Overview

overview

10

Static

static

7

5ebc942b95...cs.exe

windows7-x64

10

5ebc942b95...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5ebc942b9504aaa9cbe969207587e830_NeikiAnalytics.exe
  • Size 91KB
  • Sample240613-e54jtsthqd
  • SHA256 75855669e8aeebcbc69f5b0110935d69754f70340c3fc7be2480fdfbd14a48f6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
    evasion
  • Disables RegEdit via registry modification 16 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 56 IoCs
  • Loads dropped DLL 7 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 40 IoCs
    persistence
  • Drops desktop.ini file(s) 6 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 50 IoCs
  • Drops file in Windows directory 32 IoCs
  • Modifies Control Panel 32 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 7 IoCs
  • Suspicious use of SetWindowsHookEx 57 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 40 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ebc942b9504aaa9cbe969207587e830_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5ebc942b9504aaa9cbe969207587e830_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3716
    • C:\Windows\4k51k4.exe
      C:\Windows\4k51k4.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3164
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2156
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:3852
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2380
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5100
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1260
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1792
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2356
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3048
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4108
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4988
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1500
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1092
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1504
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4732
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:440
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3524
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1360
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:5068
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3208
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2992
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2036
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4928
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1828
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3484
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3364
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4464
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3516
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1620
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4524
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2056
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5112
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2980
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2300
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4804
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5012
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2444
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4520
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5024
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2828
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:3736
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4280
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2336
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1032
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4040
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:944
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4752
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4104
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:4312
      • C:\Windows\4k51k4.exe
        C:\Windows\4k51k4.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2792
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2984
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1800
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1108
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2040
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1672
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1300

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Modify Registry

        6
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        1
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        4k51k4.exe
        • Path C:\4k51k4.exe
        • Size 91KB
        • SHA256 5583ab4e4b8f61989f64bf9564448202ba6cbd50431d29c561e6387147262a6d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Puisi.txt
        • Path C:\Puisi.txt
        • Size 442B
        • SHA256 660ecfcd91ba19959d0c348724da95d7fd6dd57359898e6e3bcce600ff3c797d
        • MD5 SHA1 SHA512
        Submit Download

        CSRSS.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
        • Size 91KB
        • SHA256 77034d2436e175f623d4e6eaf04b48a30b5d68d46c31a6d8c795a76c55ecfb42
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LSASS.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
        • Size 91KB
        • SHA256 ed145dce8567a8245c7f2cff30c6b2282e9e4cbaa6f2dba4fe273e0f91f9e81c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SERVICES.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
        • Size 91KB
        • SHA256 89246155f33ef638dd25a9d29c9748ab433d37c206da16417e4b6e254c5be078
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SMSS.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
        • Size 91KB
        • SHA256 1fef49dd5abc5c7c2d54bd27e7979661a5c5461788e79e74e5d5805aa411f4ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WINLOGON.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
        • Size 91KB
        • SHA256 2ec13d4afa8032a707d71922982130b0c0619269f718f9654531b4c9ff7f6806
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        winlogon.exe
        • Path C:\Users\Admin\AppData\Local\winlogon.exe
        • Size 91KB
        • SHA256 75855669e8aeebcbc69f5b0110935d69754f70340c3fc7be2480fdfbd14a48f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Empty.pif
        • Path C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
        • Size 91KB
        • SHA256 97b9d33df2852101b4d4cf66f8cd9e06278b192c68c19319600944d808c686c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Empty.pif
        • Path C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
        • Size 91KB
        • SHA256 239be8b114cfc56040d11054187f0c208ee2a620e1b912926b0475a3d96ad2f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        4k51k4.exe
        • Path C:\Windows\4k51k4.exe
        • Size 91KB
        • SHA256 80647da29cb4f734e8eafbd744d6b35995320ba783d57305f73b9ee07a21ddf3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSVBVM60.DLL
        • Path C:\Windows\MSVBVM60.DLL
        • Size 1.4MB
        • SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IExplorer.exe
        • Path C:\Windows\SysWOW64\IExplorer.exe
        • Size 91KB
        • SHA256 28d22c0671b0745c088e3f30d569d6c05dda114ab61da4e4d23856805f6df0fd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MrHelloween.scr
        • Path C:\Windows\SysWOW64\MrHelloween.scr
        • Size 91KB
        • SHA256 b7878931295178b9eabd6caf481861a9f7b231969152b8b19ff841c4a89aa1b2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        shell.exe
        • Path C:\Windows\SysWOW64\shell.exe
        • Size 91KB
        • SHA256 d54075823ab2fc21701f88574ba3253e53b3cb94c5cb67d6e2024eb63cfc5cf7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Folder.htt
        • Path F:\4K51K4\Folder.htt
        • Size 640B
        • SHA256 fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061
        • MD5 SHA1 SHA512
        Submit Download

        desktop.ini
        • Path F:\desktop.ini
        • Size 221B
        • SHA256 a0dd10de1158a4d05ea916c190bf95dc4c53ae3851c47ab8449a9ce96943334f
        • MD5 SHA1 SHA512
        Submit Download

        memory/440-408-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/944-476-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1032-413-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1032-406-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1092-324-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1108-527-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1300-539-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1360-236-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1360-276-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1500-272-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1504-336-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1504-339-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1672-535-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1800-523-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/1828-431-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2040-531-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2056-480-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2156-217-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2300-345-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2300-318-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2336-398-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2380-321-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2444-425-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2792-511-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2792-515-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2980-544-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2980-317-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2980-135-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/2984-519-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3048-253-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3048-541-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3164-540-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3164-237-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3208-281-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3364-342-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3364-319-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3484-543-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3484-310-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3516-386-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3524-280-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3524-542-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3716-0-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3716-147-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3736-337-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3736-545-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3852-238-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/3852-268-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4108-202-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4108-199-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4280-380-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4312-343-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4312-546-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4464-374-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4520-460-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4524-462-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4732-378-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4804-372-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4928-393-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4988-266-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/5012-396-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/5024-492-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/5068-256-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/5068-270-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/5112-498-0x0000000000400000-0x0000000000423000-memory.dmp
        Download