Analysis
-
max time kernel
16s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 05:13
Static task
static1
Behavioral task
behavioral1
Sample
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe
-
Size
1.8MB
-
MD5
b266b43791026c6718e36de3d1c3e670
-
SHA1
53e298fb5aac31f0430c78a9a16465313d23c68a
-
SHA256
93bd41bde4b05517d74e9203e2b4eabd19b0b00311103171d10ee74257660103
-
SHA512
2648728c9f4e98886990474c9f1c2a3d6ac1b51f8b01d841714c6051cdf66a95fce387f02b902b6e39f231acb29ed93d2754c4c1c8b0ec113c024340ca07f5a7
-
SSDEEP
24576:MddVtTj2i6OedT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0A:6bTCrgxKCnFnQXBbrtgb/iQvu0UHOaT
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exeWdExt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe -
Processes:
WdExt.exeb266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe -
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exeWdExt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1640 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
WdExt.exepid process 268 WdExt.exe -
Loads dropped DLL 4 IoCs
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.execmd.exeWdExt.exepid process 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe 2348 cmd.exe 2348 cmd.exe 268 WdExt.exe -
Processes:
resource yara_rule behavioral1/memory/1224-20-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-60-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-59-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-58-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-54-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-63-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-62-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-61-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-182-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-181-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-64-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-514-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-532-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/1224-533-0x0000000002020000-0x00000000030AE000-memory.dmp upx behavioral1/memory/268-576-0x0000000001FC0000-0x000000000304E000-memory.dmp upx behavioral1/memory/268-608-0x0000000001FC0000-0x000000000304E000-memory.dmp upx behavioral1/memory/268-643-0x0000000001FC0000-0x000000000304E000-memory.dmp upx behavioral1/memory/268-638-0x0000000001FC0000-0x000000000304E000-memory.dmp upx behavioral1/memory/268-642-0x0000000001FC0000-0x000000000304E000-memory.dmp upx behavioral1/memory/268-637-0x0000000001FC0000-0x000000000304E000-memory.dmp upx -
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exeWdExt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe -
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exeWdExt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
WdExt.exedescription ioc process File opened (read-only) \??\E: WdExt.exe -
Drops file in Windows directory 1 IoCs
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exeWdExt.exepid process 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe 268 WdExt.exe 268 WdExt.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exeWdExt.exedescription pid process Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe Token: SeDebugPrivilege 268 WdExt.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.execmd.exeWdExt.exedescription pid process target process PID 1224 wrote to memory of 1076 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe taskhost.exe PID 1224 wrote to memory of 1168 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Dwm.exe PID 1224 wrote to memory of 1204 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Explorer.EXE PID 1224 wrote to memory of 2304 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe DllHost.exe PID 1224 wrote to memory of 2348 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe cmd.exe PID 1224 wrote to memory of 2348 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe cmd.exe PID 1224 wrote to memory of 2348 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe cmd.exe PID 1224 wrote to memory of 2348 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe cmd.exe PID 1224 wrote to memory of 1640 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe cmd.exe PID 1224 wrote to memory of 1640 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe cmd.exe PID 1224 wrote to memory of 1640 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe cmd.exe PID 1224 wrote to memory of 1640 1224 b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe cmd.exe PID 2348 wrote to memory of 268 2348 cmd.exe WdExt.exe PID 2348 wrote to memory of 268 2348 cmd.exe WdExt.exe PID 2348 wrote to memory of 268 2348 cmd.exe WdExt.exe PID 2348 wrote to memory of 268 2348 cmd.exe WdExt.exe PID 268 wrote to memory of 1076 268 WdExt.exe taskhost.exe PID 268 wrote to memory of 1168 268 WdExt.exe Dwm.exe PID 268 wrote to memory of 1204 268 WdExt.exe Explorer.EXE PID 268 wrote to memory of 2348 268 WdExt.exe cmd.exe PID 268 wrote to memory of 2348 268 WdExt.exe cmd.exe PID 268 wrote to memory of 2624 268 WdExt.exe conhost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exeWdExt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "5⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 2686⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "7⤵
-
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"8⤵
-
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe9⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "3⤵
- Deletes itself
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "828860057-1942895002-61474196717207864581401537616-865968159-1129858959-1454952433"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0F768D9F_Rar\b266b43791026c6718e36de3d1c3e670_NeikiAnalytics.exeFilesize
1.7MB
MD5a3295b841bd98425517eac00779be1bd
SHA198c4922bc50dd91ffb695b1f0c6c76d7a202a546
SHA2561cd4dcc67788d879b5bd26d57c143ecfb3173c133b718dd0e8b950d25c2b04e5
SHA51284a5a58f8101109f6bd4c202e5afc2b47cf357b53d1a06862633069e8fbe300d1a1e3d7aa12eca235ab0c4b95973e4fb7016e45696b3bb5127a3252ec296b18f
-
C:\Users\Admin\AppData\Local\Temp\4634.tmpFilesize
406B
MD537512bcc96b2c0c0cf0ad1ed8cfae5cd
SHA1edf7f17ce28e1c4c82207cab8ca77f2056ea545c
SHA25627e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
SHA5126d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
-
C:\Users\Admin\AppData\Local\Temp\Se9ADB.tmpFilesize
896B
MD5be49ee9d1b6da594241ce3b7432c5d64
SHA1d81e68b9bf84258af2e6b5595c4f5c8d53b9c901
SHA256db66d62796ae12bf459e514f27bb1a0d416d804365f44e8ec53dd760e3f7b8b8
SHA5120c15d8d86e0dfccbcecd50b3dd5906f8f5b7c52511128d01be82b394ccb08ed85a486a101bbb5d992a688d1e62f21fda712daef1bf3a5ecba9aad152e47562f5
-
C:\Users\Admin\AppData\Roaming\Temp\Admin0.batFilesize
129B
MD5d1073c9b34d1bbd570928734aacff6a5
SHA178714e24e88d50e0da8da9d303bec65b2ee6d903
SHA256b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
SHA5124f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
-
C:\Users\Admin\AppData\Roaming\Temp\Admin1.batFilesize
125B
MD5c0f76a213d64694ec46f0bf4438098bc
SHA18ae74d979807a363137487205d222344576cfbd1
SHA256dec8d53053d30dad68d7f770d526c195429f31657fd22eaa7c13398c87613900
SHA512d380446bda504da6d364c5a2d4011d38aa3e93188e3a145857fa5d5196d1a0b7020884a3c4859ccb740ae0dbb10b0ea5a3290cc6f83807e13689608c39db9efd
-
C:\Users\Admin\AppData\Roaming\Temp\Admin1.batFilesize
268B
MD5842763c90021cdaaab61432346f8fc81
SHA1c5a57263e82e0bf7c3cb2a22652d56e1e1d1fad2
SHA256a68cba0146f1ccc46e0e3e254551f75571f2715d051cd36fe673a425d45990af
SHA51236c87920ed7c0992b12fe67ea132fac63282a84d1cb2f05dd2c7015ea5a0f7ba0f0fa079760050cdf93fa3d7f9fc29a8aafb017375c5e2e4b093eb5d555c518d
-
C:\Users\Admin\AppData\Roaming\Temp\Admin2.batFilesize
102B
MD53ca08f080a7a28416774d80552d4aa08
SHA10b5f0ba641204b27adac4140fd45dce4390dbf24
SHA2564e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
SHA5120c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
-
C:\Users\Admin\AppData\Roaming\Temp\mydll.dllFilesize
202KB
MD5684c111c78f8bf6fcb5575d400e7669c
SHA1d587894c0beffdff00ae6d358a5463ef18bcb485
SHA256080fb4cd0b92884c89efab9161685f3ba0666cd9dab8de6c752bfe35e4e45716
SHA512bcf748d21be502d7346f56ffc9ef13f3394d46c679d7cf17289d007e91b4ead2ec4035b3ccd5626eb378958cbb6ac371edfde8319433db9b709694595ae53e4f
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5b36bf6b18458e7f964f3d1d0fd2dec8a
SHA15be03d1ddc9f90efdb51f67004dfd75fa99208be
SHA25608c1559eed9d4a3be81c2f8d6fa4675441bbfb51cae4fe4317fece445c6d448a
SHA5123262b3194123c3a25bb4f4ab4fc2bf4108b2218f32e122edbaf58d981545819ae644943e029485d337ff74f3e55a9bcfc3e935fab8ba66cb10fb67919bd2cea1
-
C:\Windows\SysWOW64\mscaps.exeFilesize
200KB
MD578d3c8705f8baf7d34e6a6737d1cfa18
SHA19f09e248a29311dbeefae9d85937b13da042a010
SHA2562c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
SHA5129a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
-
\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exeFilesize
1.8MB
MD5c3216f90ff1b27bc096b17333ac56794
SHA153be71d2f85669570cca8712f9ffe6477d3394bd
SHA2568960ad697b0da717ce97ff0ac41438be6f323934bd048a0f64a14101f487b0a5
SHA5125f19b30be9edfda17e56882d9aab43c28c8985c8f5c99c38112c04d4138f5e1c6c868ecbe27cc0023f1480319f843aeb866149124587f8df4e40c3da1f54f801
-
\Users\Admin\AppData\Roaming\Temp\mydll.dllFilesize
202KB
MD57ff15a4f092cd4a96055ba69f903e3e9
SHA1a3d338a38c2b92f95129814973f59446668402a8
SHA2561b594e6d057c632abb3a8cf838157369024bd6b9f515ca8e774b22fe71a11627
SHA5124b015d011c14c7e10568c09bf81894681535efb7d76c3ef9071fffb3837f62b36e695187b2d32581a30f07e79971054e231a2ca4e8ad7f0f83d5876f8c086dae
-
memory/268-1639-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/268-637-0x0000000001FC0000-0x000000000304E000-memory.dmpFilesize
16.6MB
-
memory/268-642-0x0000000001FC0000-0x000000000304E000-memory.dmpFilesize
16.6MB
-
memory/268-638-0x0000000001FC0000-0x000000000304E000-memory.dmpFilesize
16.6MB
-
memory/268-643-0x0000000001FC0000-0x000000000304E000-memory.dmpFilesize
16.6MB
-
memory/268-608-0x0000000001FC0000-0x000000000304E000-memory.dmpFilesize
16.6MB
-
memory/268-576-0x0000000001FC0000-0x000000000304E000-memory.dmpFilesize
16.6MB
-
memory/1076-68-0x0000000001C40000-0x0000000001C42000-memory.dmpFilesize
8KB
-
memory/1224-182-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-0-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1224-81-0x0000000000470000-0x0000000000472000-memory.dmpFilesize
8KB
-
memory/1224-532-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-533-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-58-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-567-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1224-562-0x0000000000470000-0x0000000000472000-memory.dmpFilesize
8KB
-
memory/1224-59-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-60-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-64-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-1-0x0000000010000000-0x0000000010015000-memory.dmpFilesize
84KB
-
memory/1224-79-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB
-
memory/1224-514-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-181-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-80-0x0000000000470000-0x0000000000472000-memory.dmpFilesize
8KB
-
memory/1224-61-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-62-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-63-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-54-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-20-0x0000000002020000-0x00000000030AE000-memory.dmpFilesize
16.6MB
-
memory/1224-76-0x0000000000470000-0x0000000000472000-memory.dmpFilesize
8KB
-
memory/1224-77-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB
-
memory/2348-574-0x0000000000550000-0x000000000059C000-memory.dmpFilesize
304KB
-
memory/2348-572-0x0000000000550000-0x000000000059C000-memory.dmpFilesize
304KB