Overview

overview

10

Static

static

7

5d53a28bb3...cs.exe

windows7-x64

10

5d53a28bb3...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5d53a28bb3daf2eac3243d9b8bf62c00_NeikiAnalytics.exe
  • Size 91KB
  • Sample240526-d74ryaec57
  • SHA256 7043d7fbb590e5ec27aa96924e458a0dfa8b7c65aac4c99aa4f176efa9164d44
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
    evasion
  • Disables RegEdit via registry modification 16 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 56 IoCs
  • Loads dropped DLL 7 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 40 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 50 IoCs
  • Drops file in Windows directory 32 IoCs
  • Modifies Control Panel 32 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 7 IoCs
  • Suspicious use of SetWindowsHookEx 57 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 40 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d53a28bb3daf2eac3243d9b8bf62c00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5d53a28bb3daf2eac3243d9b8bf62c00_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3228
    • C:\Windows\4k51k4.exe
      C:\Windows\4k51k4.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3624
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3160
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:832
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4160
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4628
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4468
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1948
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4996
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2280
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1360
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4180
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4164
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:876
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1316
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3648
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4924
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1000
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4196
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4860
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4284
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4556
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1832
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2928
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:720
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:4136
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3564
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4384
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3956
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1268
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1544
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:836
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3888
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:396
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2468
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4476
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1264
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1836
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1464
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4704
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3316
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2420
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3716
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1236
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4980
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2532
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3220
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4336
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1272
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:4508
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4708
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:3044
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2636
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1672
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3780
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1436
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1636

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Modify Registry

        6
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        1
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        4k51k4.exe
        • Path C:\4k51k4.exe
        • Size 91KB
        • SHA256 166d2ac4a0f27ffd01d31c5f2ece6d155f0a3a4c7c36223d1fb6c3abfc871ae0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        4k51k4.exe
        • Path C:\4k51k4.exe
        • Size 91KB
        • SHA256 f70c6d6a6b9168f7872cf7430fe4ba23e9bec4cebb7b95e750835614805abf40
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Puisi.txt
        • Path C:\Puisi.txt
        • Size 442B
        • SHA256 660ecfcd91ba19959d0c348724da95d7fd6dd57359898e6e3bcce600ff3c797d
        • MD5 SHA1 SHA512
        Submit Download

        CSRSS.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
        • Size 91KB
        • SHA256 ea7e7b7c6cad7cf42c5ab07e9caf6eace00ece0316f0f235b6e8799d6b8fb304
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LSASS.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
        • Size 91KB
        • SHA256 329d467cf944105db4328fc12a7a22adf48cfbd217e976e2e0372024a1668849
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SERVICES.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
        • Size 91KB
        • SHA256 61e2e92cf9ecfdd8ab6cd0e16025ca009e39ca9c4c4af2dd7e8499c5efcf9cfc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SMSS.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
        • Size 91KB
        • SHA256 dda66a43b6e86903bff35e02875d5edabc688e5fe3386d8011e2ab812ea61a03
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WINLOGON.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
        • Size 91KB
        • SHA256 2a45e6c0d9ef8f4fd2b17d46cc415bdebe6d835717eab296b191f98f4354f687
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        winlogon.exe
        • Path C:\Users\Admin\AppData\Local\winlogon.exe
        • Size 91KB
        • SHA256 7043d7fbb590e5ec27aa96924e458a0dfa8b7c65aac4c99aa4f176efa9164d44
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Empty.pif
        • Path C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
        • Size 91KB
        • SHA256 19a4b6789165a62d2d52af5a5c8b317dce51a8d4866a164b3be3ced381f98b90
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Empty.pif
        • Path C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
        • Size 91KB
        • SHA256 d7b6bfd2aeba125441dde40b13ffe95fac0c9c17fd3443036d5d1041ecb5f230
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        4k51k4.exe
        • Path C:\Windows\4k51k4.exe
        • Size 91KB
        • SHA256 be5faaafb0bc258d13ec49320f2b60532e129b534e08ef506826c57a678b5d8e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSVBVM60.DLL
        • Path C:\Windows\MSVBVM60.DLL
        • Size 1.4MB
        • SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IExplorer.exe
        • Path C:\Windows\SysWOW64\IExplorer.exe
        • Size 91KB
        • SHA256 ae240ab44ec8650d9f0efb236210cf66f7b576584fdaf58c5d490fdf8304625c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MrHelloween.scr
        • Path C:\Windows\SysWOW64\MrHelloween.scr
        • Size 91KB
        • SHA256 313d6a61b173fa211bf5e9ac44a6c801117ca2abb93cc5dedac0ca2b5193122d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MrHelloween.scr
        • Path C:\Windows\SysWOW64\MrHelloween.scr
        • Size 91KB
        • SHA256 b04b5c519245d38bad0403471127fa45972f25047c5a087042df55e1bc8ecd23
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        shell.exe
        • Path C:\Windows\SysWOW64\shell.exe
        • Size 91KB
        • SHA256 3472bfa0cbe00741010d61ce077ecf63a4a7e5455375fd9817fa1ac9f3ccc94f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        shell.exe
        • Path C:\Windows\SysWOW64\shell.exe
        • Size 91KB
        • SHA256 78118668735635081af03a88d32a19c9722af1fc69654ff69a259fb33075cef7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/396-513-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/396-261-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/720-415-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/832-203-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/832-213-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/836-425-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/876-263-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1000-511-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1000-239-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1236-438-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1264-448-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1272-492-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1316-303-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1360-211-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1360-204-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1436-505-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1464-463-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1672-497-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1832-396-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1836-455-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1948-323-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1948-314-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2280-236-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2280-510-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2420-514-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2420-296-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2468-428-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2532-453-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2636-494-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2928-404-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2928-400-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3044-487-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3044-483-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3160-189-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3220-461-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3228-148-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3228-0-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3316-482-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3564-364-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3564-341-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3624-225-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3624-509-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3648-310-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3716-429-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3780-501-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3888-441-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3956-390-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3956-384-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4136-129-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4136-512-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4136-241-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4160-231-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4164-235-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4180-229-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4196-324-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4284-370-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4384-379-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4468-308-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4476-437-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4508-305-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4508-515-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4556-388-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4628-265-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4708-477-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4860-362-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4924-326-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4980-447-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4996-367-0x0000000000400000-0x0000000000423000-memory.dmp
        Download