Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 01:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe
- Size 594KB
- Sample240614-bfyqhayfle
- SHA256 231a009d40ffcda1625c3e1bd73ac8157986e15ed985fed33b2a44e18851a12b
- MD5 95b8b276fb0e96ca91673d3deaad0640
- SHA1 c6eea5113b196fef919a72143b5b807c2672a4fd
- SHA512 0f5135cdb4a4baa580860427cfd6e66aea2d67df6f29946a6edf28dfeb33d1c539621ab4add6531797b4b8fc6791f8b9fe2c365c7a7d9f1eb5b91002d17ec359
- SSDEEP 12288:zBgnnf1lgzNlbhffX8PTWS+Nsf1lgzyYJ:zGfPidULWFoPiyYJ
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Sets file execution options in registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe " cmd.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jhat.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\orbd.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\servertool.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\mip.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jps.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jjs.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\dotnet.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\orbd.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javap.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\kinit.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstatd.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\keytool.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\idlj.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstack.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ktab.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\pack200.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\policytool.exe 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe - Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2432 wrote to memory of 3076 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 84 PID 2432 wrote to memory of 3076 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 84 PID 2432 wrote to memory of 3076 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 84 PID 2432 wrote to memory of 2876 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 86 PID 2432 wrote to memory of 2876 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 86 PID 2432 wrote to memory of 2876 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 86 PID 2432 wrote to memory of 1352 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 87 PID 2432 wrote to memory of 1352 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 87 PID 2432 wrote to memory of 1352 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 87 PID 2432 wrote to memory of 3308 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 88 PID 2432 wrote to memory of 3308 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 88 PID 2432 wrote to memory of 3308 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 88 PID 2432 wrote to memory of 1952 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 89 PID 2432 wrote to memory of 1952 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 89 PID 2432 wrote to memory of 1952 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 89 PID 2432 wrote to memory of 4608 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 90 PID 2432 wrote to memory of 4608 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 90 PID 2432 wrote to memory of 4608 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 90 PID 2432 wrote to memory of 3124 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 91 PID 2432 wrote to memory of 3124 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 91 PID 2432 wrote to memory of 3124 2432 95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe 91 PID 2876 wrote to memory of 928 2876 cmd.exe 98 PID 2876 wrote to memory of 928 2876 cmd.exe 98 PID 2876 wrote to memory of 928 2876 cmd.exe 98 PID 2876 wrote to memory of 4912 2876 cmd.exe 99 PID 2876 wrote to memory of 4912 2876 cmd.exe 99 PID 2876 wrote to memory of 4912 2876 cmd.exe 99 PID 2876 wrote to memory of 2348 2876 cmd.exe 100 PID 2876 wrote to memory of 2348 2876 cmd.exe 100 PID 2876 wrote to memory of 2348 2876 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:3076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:928
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:4912
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:2348
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:1352
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3308
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1952
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4608
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\95b8b276fb0e96ca91673d3deaad0640_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:3124
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\123.bat
- Size 443B
- SHA256 d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
- MD5 70170ba16a737a438223b88279dc6c85
- SHA1 cc066efa0fca9bc9f44013660dea6b28ddfd6a24
- SHA512 37cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
- MD5 SHA1 SHA512
- Path C:\Program Files\7-Zip\7zG.exe
- Size 594KB
- SHA256 1ef100f4b0611c17f269c42993cc3669d680babac0ee28445346417f07cfe820
- MD5 9458de2081b38bcd811d891912b3c1c7
- SHA1 176fa23f7a29b4c7b2dff77ae685d743288321b3
- SHA512 133efc8b4a59b70ede6056082e0f40b27bbfff16f7d1317638c1ecee2c625a9ef29248323b594fc3baeaa1d733bf79f7a02b26842c1a37722ae9e9e045fe9cc4
- SSDEEP 12288:zBgnnf1lgzNlbhffX8PTWS+Nsf1lgzyYT:zGfPidULWFoPiyYT
- MD5 SHA1 SHA512 SSDEEP