Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 03:39

General

  • Target

    5d53a28bb3daf2eac3243d9b8bf62c00_NeikiAnalytics.exe

  • Size

    91KB

  • MD5

    5d53a28bb3daf2eac3243d9b8bf62c00

  • SHA1

    6141c8ceab00d56d312101232c95e73e438d1612

  • SHA256

    7043d7fbb590e5ec27aa96924e458a0dfa8b7c65aac4c99aa4f176efa9164d44

  • SHA512

    e575a6b4d34757c1d5e058a889d53bf0863d4e76503c73eeb66191d5ec2199f56dd2aca1eed35c948b24b208f8506c91e34311b5e6b8fc982d53c375cda19db2

  • SSDEEP

    1536:yOcjUpkWb2TTgKwuSOcjUpkWb2TTgKwuq:yOcjWJu7tSOcjWJu7tq

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
  • Disables RegEdit via registry modification 16 IoCs
  • Disables Task Manager via registry modification
  • Disables use of System Restore points 1 TTPs
  • Executes dropped EXE 56 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 40 IoCs
  • Drops desktop.ini file(s) 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 48 IoCs
  • Drops file in Windows directory 30 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 7 IoCs
  • Suspicious use of SetWindowsHookEx 56 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d53a28bb3daf2eac3243d9b8bf62c00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5d53a28bb3daf2eac3243d9b8bf62c00_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2968
    • C:\Windows\4k51k4.exe
      C:\Windows\4k51k4.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2756
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2008
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:672
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2400
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2716
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:540
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2008
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1220
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2784
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3064
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        PID:2848
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2380
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2976
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1924
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2932
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1648
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1800
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:900
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1624
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2472
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1472
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1864
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:948
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2064
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1444
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1884
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2600
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2888
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2832
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1672
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2584
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2420
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2548
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2584
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2684
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1844
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2628
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2012
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:428
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:756
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:612
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2148
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2708
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1440
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2024
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2056
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:692
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2536
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1344
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2492
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1256
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1380
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2020
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2424
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2296
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:772

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\4k51k4.exe

          Filesize

          91KB

          MD5

          33ce30993f4678f0b5898eb7f74daa1c

          SHA1

          63ec9c2c9725f77544c55317b4c78f2ca366e9bf

          SHA256

          f4cc8c793f1ee2eb4b3a9b3037c2d2ed00899c9dad80572340bd0f61d6e627da

          SHA512

          e6c8cff710d15977b0bdf30cd61219bb207813c7c5fc6bcc6a6b8d3cca2d103141d35f693bda435f28407fbc1252473c5d79fb2072976c2d83693ebb47f54d2f

        • C:\4k51k4.exe

          Filesize

          91KB

          MD5

          ed3ba3010622d3d9905fd6c03b3aaeb4

          SHA1

          eaef97649256345efe142844c4710d20c1553692

          SHA256

          96e5b8f63b035672b81238e16c93a495c6cfacf5c2696f283db5e03e36a3a8e7

          SHA512

          8a13b677895a0b1d63f78bef233cf9e2d9b1946adaa1b51e4afac7098e7b8285620c90171c45f5741a95fec7f169d035b5a2447a3e55424c669ecaaca8c111cb

        • C:\Puisi.txt

          Filesize

          442B

          MD5

          001424d7974b9a3995af292f6fcfe171

          SHA1

          f8201d49d594d712c8450679c856c2e8307d2337

          SHA256

          660ecfcd91ba19959d0c348724da95d7fd6dd57359898e6e3bcce600ff3c797d

          SHA512

          66ec4330b9a9961a2926516ec96d71e3311f67a61e6ac3070303453d26fa4fdc9524296f583c0e2179414f1a0d795cedbd094a83f5ecd3f1faa0cccfe4276657

        • C:\Users\Admin\AppData\Local\winlogon.exe

          Filesize

          91KB

          MD5

          5d53a28bb3daf2eac3243d9b8bf62c00

          SHA1

          6141c8ceab00d56d312101232c95e73e438d1612

          SHA256

          7043d7fbb590e5ec27aa96924e458a0dfa8b7c65aac4c99aa4f176efa9164d44

          SHA512

          e575a6b4d34757c1d5e058a889d53bf0863d4e76503c73eeb66191d5ec2199f56dd2aca1eed35c948b24b208f8506c91e34311b5e6b8fc982d53c375cda19db2

        • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

          Filesize

          91KB

          MD5

          5eaee01cc0ca56307d44b256f15bb120

          SHA1

          4c81f067210a8d6482f57e06335dc55579f29987

          SHA256

          e121d1c3cf4e775259c22647442ab67b157d57e67fa96ab57f423674f991c9d1

          SHA512

          428a799de98532f25ec573887b9aa7c5dd27e65b8ec2dea5bfbb454ae6da5a81456a5cfc89baa40dabb7a572e51794c53ccaa34a6c9f6d8b33e792af5ebc6d37

        • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

          Filesize

          91KB

          MD5

          e3f89aa16f8af66b0b9be4783bfdfa53

          SHA1

          621c00305e97c4abe0d6da7b47c79be3f3a1cdf3

          SHA256

          1de81a2fb731e98570c3633646c05504ea3afb8da774912a54d3c08b2217683c

          SHA512

          1c63889984f63bebb55ec9862c46ba45ac16a75c5868bf181ce5a5bd7a8b6e22185f9c0617e6732142c7469206f1185a64ec8487afcc8b82712ba06d024abfd8

        • C:\Windows\4k51k4.exe

          Filesize

          91KB

          MD5

          c4a2f3d6ebdaaca9e937457ee2c7db1a

          SHA1

          73771c42b00c88c4213a426d66263c799326d2f2

          SHA256

          110567b49e1a6df99092b65f8782f344ee469d408ada986154e9e45c2b0686e8

          SHA512

          b5df772ccee0bce1578cf7696376bc85cfdcaa7eef6ae333577c633c9dd1fed6188804bf52353a3131a5441d3eaf7ac725cee840526f551a761b22737de8926e

        • C:\Windows\MSVBVM60.DLL

          Filesize

          1.3MB

          MD5

          5343a19c618bc515ceb1695586c6c137

          SHA1

          4dedae8cbde066f31c8e6b52c0baa3f8b1117742

          SHA256

          2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

          SHA512

          708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

        • C:\Windows\SysWOW64\MrHelloween.scr

          Filesize

          91KB

          MD5

          9223d742854bcb271a91f62846e405f7

          SHA1

          f33d48f2c71b246992c0c9c7613441f64e857cf8

          SHA256

          e84673a105a9f8273f565c6564f329285c772d7de75e397a1d05efd62bc58794

          SHA512

          bd2ec4d1ed25ef47e9f3d6884b34d5a63849f3a7ddc88bb800a5635dfa6f8de255f9bc97267048cd00869a18b68feeb4f593fc0307026d79b9fb0fcc61d54667

        • C:\Windows\SysWOW64\MrHelloween.scr

          Filesize

          91KB

          MD5

          7200851c871f80b34b7de224e6daf3c1

          SHA1

          bedbc884e966a1fcbc336c0690c10ec662ee0794

          SHA256

          1d44228401a877210e9a54f8c5e90a8ec498305765b7803c949d03703271266b

          SHA512

          dc868788f3afc331767ae2f78de0c1125947411e1c6b7ea84f0748ef557a2578b1b205fea88abeeaa6da5e6a0ee993758433393eae495a683383698b559a551f

        • C:\Windows\SysWOW64\shell.exe

          Filesize

          91KB

          MD5

          1bc894ff4249e36d3968df3277d75e9f

          SHA1

          f3d282e12ed1405753107962feca99cac940c6d9

          SHA256

          6f3b671e21e780a24f4d4b6107c5d97781b0cfd0774c242ecb0a40afd5cb1b62

          SHA512

          691559af43e47868640d4a0698a04f704c5466d68cb935101f86b1a540168d17bd4dd9ba336c7fb707702aa3ff394646cbb9ce9abbd15b9e450e22e9ef320e6c

        • C:\Windows\SysWOW64\shell.exe

          Filesize

          91KB

          MD5

          b7d5f03b478ef31f8d5e2418f5d730f0

          SHA1

          4d451e9a8422dadb456a76fced0cf0fd9e610f73

          SHA256

          7b9a279f385bc75e492de6c728b995ce351ca3596cb840b0c26c2ce989f31abc

          SHA512

          6bca25f5270d63d9699127f6baebd2b7476c9a67e1349e5b1fc3c6b0c8194c42dd3c3fc928320b7a65e180d0a5df68d7c29d05bf3a812f093fe9b5f994578f49

        • C:\Windows\SysWOW64\shell.exe

          Filesize

          91KB

          MD5

          0b7f0ded62096d58334e252c3b231d14

          SHA1

          9ae160efa11ae6b0f6d579635a007fac1e29b5fc

          SHA256

          73d754ece4401262fdc5b5b6703f389f5f80a873a2cb40e34ad281798cdf07f7

          SHA512

          097d30b9ae6d106e5321f295a6c77e7946ecfa08971384c1e895f77c39337a054557b9539e7400eeeccb02dc98566e2cda50d712ab35fcd5483d4ec742e8e176

        • \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

          Filesize

          91KB

          MD5

          e6eb4cec7d532a4ea59564835f43d24d

          SHA1

          b2090fc5c57d49f7fb7bd814943f54ce1ef6b842

          SHA256

          9f5818d4ccd79427acd078f11bd4011f629d648139b719d7f0628e232f8fabf7

          SHA512

          94e2968d4c2b1959fc58644dfd02672ae9f1b4a505fcb1d56b2c506bb6b5268bef6ab098295534205734881872b61dee6a329a30e91cbb2ff3be69b2e2bc9d29

        • \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

          Filesize

          91KB

          MD5

          5fd9aa4a27723da4d04067b86982c52d

          SHA1

          712b0bb53c6d0c739b4762ea1f3e3b8fc0fa9708

          SHA256

          23fa3979c17a19adb4986f847d81ca97a19abe11fb981883193cff1992effcc2

          SHA512

          24c4fc212a94b66bade7dd13db388a3365be6cee2cc4d1acce190bdadcb7a2de8435a35d22820da3c8531def36d3d4f5c8df5bd4e7d44d814bc3076c86122c32

        • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

          Filesize

          91KB

          MD5

          a897e2d973ec48d838c9dd6d718490fd

          SHA1

          5f76dc8bed004feec45d2a143224ff48951c42fe

          SHA256

          ac613b1c85571148c8c988c78e2578eb1b09a62b4bfa40de6d68040f971f9320

          SHA512

          f2e3286ad9325d6782c5edd96e350cf5df04a41b8daa005b462e3af9e383d9a28a4e2451e696f2a2b39cb228e4d3020e3762c112f0db6b730480e5a6a525a25f

        • \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

          Filesize

          91KB

          MD5

          ecd4eb23ce4a84065d71557c01daa26f

          SHA1

          23e54594f49e3c514806ade05f81d0b1bda71ce7

          SHA256

          f890fda8de7673bfe5337d25516405f44b4b1608db1d2fa9cfd26a85d1033564

          SHA512

          b1bb56f441baf126c370f46f4dbc5090396311415b6b07fbe84105fa74dc9b19029b3110fc7b5f3d28bebba12eded186c6cdf591033152ab1177d40afad8e806

        • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

          Filesize

          91KB

          MD5

          adc460ee4bd3b8ba08a9bcc946e77ba1

          SHA1

          d7c295e2f4eb18ebc12bf5ca493f1a3c80f74752

          SHA256

          5448ff07306cfeeef986611f822def36f9ffee8bbd62f0145750972bef594055

          SHA512

          a4e02cff07465d17f610e64132069b11d4deaecd8c921d7c94ff02d9c104dd8ea064103c9e97a01086d8b3398bfa9d54f44c8243f2f3022ff8057735edbedc44

        • \Windows\SysWOW64\IExplorer.exe

          Filesize

          91KB

          MD5

          739c32514fcfcf0cd3f04862d7dad501

          SHA1

          da2bc54aaaa87fcd7f147e2a995623f5ae148414

          SHA256

          33a911ab281e982db1c3723a1d503c06e94122bc03d4672081adc82aed01d243

          SHA512

          0d1461abbec09ffffc1c0b6700c5df92360bf901409527d7bed58530c6d72976357a69b52f9310af2d60c6a5e37042f05b90cd0cc8e3f767d2557a65d5ca5010

        • memory/428-551-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/612-567-0x00000000003D0000-0x00000000003F3000-memory.dmp

          Filesize

          140KB

        • memory/612-410-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/612-460-0x00000000003D0000-0x00000000003F3000-memory.dmp

          Filesize

          140KB

        • memory/612-359-0x00000000003D0000-0x00000000003F3000-memory.dmp

          Filesize

          140KB

        • memory/612-562-0x00000000003D0000-0x00000000003F3000-memory.dmp

          Filesize

          140KB

        • memory/612-563-0x00000000003D0000-0x00000000003F3000-memory.dmp

          Filesize

          140KB

        • memory/672-291-0x0000000000260000-0x0000000000270000-memory.dmp

          Filesize

          64KB

        • memory/672-313-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/900-378-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/900-339-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/948-547-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1220-556-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1256-533-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1344-560-0x0000000002640000-0x0000000002663000-memory.dmp

          Filesize

          140KB

        • memory/1344-500-0x0000000002640000-0x0000000002663000-memory.dmp

          Filesize

          140KB

        • memory/1344-411-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1440-468-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1444-150-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1444-336-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1444-557-0x0000000002320000-0x0000000002343000-memory.dmp

          Filesize

          140KB

        • memory/1444-534-0x0000000002320000-0x0000000002343000-memory.dmp

          Filesize

          140KB

        • memory/1472-478-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1472-465-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1624-409-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1648-497-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1800-498-0x00000000023F0000-0x0000000002413000-memory.dmp

          Filesize

          140KB

        • memory/1800-535-0x00000000023F0000-0x0000000002413000-memory.dmp

          Filesize

          140KB

        • memory/1800-536-0x00000000023F0000-0x0000000002413000-memory.dmp

          Filesize

          140KB

        • memory/1800-463-0x00000000023F0000-0x0000000002413000-memory.dmp

          Filesize

          140KB

        • memory/1800-464-0x00000000023F0000-0x0000000002413000-memory.dmp

          Filesize

          140KB

        • memory/1800-564-0x00000000023F0000-0x0000000002413000-memory.dmp

          Filesize

          140KB

        • memory/1800-494-0x00000000023F0000-0x0000000002413000-memory.dmp

          Filesize

          140KB

        • memory/1800-338-0x00000000023F0000-0x0000000002413000-memory.dmp

          Filesize

          140KB

        • memory/1800-242-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1844-444-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1864-532-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1884-365-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/1884-366-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1924-480-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2008-247-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2008-549-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2008-249-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2012-496-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2024-531-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2148-434-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2148-408-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2380-376-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2400-424-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2472-474-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2492-472-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2492-459-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2492-473-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2536-614-0x00000000001B0000-0x00000000001C0000-memory.dmp

          Filesize

          64KB

        • memory/2548-405-0x0000000000670000-0x0000000000693000-memory.dmp

          Filesize

          140KB

        • memory/2548-440-0x0000000000670000-0x0000000000693000-memory.dmp

          Filesize

          140KB

        • memory/2548-566-0x0000000000670000-0x0000000000693000-memory.dmp

          Filesize

          140KB

        • memory/2548-469-0x0000000000670000-0x0000000000693000-memory.dmp

          Filesize

          140KB

        • memory/2548-446-0x0000000000670000-0x0000000000693000-memory.dmp

          Filesize

          140KB

        • memory/2548-403-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2548-565-0x0000000000670000-0x0000000000693000-memory.dmp

          Filesize

          140KB

        • memory/2548-467-0x0000000000670000-0x0000000000693000-memory.dmp

          Filesize

          140KB

        • memory/2584-372-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2600-471-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2628-470-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2628-476-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2684-386-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2708-450-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2708-445-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2716-437-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2756-251-0x00000000025A0000-0x00000000025C3000-memory.dmp

          Filesize

          140KB

        • memory/2756-466-0x00000000025A0000-0x00000000025C3000-memory.dmp

          Filesize

          140KB

        • memory/2756-116-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2756-416-0x00000000025A0000-0x00000000025C3000-memory.dmp

          Filesize

          140KB

        • memory/2756-458-0x00000000025A0000-0x00000000025C3000-memory.dmp

          Filesize

          140KB

        • memory/2756-555-0x00000000025A0000-0x00000000025C3000-memory.dmp

          Filesize

          140KB

        • memory/2756-554-0x00000000025A0000-0x00000000025C3000-memory.dmp

          Filesize

          140KB

        • memory/2756-634-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2756-180-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2784-215-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2784-417-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-635-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2784-404-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-495-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-337-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-492-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-414-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-415-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-406-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-407-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-241-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-127-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2784-441-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-240-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2784-438-0x00000000026D0000-0x00000000026F3000-memory.dmp

          Filesize

          140KB

        • memory/2848-362-0x0000000077270000-0x000000007736A000-memory.dmp

          Filesize

          1000KB

        • memory/2848-363-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2848-361-0x0000000077370000-0x000000007748F000-memory.dmp

          Filesize

          1.1MB

        • memory/2888-461-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2932-485-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2968-184-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2968-115-0x0000000000390000-0x00000000003B3000-memory.dmp

          Filesize

          140KB

        • memory/2968-114-0x0000000000390000-0x00000000003B3000-memory.dmp

          Filesize

          140KB

        • memory/2968-169-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2968-0-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/2968-139-0x0000000000390000-0x00000000003B3000-memory.dmp

          Filesize

          140KB

        • memory/2968-149-0x0000000000390000-0x00000000003B3000-memory.dmp

          Filesize

          140KB

        • memory/2968-126-0x0000000000390000-0x00000000003B3000-memory.dmp

          Filesize

          140KB

        • memory/2968-170-0x0000000000390000-0x00000000003B3000-memory.dmp

          Filesize

          140KB

        • memory/2976-442-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/3064-332-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/3064-331-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB