Malware Analysis Report

2025-01-06 09:05

Sample ID 240601-fwmemabf75
Target 8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
SHA256 908f31ed01990097a2e28dc6d2ba85ca4b93f3a8025c69606e496e1a98b655e3
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

908f31ed01990097a2e28dc6d2ba85ca4b93f3a8025c69606e496e1a98b655e3

Threat Level: Known bad

The file 8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visibility of file extensions in Explorer

Modifies visiblity of hidden/system files in Explorer

Adds policy Run key to start application

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SetWindowsHookEx

Modifies registry key

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 05:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 05:13

Reported

2024-06-01 05:16

Platform

win7-20240221-en

Max time kernel

121s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IZKCKOTP = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IZKCKOTP = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IZKCKOTP = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1684 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\REG.exe
PID 1684 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\REG.exe
PID 1684 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\REG.exe
PID 1684 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\REG.exe
PID 1684 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 1684 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 1684 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 1684 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 1128 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 1128 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 1128 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 1128 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 1128 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 1128 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 1128 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 1128 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 1684 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 1684 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 1684 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 1684 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2544 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2544 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2544 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2296 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2296 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2296 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2296 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2820 wrote to memory of 2432 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2820 wrote to memory of 2432 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2820 wrote to memory of 2432 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2820 wrote to memory of 2432 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2820 wrote to memory of 2672 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2820 wrote to memory of 2672 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2820 wrote to memory of 2672 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2820 wrote to memory of 2672 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2672 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2672 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2672 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2672 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2672 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2672 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2672 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2296 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2296 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2296 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2296 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2544 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2544 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2544 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2544 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1128 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 1128 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 1128 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 1128 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2820 wrote to memory of 1612 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2820 wrote to memory of 1612 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2820 wrote to memory of 1612 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2820 wrote to memory of 1612 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 1128 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 1128 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 1128 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 1128 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 8d81f3a4b2a165c100a0ed1b15eb7914
SHA1 b63e36027477bfd4851d7d5a2c9263bba2eb5bb4
SHA256 cc5ab90c210aa50b8fe2c8b8d053bee90a28ce7d4e3082612b9b9f990933a628
SHA512 16f780db78797adcc2f2b784a61f89cf2406670a939bf5aa2fd813c491a27dc63764a3cacb207209acc4832f312cd91bad24e523801b069406119f7cd44a7987

C:\Windows\hosts.exe

MD5 7fbd3275e6f912fa10016636457c4816
SHA1 ee93ecd4de6f2cad748c35a0c2276aaaf152c3b8
SHA256 2b8201b5973fa3964dab580506950296dedda507a4617e05616eacd8f538b3b2
SHA512 faf7f7e9cc9485bdcc3b9b34af40bfa913a08a3077863a9ed0c736459bc5c87325e3b71d0a1cee272e2919ff5fd51a054e165d7b82e24ba6afc4f21f8a9f9fa1

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

memory/2432-60-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2432-59-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2784-63-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/2784-62-0x00000000001B0000-0x00000000001C0000-memory.dmp

C:\Windows\W_X_C.vbs

MD5 953cf5c915c9c58501354c4826dea466
SHA1 2934232a159f5c3738212aa3ece4cdd45ba8cfe4
SHA256 bbdb3fb588b1aca990fbc6355f577bdd40c60e69d9951142da5e8dc84e0b33ed
SHA512 77472ee7f75bee37380d22c14e698b07240c0177b1b4850b72b5ee05136cf17ac3e391b26c6876bfed15049326cd0e2717d0f1de8c4fffba4cd83446218c3147

memory/2296-75-0x0000000002490000-0x0000000002590000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 12d17e70bc9c140189893e64e733d9c3
SHA1 362929a33b4ce3dd8a9a4fbd026e51c92885b767
SHA256 5777a15f5d73ec4e46d7b427e5dc914ed6f8b3b9645c054b9434316e59787358
SHA512 d1dc09872223cda4702849f19b77f6c6f5c9f8bd04856cc97ee499c282feee73d0ff473af0f0c7bdeabe110dab68fa9907c009be1d058b0119fc20a98aed4faf

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 ef2931ed750294c5614a5d7d4ccd127c
SHA1 f17735f36f87a14e170299a529b3332719a7f18f
SHA256 cf62ca91ff0908453cc565c58ac8f675f05e8f56b23bdc2750297799231b83c3
SHA512 5058c5f7057b0258bf9c37d6eab22246f0ebed4e3283e8e4eae0b2ef805fd5927d6054f141374582903dd38b9fb62b155f60400cf6bc5fd1a62cdefbf67ab50d

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 7d972ba94036fa96db4023a4324b9d09
SHA1 3dd14ceb908efb8c27aeffc9c765b8f23226456d
SHA256 a4d052a4b9d1bed1fff84a0b73c0e56fd26ecfcacc81053bab180e1299706a5c
SHA512 b89b7951ea2b67b20dfa67c2f82638d4a8776eb4a42766a2dfa799ad4e3146f8b9f72a69d838bf84bb4b4ca2241137028ef207f7fd459b95fbb813ce1255782a

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 39faa1b035e3341061b92f2a96e37b7f
SHA1 75facac3dd3a8df51ac6d274f492e1aa0be2ce28
SHA256 bb4a280490ec5dae12dbfa7ffc9dea5d9690c44ce75f6d94ae646ac83d798758
SHA512 59f1136c68acc137eb84d2d14a0874367bebc05ecd36bf75211ce84d4e9b4c619bb23b680d68cd167330ddd7c47ddebf0e16c62478b5135733e2de99f5493b06

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 f15dcf1b8961e95890ce605307f866a3
SHA1 f5a457b600ef3fe570d146266c12a099baeffa5f
SHA256 a7f7fea263326ab89c525992638dca1d65cb0f7a131634b3f2539cc407f49762
SHA512 1a273912e09c04fb14b0ba4a65b88b387c9e51cd01787963c8721f982b41cb3a9a347737836267ebf5d8e4284ca8030a7916ad998aec3e850ee8c9bdf86f108e

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 2634dbb90e4bf51eda1596394f22fbfd
SHA1 03d7a65d2ba2df0e8b7facff5162ccb2b25a2011
SHA256 95c48874ae48f01cd01b80e81ad0f60e9a99708cd07a089795c7d367e928a4f3
SHA512 946a4ebc99435a53fd95c86067b65f991369a6a2e30bd604613e47a4f69f737e96adad0d2f2ab1b60c0a035505e1632d4ea394caacf117c414346df81936e93c

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 ec216a6339eeb10fb7dd77a0efaf8d8b
SHA1 e2494fffab06eedf5b067f4518d1758d81b67971
SHA256 ef99c69362145265b3fd941bc607036642c5e85cbd97cd2fb1653bcb7aa788c2
SHA512 e86f19ae299577e92f15b3ea66f52b499d328ca6e274c60f7a73e820547d8fc96cc962f8352a68fbeae64bdd4a04c2b046bf1b7d7f5635f461afcadaf49d523e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 05:13

Reported

2024-06-01 05:16

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YCLEXTAL = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YCLEXTAL = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YCLEXTAL = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2104 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\REG.exe
PID 2104 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\REG.exe
PID 2104 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\REG.exe
PID 2104 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2104 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2104 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2080 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2080 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2080 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2080 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 3312 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3312 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3312 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2176 wrote to memory of 3364 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2176 wrote to memory of 3364 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2176 wrote to memory of 3364 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 4920 wrote to memory of 1284 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4920 wrote to memory of 1284 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4920 wrote to memory of 1284 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3312 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3312 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3312 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4920 wrote to memory of 1376 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 1376 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 1376 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 1032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2176 wrote to memory of 1032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2176 wrote to memory of 1032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1376 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 1376 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 1376 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 1376 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1376 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1376 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2080 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 4308 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 4308 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 4308 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 4924 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 4924 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 4924 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 3500 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 3500 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 3500 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2080 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 1904 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 1904 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4920 wrote to memory of 1904 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 0670f3b7e3d0101cdbf9c0d55187af1f
SHA1 797dad745fcece62f77f84e93f85228a5226e330
SHA256 fc567af306ec4b0d4a3134f1a435d74874b0a0366513400acce3b10eae6e37a8
SHA512 2684b213310d536d1efb4a35af74a9de5cf6b57be09976f21a5482ef64b41d9ccb24d9f998ce4b3799865c1718f92af3b78dbe0fbd37132ef59efbfc5117a066

C:\Windows\hosts.exe

MD5 ef1d02e0393807b4f64f3dff94ed6821
SHA1 269f0c2d2cd2de16a5daf21317108eb6bbbe99fb
SHA256 82509628bf116e52b2c5ad0b644b72a270a4f887eb28054d9cdaabe11b8bb841
SHA512 276eda2e920f05f5b9c6c07966ad8061ccfce1e4f52652d7365021be6bfed5c1d787d9dae9855cf3c182cce53fea589192eebc6c39f47e8985de9a4d7f436df9

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

C:\Windows\W_X_C.vbs

MD5 5a0bc75af86d7b19590f2893967c001d
SHA1 ef84fda77229bb4da29ec18aca2c6b334a640b79
SHA256 e81b685ef5500a016e284eedd8ced163f4900042894e0728ef1cfe583daaf33c
SHA512 4046f66d5f365a5b0bb398d9e62c25277d91010f8fe5a722460df642dedb9986476a8dfc4d16d846c08387a3a4f988b810f2947f5a09b351f21673c0cb5532a3