e01452fae026a319ca3a858940cfd62242b10b264ae06fc05d50c45f11c0d7db

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
Size 105KB
Sample240614-eefp3sxhrq
SHA256 e01452fae026a319ca3a858940cfd62242b10b264ae06fc05d50c45f11c0d7db
MD5 9ff813299d25a30883c0697996beaca0
SHA1 44ff3dc76d72b4eabac961492308b0befd89f878
SHA512 e593a2dbf8fa78814634a72e515a0822675bc558c9d7b135906c1b0fdf53b38b9dcfff80434d7b85f98bde1ee42e679a268e8225be6f54bef00a0044d383872c
SSDEEP 3072:JjaY46tGNFC0VFu2NQKPWDyDRepJltZrpRSfHe:/46tGfC0jhNSDyDRothpQG
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
3272	Logo1_.exe
4812	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
File created	C:\Windows\Logo1_.exe	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe
3272	Logo1_.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 1744	3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe	81
PID 3732 wrote to memory of 1744	3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe	81
PID 3732 wrote to memory of 1744	3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe	81
PID 1744 wrote to memory of 3420	1744	net.exe	83
PID 1744 wrote to memory of 3420	1744	net.exe	83
PID 1744 wrote to memory of 3420	1744	net.exe	83
PID 3732 wrote to memory of 3276	3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe	87
PID 3732 wrote to memory of 3276	3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe	87
PID 3732 wrote to memory of 3276	3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe	87
PID 3732 wrote to memory of 3272	3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe	89
PID 3732 wrote to memory of 3272	3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe	89
PID 3732 wrote to memory of 3272	3732	9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe	89
PID 3272 wrote to memory of 2448	3272	Logo1_.exe	90
PID 3272 wrote to memory of 2448	3272	Logo1_.exe	90
PID 3272 wrote to memory of 2448	3272	Logo1_.exe	90
PID 3276 wrote to memory of 4812	3276	cmd.exe	91
PID 3276 wrote to memory of 4812	3276	cmd.exe	91
PID 3276 wrote to memory of 4812	3276	cmd.exe	91
PID 2448 wrote to memory of 528	2448	net.exe	93
PID 2448 wrote to memory of 528	2448	net.exe	93
PID 2448 wrote to memory of 528	2448	net.exe	93
PID 3272 wrote to memory of 3244	3272	Logo1_.exe	94
PID 3272 wrote to memory of 3244	3272	Logo1_.exe	94
PID 3272 wrote to memory of 3244	3272	Logo1_.exe	94
PID 3244 wrote to memory of 3996	3244	net.exe	96
PID 3244 wrote to memory of 3996	3244	net.exe	96
PID 3244 wrote to memory of 3996	3244	net.exe	96
PID 3272 wrote to memory of 3444	3272	Logo1_.exe	55
PID 3272 wrote to memory of 3444	3272	Logo1_.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:3420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B92.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe"
      4⤵
      Executes dropped EXE
      PID:4812
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:528
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3244
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 258KB
SHA256 e8db4f222623580956eaa3cecb1aff5bcd019e9a004c3fe05f0feb696580c44e
MD5 abebaf128d6bdb9fde2b1f0e33f1940d
SHA1 173fb9534043dca8d7b00cd16e140bea31e380c4
SHA512 6d73721e41950c1d3473bfe154ce33ed2b52034ec9c56608e84f00323db7860930dfba52613a5a8f02644a112891e3d8e615c705647719b70316ea8dd226be92
SSDEEP 6144:246tGfC0jJgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:23WFj2itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 577KB
SHA256 0090fa82fba1b753ce57a6649fa385ee72ca485ad63ff2871220778f5b2bad01
MD5 b23c9206128d112b598eae8ecb14da16
SHA1 93946e340c1d478b7968951b47e9f8d2cbad6666
SHA512 07235d26398db1abae650402a3c944747f367f9d00acdd2fa47e51f92b62ca4ae45393e85696350a559000c1915e2e8ec5a6f97d22d7882acab64a70c8b02009
SSDEEP 6144:/46tGfC0jcE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4tR:/3WFjn7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 644KB
SHA256 636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
MD5 0eec0543603f7a8ce8e8f5fee478e1d2
SHA1 f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA512 cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
SSDEEP 12288:QR3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a3B92.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3B92.bat
Size 620B
SHA256 8b28850bf28cb0ed3f6664129887313457f5e428be36342731ee654bab49d9d5
MD5 649d0957fa4ceee536577e04b4ce9392
SHA1 6fb4bc71c1a8a7d74744c8878c8dc5c39a946b49
SHA512 288069281105ecf8571320a11bf24caa4e4607daeffe16ec077964421bb3c22cb6b7e5a526148f1de6dc3b4e5c800a5eec847efeb158f9ece5e2d107bf1e5ca9
MD5 SHA1 SHA512

Submit Download

9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\9ff813299d25a30883c0697996beaca0_NeikiAnalytics.exe.exe
Size 71KB
SHA256 99cec7888af203c8997fc4e9a3b2a5b974540fe0e70f161c1b6b025309f12607
MD5 423adb5b09778f505593929d89d3fd8c
SHA1 ba688ed370a2dbba0589fc7bcebf726111910189
SHA512 406452e7891f8b4307465ee83edb925c76a1649bb405878cfb1d8e971c470569163f1493922b25a44f71b788f0ff1971485eafe47d982752d3974426032edd51
SSDEEP 1536:MEwOnbNQKLjWDyy1o5RepJUEbooPRrKKRSq6Hne:M2NQKPWDyDRepJltZrpRSfHe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 3e4b59e3d964fb8e6f36415ef5acbb9d24638945c0ee0ed4624e34e3fd766449
MD5 55b45e3d9494b95a16c60dfc44599db6
SHA1 66ec47cfced6ff77e8a5bba352f48ad6f7e78d7b
SHA512 416fa491918b8e071b0d6d4bfe6c83de520a6543720f9fc072e22c0ffe4a1c82ece856f4961e111b04365ff3e70ae834e9b39b0a9825686b78b5102a1c70933f
SSDEEP 768:JFMUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JjaYzMXqtGN/CstC9qVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2447855248-390457009-3660902674-1000\_desktop.ini
Size 9B
SHA256 85a53f5b976fb1c26ce14c31e93c1f68997d2d8b09ab9aa2b7e0d32b8e50ec3b
MD5 03c36dbecb7f35761f80ba5fc5566da6
SHA1 159b7733006187467bda251a1bbb278c141dceb6
SHA512 fe573085d2abef34adcede2f89b1c2810875ab00ef9ba27a1d95ed1dbe93e182fc53d981901a0b8048dd4eb5fdc852b8f0e0c3a0e1a404cbbe70e13a7a14104a
MD5 SHA1 SHA512

Submit Download

memory/3272-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3272-5168-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3272-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3272-8653-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3732-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3732-12-0x0000000000400000-0x000000000043E000-memory.dmp

Download