Analysis
- max time kernel
133s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 17:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe
- Size 45KB
- Sample240603-vky2lsec78
- SHA256 708b3c440c87e7190f291ecdc2f0c693c90da944e0b4e5c2223316422808f587
- MD5 5b1953a1411ab00efecf54886715f8c0
- SHA1 b4edfe7bdc870e44c0ab6f92278d81d9a7bd7034
- SHA512 c03870602a0737df1e4f39321d877b653ef8a4388093e448e283f771d6a7d27c03b93f4c543d98e770bc3e8a8b94994e9280f53785431a3ab6a0580bf1ef0e91
- SSDEEP 768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nEn7:FAwEmBGz1lNNqDaG0Poxhlzm7
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Disables use of System Restore points 1 TTPs
- Executes dropped EXE 7 IoCs
pid Process 3548 xk.exe 4240 IExplorer.exe 3960 WINLOGON.EXE 5028 CSRSS.EXE 3844 SERVICES.EXE 2672 LSASS.EXE 4660 SMSS.EXE - Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\IExplorer.exe 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\shell.exe 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\shell.exe 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Mig2.scr 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IExplorer.exe 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xk.exe 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe File created C:\Windows\xk.exe 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Modifies Control Panel 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 3548 xk.exe 4240 IExplorer.exe 3960 WINLOGON.EXE 5028 CSRSS.EXE 3844 SERVICES.EXE 2672 LSASS.EXE 4660 SMSS.EXE - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4600 wrote to memory of 3548 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 90 PID 4600 wrote to memory of 3548 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 90 PID 4600 wrote to memory of 3548 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 90 PID 4600 wrote to memory of 4240 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 91 PID 4600 wrote to memory of 4240 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 91 PID 4600 wrote to memory of 4240 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 91 PID 4600 wrote to memory of 3960 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 92 PID 4600 wrote to memory of 3960 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 92 PID 4600 wrote to memory of 3960 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 92 PID 4600 wrote to memory of 5028 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 93 PID 4600 wrote to memory of 5028 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 93 PID 4600 wrote to memory of 5028 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 93 PID 4600 wrote to memory of 3844 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 94 PID 4600 wrote to memory of 3844 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 94 PID 4600 wrote to memory of 3844 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 94 PID 4600 wrote to memory of 2672 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 95 PID 4600 wrote to memory of 2672 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 95 PID 4600 wrote to memory of 2672 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 95 PID 4600 wrote to memory of 4660 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 96 PID 4600 wrote to memory of 4660 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 96 PID 4600 wrote to memory of 4660 4600 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe 96 - System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5b1953a1411ab00efecf54886715f8c0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4600 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3548
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4240
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3960
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5028
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3844
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2672
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3624,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:81⤵PID:1816
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
- Size 45KB
- SHA256 cd0f8a636da13f78de831de123d27dc454f3ff609a3110676200cf7d887f4421
- MD5 c9498d8c849da3969eac9f967f321035
- SHA1 a4a83d81f3be0dbaa500d4e7770f65333090521f
- SHA512 33212ccb93a971f91950641b388a40223b329eb3fef00dc7ee40205e5d72bdf0df03494c7b9f357093ee138e3e3c55a794ed99b8e3e3b042894412944d182790
- SSDEEP 768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nEFD7:FAwEmBGz1lNNqDaG0PoxhlzmFv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
- Size 45KB
- SHA256 107c9c13bef4a2152d18add326479c575676a0d06d7183e0716b47edd847273e
- MD5 a3bc9264e3e969abe9f650ff64f4d0f0
- SHA1 6fa075dd4e9daa15e842ba76256a1e09c1b7ac45
- SHA512 0db3e6c6539171f3dfb720c206e7cc3daa215b8b4a36a5be67b0f5fcfbd3d0e01666911ddb329d05686be9bdcfa0e37a93a765bbf2a198ca9e800df6c0003af0
- SSDEEP 768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nETG7:FAwEmBGz1lNNqDaG0PoxhlzmC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
- Size 45KB
- SHA256 d562c2ef1184cafa28197f2d51c1aa396702f2b23b71a2f1947d1928f7541961
- MD5 b222b5a787410bcb0f4ecd84195785d0
- SHA1 8da0d8e08e7360d2ca22f54630f517492e71c0e5
- SHA512 16203ff9c13e514754abecd2bb579bb0b8059feb2866f7aeeaf2268cebfe16ffa030876033bb0b40853cab36c42bfde950ff6698bf4290eeb678c8982372d8ad
- SSDEEP 768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nEE7:FAwEmBGz1lNNqDaG0Poxhlzm4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
- Size 45KB
- SHA256 baab19b821af92f9717eee7b8bea7144104e12e2752eda172ed67091ed25c752
- MD5 39e67b4f35b96f43c5ab1d8c0fe64a95
- SHA1 865c8b5f4273471e3fcea42ec27dc941c6d0cdda
- SHA512 7f789d76383000aa7c00aef0a58443e8d603f455ede2b2498313340efa80bb9f1576f90995f94ca00ed9f832f3b0bc32133d68843b3343ce672374c212fe8d9e
- SSDEEP 768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nEo7:FAwEmBGz1lNNqDaG0Poxhlzmk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
- Size 45KB
- SHA256 d64e75bd9d72e678b6fb1869031fe6757ea762168461c5bc42fc71dd6431bb32
- MD5 78f4da55858b9aeb3148d2a5eb14a180
- SHA1 10e71a71a13775d303f34b6cb3794d80986bfc87
- SHA512 78c7ea3acfd25435425178961c6bcc405cd096e3c228c725c232f9a409399368391d406308197a76913190c3021a8901eff4e597b07d02779ff99ed164b9a6ee
- SSDEEP 768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nEw7:FAwEmBGz1lNNqDaG0Poxhlzm8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\winlogon.exe
- Size 45KB
- SHA256 708b3c440c87e7190f291ecdc2f0c693c90da944e0b4e5c2223316422808f587
- MD5 5b1953a1411ab00efecf54886715f8c0
- SHA1 b4edfe7bdc870e44c0ab6f92278d81d9a7bd7034
- SHA512 c03870602a0737df1e4f39321d877b653ef8a4388093e448e283f771d6a7d27c03b93f4c543d98e770bc3e8a8b94994e9280f53785431a3ab6a0580bf1ef0e91
- SSDEEP 768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nEn7:FAwEmBGz1lNNqDaG0Poxhlzm7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\IExplorer.exe
- Size 45KB
- SHA256 1ad5c2c51707a353f76e2fcc4ee1dc64805c19f46fd2340badec97e6a8941a4a
- MD5 6889d5c7237c0602c3f74c4d8c793b9e
- SHA1 ef62365dfc81eb1d64b97bd11687f68bfdb5710c
- SHA512 8792fe91cffba18158194a7f1f024b774c70a7706d026cd4e7d2c8f3a6f9098bcec86003509db9fb251a171a3b39da2455468258321f387ef4d6f28b0de3fb9a
- SSDEEP 768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nE17:FAwEmBGz1lNNqDaG0Poxhlzm9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\xk.exe
- Size 45KB
- SHA256 5b7f2c9ec939856637535d9c52decbb5793898bd771977c88756d87a08a48bec
- MD5 81f6cc990734b619422d9fc87dd5d909
- SHA1 2117c17d8eb734df955f08f255b7a15090eeda4a
- SHA512 c8fe29a9469fe1360e066df8859aac06683c6b0f0388820c9e2641136013d51971c082e1131ba55a609ba0be069bee17dd5c0ad0c18110afe5a46e43ebd8fb50
- SSDEEP 768:PmFQj8rM9whcqet8WfuzHVHFNNqDaG0XjqGoxhz/8szBnP7DFK+5nEf7:FAwEmBGz1lNNqDaG0Poxhlzmj
- MD5 SHA1 SHA512 SSDEEP