749e743fd1cc94d8757230378156a7e1119d42
Tags
bootkit persistence spyware stealer upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

276d8a997289099d704a5ce94f749e743fd1cc94d8757230378156a7e1119d42

Threat Level: Likely malicious

The file cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics was found to be: Likely malicious.

Malicious Activity Summary

bootkit persistence spyware stealer upx

Blocklisted process makes network request

Deletes itself

Reads user/profile data of web browsers

UPX packed file

Loads dropped DLL

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Enumerates connected drives

Adds Run key to start application

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Kills process with taskkill

Suspicious use of WriteProcessMemory

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 11:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 11:00

Reported

2024-05-15 11:03

Platform

win7-20240221-en

Max time kernel

142s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A \??\c:\windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\nvgrhmdyb\\buptq.utb\",crc32" \??\c:\windows\SysWOW64\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\s: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\t: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\v: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\w: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\y: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\e: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\g: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\l: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\z: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\a: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\j: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\o: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\p: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\q: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\u: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\k: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\n: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\i: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\m: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\r: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\x: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\b: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\h: \??\c:\windows\SysWOW64\rundll32.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 \??\c:\windows\SysWOW64\rundll32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\c:\windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString \??\c:\windows\SysWOW64\rundll32.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A \??\c:\windows\SysWOW64\taskkill.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A \??\c:\windows\SysWOW64\rundll32.exe N/A
N/A N/A \??\c:\windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A \??\c:\windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\SysWOW64\taskkill.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2220 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2404 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2404 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2404 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2404 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe
PID 2404 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe
PID 2404 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe
PID 2404 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe
PID 2860 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 2860 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 2860 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 2860 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 2860 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 2860 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 2860 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 2540 wrote to memory of 2588 N/A \??\c:\windows\SysWOW64\rundll32.exe \??\c:\windows\SysWOW64\taskkill.exe
PID 2540 wrote to memory of 2588 N/A \??\c:\windows\SysWOW64\rundll32.exe \??\c:\windows\SysWOW64\taskkill.exe
PID 2540 wrote to memory of 2588 N/A \??\c:\windows\SysWOW64\rundll32.exe \??\c:\windows\SysWOW64\taskkill.exe
PID 2540 wrote to memory of 2588 N/A \??\c:\windows\SysWOW64\rundll32.exe \??\c:\windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\dayxkyh.exe "C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 2

C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe

C:\Users\Admin\AppData\Local\Temp\\dayxkyh.exe "C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"

\??\c:\windows\SysWOW64\rundll32.exe

c:\windows\system32\rundll32.exe "c:\nvgrhmdyb\buptq.utb",crc32 C:\Users\Admin\AppData\Local\Temp\dayxkyh.exe

\??\c:\windows\SysWOW64\taskkill.exe

taskkill /f /im attrib.exe

Network

Country Destination Domain Proto
US 98.126.15.172:803 tcp
US 98.126.15.172:803 tcp
US 98.126.15.170:3201 tcp
US 98.126.15.171:805 tcp
US 98.126.15.171:805 tcp
US 98.126.15.171:805 tcp
US 98.126.15.171:805 tcp
US 98.126.15.170:3201 tcp
US 98.126.15.170:3201 tcp
US 98.126.15.170:3201 tcp

Files

memory/2220-0-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2220-1-0x00000000002F0000-0x00000000002F1000-memory.dmp

memory/2220-3-0x0000000000400000-0x0000000000428000-memory.dmp

\Users\Admin\AppData\Local\Temp\dayxkyh.exe

MD5 6ac0ce90d95e2def41ff4076bcad3cbe
SHA1 1cbc57733b53ac64b660ad2d092445ec3e411043
SHA256 321d9ff56c8970a45e6a82542c49be7234201887943bc6363c3be572e34b63d4
SHA512 1281d517646d7529c1768eaa80ebfb7c97b93299940ddcd72807fc96650fa542165f904bd4b188336d8f0d1a75f70e31d94abd9e0a1b85fe913f87eda29493c7

memory/2404-8-0x0000000000170000-0x0000000000198000-memory.dmp

memory/2860-9-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/2860-11-0x0000000000400000-0x0000000000428000-memory.dmp

\??\c:\nvgrhmdyb\buptq.utb

MD5 2f53f49e01f09d6e6064871eec1955cd
SHA1 a6e1a6e5c2080d0fb2f7a872e3902a8a4a1a9b5f
SHA256 964e4dd2532d540bb61d3c7ccc833f2358d8cd6b2eabc3a2d51183a18b59f82d
SHA512 2cb98030c3df7417c04f796f78f23f96d381871d9c7ae4a14116764e915b2e2f56b9b3a6fb76fedc50a17788de9538fc7954a7b73bf17e4be43e1fc1a06bc218

memory/2540-14-0x0000000010000000-0x0000000010022000-memory.dmp

memory/2540-15-0x0000000010000000-0x0000000010022000-memory.dmp

memory/2540-19-0x0000000010000000-0x0000000010022000-memory.dmp

memory/2540-20-0x0000000010000000-0x0000000010022000-memory.dmp

memory/2540-21-0x0000000010000000-0x0000000010022000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 11:00

Reported

2024-05-15 11:03

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\rmvjo.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\rmvjo.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A \??\c:\windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\dwrboxr\\hgwhu.ghh\",crc32" \??\c:\windows\SysWOW64\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\a: \??\c:\windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\b: \??\c:\windows\SysWOW64\rundll32.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 \??\c:\windows\SysWOW64\rundll32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\c:\windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString \??\c:\windows\SysWOW64\rundll32.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A \??\c:\windows\SysWOW64\taskkill.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A \??\c:\windows\SysWOW64\rundll32.exe N/A
N/A N/A \??\c:\windows\SysWOW64\rundll32.exe N/A
N/A N/A \??\c:\windows\SysWOW64\rundll32.exe N/A
N/A N/A \??\c:\windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A \??\c:\windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\SysWOW64\taskkill.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rmvjo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4900 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2404 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2404 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2404 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\rmvjo.exe
PID 2404 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\rmvjo.exe
PID 2404 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\rmvjo.exe
PID 220 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\rmvjo.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 220 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\rmvjo.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 220 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\rmvjo.exe \??\c:\windows\SysWOW64\rundll32.exe
PID 1964 wrote to memory of 2432 N/A \??\c:\windows\SysWOW64\rundll32.exe \??\c:\windows\SysWOW64\taskkill.exe
PID 1964 wrote to memory of 2432 N/A \??\c:\windows\SysWOW64\rundll32.exe \??\c:\windows\SysWOW64\taskkill.exe
PID 1964 wrote to memory of 2432 N/A \??\c:\windows\SysWOW64\rundll32.exe \??\c:\windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\rmvjo.exe "C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 2

C:\Users\Admin\AppData\Local\Temp\rmvjo.exe

C:\Users\Admin\AppData\Local\Temp\\rmvjo.exe "C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"

\??\c:\windows\SysWOW64\rundll32.exe

c:\windows\system32\rundll32.exe "c:\dwrboxr\hgwhu.ghh",crc32 C:\Users\Admin\AppData\Local\Temp\rmvjo.exe

\??\c:\windows\SysWOW64\taskkill.exe

taskkill /f /im attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3872 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 98.126.15.172:803 tcp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 98.126.15.170:3201 tcp
US 98.126.15.171:805 tcp
US 98.126.15.171:805 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 98.126.15.171:805 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 98.126.15.170:3201 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
FR 216.58.213.74:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 74.213.58.216.in-addr.arpa udp
US 98.126.15.170:3201 tcp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp
US 98.126.15.170:3201 tcp

Files

memory/4900-0-0x0000000000400000-0x0000000000428000-memory.dmp

memory/4900-1-0x0000000002220000-0x0000000002221000-memory.dmp

memory/4900-3-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rmvjo.exe

MD5 a5742092445feb833c2ef762189cd0b0
SHA1 ef3edae57d98a0902611366e0da8e1fb3b5fb25a
SHA256 a3589c7419e3e1d32ec3489943541b0328ba6bb73a14b16a1d0d92fdbf14f3f2
SHA512 cbf2a2bb6d70ef8ce8229c9c2a754ab4b8df5b95d6c33be4f40b88e45403720addc556ce3f06824c85be68ab85bf0d4ae7d85bdf467b972dc5f1d988bd878e12

memory/220-8-0x0000000000400000-0x0000000000428000-memory.dmp

\??\c:\dwrboxr\hgwhu.ghh

MD5 2f53f49e01f09d6e6064871eec1955cd
SHA1 a6e1a6e5c2080d0fb2f7a872e3902a8a4a1a9b5f
SHA256 964e4dd2532d540bb61d3c7ccc833f2358d8cd6b2eabc3a2d51183a18b59f82d
SHA512 2cb98030c3df7417c04f796f78f23f96d381871d9c7ae4a14116764e915b2e2f56b9b3a6fb76fedc50a17788de9538fc7954a7b73bf17e4be43e1fc1a06bc218

memory/1964-11-0x0000000010000000-0x0000000010022000-memory.dmp

memory/1964-12-0x0000000010000000-0x0000000010022000-memory.dmp

memory/1964-16-0x0000000010000000-0x0000000010022000-memory.dmp

memory/1964-17-0x0000000010000000-0x0000000010022000-memory.dmp

memory/1964-18-0x0000000010000000-0x0000000010022000-memory.dmp