Malware analysis FuckNiga1.exe Malicious activity | ANY.RUN - Malware Sandbox Online

Add for printing

File name:	FuckNiga1.exe
Full analysis:	https://app.any.run/tasks/12310a07-990a-4d6d-b913-23b741e30e75
Verdict:	Malicious activity
Analysis date:	March 25, 2025, 06:02:02
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	python pyinstaller
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:	7B8D9A0CAA9E7F30965F36CDB11C53BA
SHA1:	8694DAB6B2D163C227133CE72B6D4EA67C3BE761
SHA256:	2082FB5DC6DED791901A71BCB9DA9EFABA3AF4CB16B96B53A764D1FDA49A2FA0
SSDEEP:	98304:eVIyDmgGmSyu4YJbebWn7CvlfaMh3pmV4CseEesQHc/kHqqHmRdoiLhrc0W6lpht:2OglOkmPf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 150 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: on
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- The process drops C-runtime libraries
  - FuckNiga1.exe (PID: 4040)
  - FuckNiga1.exe (PID: 1184)
  - FuckNiga1.exe (PID: 4272)
- Process drops legitimate windows executable
  - FuckNiga1.exe (PID: 4040)
  - FuckNiga1.exe (PID: 1184)
  - FuckNiga1.exe (PID: 4272)
  - FuckNiga1.exe (PID: 2108)
- Application launched itself
  - FuckNiga1.exe (PID: 4040)
  - FuckNiga1.exe (PID: 2108)
  - FuckNiga1.exe (PID: 1056)
  - FuckNiga1.exe (PID: 1184)
  - FuckNiga1.exe (PID: 5892)
  - FuckNiga1.exe (PID: 960)
  - FuckNiga1.exe (PID: 4776)
  - FuckNiga1.exe (PID: 4272)
  - FuckNiga1.exe (PID: 6372)
  - FuckNiga1.exe (PID: 672)
  - FuckNiga1.exe (PID: 1276)
  - FuckNiga1.exe (PID: 2148)
  - FuckNiga1.exe (PID: 5588)
  - FuckNiga1.exe (PID: 6048)
  - FuckNiga1.exe (PID: 3884)
  - FuckNiga1.exe (PID: 1324)
  - FuckNiga1.exe (PID: 2384)
  - FuckNiga1.exe (PID: 3900)
  - FuckNiga1.exe (PID: 6068)
  - FuckNiga1.exe (PID: 6148)
  - FuckNiga1.exe (PID: 904)
  - FuckNiga1.exe (PID: 2392)
  - FuckNiga1.exe (PID: 4812)
  - FuckNiga1.exe (PID: 1764)
  - FuckNiga1.exe (PID: 5164)
  - FuckNiga1.exe (PID: 5344)
  - FuckNiga1.exe (PID: 5548)
  - FuckNiga1.exe (PID: 7188)
  - FuckNiga1.exe (PID: 7224)
  - FuckNiga1.exe (PID: 7208)
  - FuckNiga1.exe (PID: 7244)
  - FuckNiga1.exe (PID: 7300)
  - FuckNiga1.exe (PID: 7284)
  - FuckNiga1.exe (PID: 7264)
  - FuckNiga1.exe (PID: 7316)
  - FuckNiga1.exe (PID: 7344)
  - FuckNiga1.exe (PID: 7440)
  - FuckNiga1.exe (PID: 7460)
  - FuckNiga1.exe (PID: 7476)
  - FuckNiga1.exe (PID: 7508)
  - FuckNiga1.exe (PID: 7492)
  - FuckNiga1.exe (PID: 7548)
  - FuckNiga1.exe (PID: 7524)
  - FuckNiga1.exe (PID: 7652)
  - FuckNiga1.exe (PID: 7636)
  - FuckNiga1.exe (PID: 7684)
  - FuckNiga1.exe (PID: 7668)
  - FuckNiga1.exe (PID: 7572)
  - FuckNiga1.exe (PID: 7604)
  - FuckNiga1.exe (PID: 7620)
  - FuckNiga1.exe (PID: 7700)
  - FuckNiga1.exe (PID: 7716)
  - FuckNiga1.exe (PID: 7748)
  - FuckNiga1.exe (PID: 7780)
  - FuckNiga1.exe (PID: 7824)
  - FuckNiga1.exe (PID: 7872)
  - FuckNiga1.exe (PID: 7944)
  - FuckNiga1.exe (PID: 7960)
  - FuckNiga1.exe (PID: 7988)
  - FuckNiga1.exe (PID: 7896)
  - FuckNiga1.exe (PID: 8008)
  - FuckNiga1.exe (PID: 8064)
  - FuckNiga1.exe (PID: 8080)
  - FuckNiga1.exe (PID: 8100)
  - FuckNiga1.exe (PID: 8120)
  - FuckNiga1.exe (PID: 8048)
  - FuckNiga1.exe (PID: 8184)
  - FuckNiga1.exe (PID: 6676)
  - FuckNiga1.exe (PID: 1040)
  - FuckNiga1.exe (PID: 1240)
  - FuckNiga1.exe (PID: 8148)
  - FuckNiga1.exe (PID: 8164)
  - FuckNiga1.exe (PID: 6960)
  - FuckNiga1.exe (PID: 2908)
  - FuckNiga1.exe (PID: 3332)
  - FuckNiga1.exe (PID: 6572)
  - FuckNiga1.exe (PID: 5084)
  - FuckNiga1.exe (PID: 5136)
  - FuckNiga1.exe (PID: 3008)
  - FuckNiga1.exe (PID: 4464)
  - FuckNiga1.exe (PID: 4844)
  - FuckNiga1.exe (PID: 6736)
  - FuckNiga1.exe (PID: 4896)
  - FuckNiga1.exe (PID: 4724)
  - FuckNiga1.exe (PID: 4000)
  - FuckNiga1.exe (PID: 7432)
  - FuckNiga1.exe (PID: 6540)
  - FuckNiga1.exe (PID: 4212)
  - FuckNiga1.exe (PID: 5600)
  - FuckNiga1.exe (PID: 6760)
  - FuckNiga1.exe (PID: 7452)
  - FuckNiga1.exe (PID: 5404)
  - FuckNiga1.exe (PID: 7596)
  - FuckNiga1.exe (PID: 6208)
  - FuckNiga1.exe (PID: 2084)
  - FuckNiga1.exe (PID: 8208)
  - FuckNiga1.exe (PID: 8224)
  - FuckNiga1.exe (PID: 8240)
  - FuckNiga1.exe (PID: 4424)
  - FuckNiga1.exe (PID: 2064)
  - FuckNiga1.exe (PID: 8256)
  - FuckNiga1.exe (PID: 8288)
  - FuckNiga1.exe (PID: 8316)
  - FuckNiga1.exe (PID: 8332)
  - FuckNiga1.exe (PID: 8348)
  - FuckNiga1.exe (PID: 8384)
  - FuckNiga1.exe (PID: 8408)
  - FuckNiga1.exe (PID: 8440)
  - FuckNiga1.exe (PID: 8424)
  - FuckNiga1.exe (PID: 8464)
  - FuckNiga1.exe (PID: 8364)
  - FuckNiga1.exe (PID: 8512)
  - FuckNiga1.exe (PID: 8536)
  - FuckNiga1.exe (PID: 8556)
  - FuckNiga1.exe (PID: 8488)
  - FuckNiga1.exe (PID: 8572)
  - FuckNiga1.exe (PID: 8680)
  - FuckNiga1.exe (PID: 8636)
  - FuckNiga1.exe (PID: 8660)
  - FuckNiga1.exe (PID: 8600)
  - FuckNiga1.exe (PID: 8620)
  - FuckNiga1.exe (PID: 8720)
  - FuckNiga1.exe (PID: 8776)
  - FuckNiga1.exe (PID: 8752)
  - FuckNiga1.exe (PID: 8700)
- Loads Python modules
  - FuckNiga1.exe (PID: 2108)
  - FuckNiga1.exe (PID: 1056)
  - FuckNiga1.exe (PID: 1184)
  - FuckNiga1.exe (PID: 5892)
  - FuckNiga1.exe (PID: 960)
  - FuckNiga1.exe (PID: 4272)
  - FuckNiga1.exe (PID: 6372)
  - FuckNiga1.exe (PID: 672)
  - FuckNiga1.exe (PID: 4776)
  - FuckNiga1.exe (PID: 2384)
  - FuckNiga1.exe (PID: 1276)
  - FuckNiga1.exe (PID: 2148)
  - FuckNiga1.exe (PID: 5588)
  - FuckNiga1.exe (PID: 1324)
  - FuckNiga1.exe (PID: 3884)
  - FuckNiga1.exe (PID: 6048)
  - FuckNiga1.exe (PID: 3900)
  - FuckNiga1.exe (PID: 6068)
  - FuckNiga1.exe (PID: 6148)
  - FuckNiga1.exe (PID: 904)
  - FuckNiga1.exe (PID: 2392)
  - FuckNiga1.exe (PID: 4812)
  - FuckNiga1.exe (PID: 1764)
  - FuckNiga1.exe (PID: 5164)
  - FuckNiga1.exe (PID: 5344)
  - FuckNiga1.exe (PID: 5548)
  - FuckNiga1.exe (PID: 7208)
  - FuckNiga1.exe (PID: 7188)
  - FuckNiga1.exe (PID: 7224)
  - FuckNiga1.exe (PID: 7264)
  - FuckNiga1.exe (PID: 7244)
  - FuckNiga1.exe (PID: 7284)
  - FuckNiga1.exe (PID: 7300)
  - FuckNiga1.exe (PID: 7316)
  - FuckNiga1.exe (PID: 7344)
  - FuckNiga1.exe (PID: 7440)
  - FuckNiga1.exe (PID: 7460)
  - FuckNiga1.exe (PID: 7476)
  - FuckNiga1.exe (PID: 7508)
  - FuckNiga1.exe (PID: 7492)
  - FuckNiga1.exe (PID: 7524)
  - FuckNiga1.exe (PID: 7548)
  - FuckNiga1.exe (PID: 7572)
  - FuckNiga1.exe (PID: 7620)
  - FuckNiga1.exe (PID: 7636)
  - FuckNiga1.exe (PID: 7652)
  - FuckNiga1.exe (PID: 7668)
  - FuckNiga1.exe (PID: 7684)
  - FuckNiga1.exe (PID: 7604)
  - FuckNiga1.exe (PID: 7716)
  - FuckNiga1.exe (PID: 7748)
  - FuckNiga1.exe (PID: 7780)
  - FuckNiga1.exe (PID: 7824)
  - FuckNiga1.exe (PID: 7872)
  - FuckNiga1.exe (PID: 7700)
  - FuckNiga1.exe (PID: 7944)
  - FuckNiga1.exe (PID: 7960)
  - FuckNiga1.exe (PID: 7988)
  - FuckNiga1.exe (PID: 7896)
  - FuckNiga1.exe (PID: 8008)
  - FuckNiga1.exe (PID: 8048)
  - FuckNiga1.exe (PID: 8064)
  - FuckNiga1.exe (PID: 8080)
  - FuckNiga1.exe (PID: 8100)
  - FuckNiga1.exe (PID: 8120)
  - FuckNiga1.exe (PID: 8148)
  - FuckNiga1.exe (PID: 6676)
  - FuckNiga1.exe (PID: 6960)
  - FuckNiga1.exe (PID: 1240)
  - FuckNiga1.exe (PID: 8164)
  - FuckNiga1.exe (PID: 8184)
  - FuckNiga1.exe (PID: 2908)
  - FuckNiga1.exe (PID: 3332)
  - FuckNiga1.exe (PID: 6572)
  - FuckNiga1.exe (PID: 1040)
  - FuckNiga1.exe (PID: 5084)
  - FuckNiga1.exe (PID: 6736)
  - FuckNiga1.exe (PID: 5136)
  - FuckNiga1.exe (PID: 4212)
  - FuckNiga1.exe (PID: 3008)
  - FuckNiga1.exe (PID: 4464)
  - FuckNiga1.exe (PID: 6540)
  - FuckNiga1.exe (PID: 4844)
  - FuckNiga1.exe (PID: 4896)
  - FuckNiga1.exe (PID: 4724)
  - FuckNiga1.exe (PID: 4000)
  - FuckNiga1.exe (PID: 7432)
  - FuckNiga1.exe (PID: 6760)
  - FuckNiga1.exe (PID: 5600)
  - FuckNiga1.exe (PID: 7452)
  - FuckNiga1.exe (PID: 5404)
  - FuckNiga1.exe (PID: 7596)
  - FuckNiga1.exe (PID: 6208)
  - FuckNiga1.exe (PID: 8224)
  - FuckNiga1.exe (PID: 8208)
  - FuckNiga1.exe (PID: 8240)
  - FuckNiga1.exe (PID: 4424)
  - FuckNiga1.exe (PID: 2064)
  - FuckNiga1.exe (PID: 2084)
  - FuckNiga1.exe (PID: 8348)
  - FuckNiga1.exe (PID: 8316)
  - FuckNiga1.exe (PID: 8332)
  - FuckNiga1.exe (PID: 8256)
  - FuckNiga1.exe (PID: 8288)
  - FuckNiga1.exe (PID: 8408)
  - FuckNiga1.exe (PID: 8424)
  - FuckNiga1.exe (PID: 8440)
  - FuckNiga1.exe (PID: 8464)
  - FuckNiga1.exe (PID: 8364)
  - FuckNiga1.exe (PID: 8384)
  - FuckNiga1.exe (PID: 8536)
  - FuckNiga1.exe (PID: 8512)
  - FuckNiga1.exe (PID: 8556)
  - FuckNiga1.exe (PID: 8572)
  - FuckNiga1.exe (PID: 8488)
  - FuckNiga1.exe (PID: 8620)
  - FuckNiga1.exe (PID: 8636)
  - FuckNiga1.exe (PID: 8680)
  - FuckNiga1.exe (PID: 8700)
  - FuckNiga1.exe (PID: 8600)
  - FuckNiga1.exe (PID: 8660)
  - FuckNiga1.exe (PID: 8720)
  - FuckNiga1.exe (PID: 8752)
  - FuckNiga1.exe (PID: 8776)
- Process drops python dynamic module
  - FuckNiga1.exe (PID: 4040)
- Executable content was dropped or overwritten
  - FuckNiga1.exe (PID: 4040)
  - FuckNiga1.exe (PID: 1184)
  - FuckNiga1.exe (PID: 2108)
  - FuckNiga1.exe (PID: 4272)
  - FuckNiga1.exe (PID: 672)
INFO
- Checks supported languages
  - FuckNiga1.exe (PID: 4040)
  - FuckNiga1.exe (PID: 2108)
  - FuckNiga1.exe (PID: 1056)
  - FuckNiga1.exe (PID: 1184)
  - FuckNiga1.exe (PID: 5892)
  - FuckNiga1.exe (PID: 960)
  - FuckNiga1.exe (PID: 4272)
  - FuckNiga1.exe (PID: 6372)
  - FuckNiga1.exe (PID: 672)
  - FuckNiga1.exe (PID: 4776)
  - FuckNiga1.exe (PID: 5588)
  - FuckNiga1.exe (PID: 3884)
  - FuckNiga1.exe (PID: 1324)
  - FuckNiga1.exe (PID: 6048)
  - FuckNiga1.exe (PID: 2384)
  - FuckNiga1.exe (PID: 1276)
  - FuckNiga1.exe (PID: 2148)
  - FuckNiga1.exe (PID: 3900)
  - FuckNiga1.exe (PID: 6068)
  - FuckNiga1.exe (PID: 6148)
  - FuckNiga1.exe (PID: 904)
  - FuckNiga1.exe (PID: 2392)
  - FuckNiga1.exe (PID: 4812)
  - FuckNiga1.exe (PID: 5548)
  - FuckNiga1.exe (PID: 5164)
  - FuckNiga1.exe (PID: 5344)
  - FuckNiga1.exe (PID: 7188)
  - FuckNiga1.exe (PID: 7208)
  - FuckNiga1.exe (PID: 7224)
  - FuckNiga1.exe (PID: 1764)
  - FuckNiga1.exe (PID: 7264)
  - FuckNiga1.exe (PID: 7244)
  - FuckNiga1.exe (PID: 7284)
  - FuckNiga1.exe (PID: 7300)
  - FuckNiga1.exe (PID: 7316)
  - FuckNiga1.exe (PID: 7344)
  - FuckNiga1.exe (PID: 7440)
  - FuckNiga1.exe (PID: 7476)
  - FuckNiga1.exe (PID: 7460)
  - FuckNiga1.exe (PID: 7492)
  - FuckNiga1.exe (PID: 7508)
  - FuckNiga1.exe (PID: 7524)
  - FuckNiga1.exe (PID: 7548)
  - FuckNiga1.exe (PID: 7572)
  - FuckNiga1.exe (PID: 7652)
  - FuckNiga1.exe (PID: 7636)
  - FuckNiga1.exe (PID: 7668)
  - FuckNiga1.exe (PID: 7684)
  - FuckNiga1.exe (PID: 7604)
  - FuckNiga1.exe (PID: 7620)
  - FuckNiga1.exe (PID: 7700)
  - FuckNiga1.exe (PID: 7780)
  - FuckNiga1.exe (PID: 7748)
  - FuckNiga1.exe (PID: 7824)
  - FuckNiga1.exe (PID: 7872)
  - FuckNiga1.exe (PID: 7716)
  - FuckNiga1.exe (PID: 7944)
  - FuckNiga1.exe (PID: 7960)
  - FuckNiga1.exe (PID: 7988)
  - FuckNiga1.exe (PID: 8008)
  - FuckNiga1.exe (PID: 8048)
  - FuckNiga1.exe (PID: 7896)
  - FuckNiga1.exe (PID: 8080)
  - FuckNiga1.exe (PID: 8100)
  - FuckNiga1.exe (PID: 8120)
  - FuckNiga1.exe (PID: 8148)
  - FuckNiga1.exe (PID: 8064)
  - FuckNiga1.exe (PID: 6676)
  - FuckNiga1.exe (PID: 1240)
  - FuckNiga1.exe (PID: 8164)
  - FuckNiga1.exe (PID: 2908)
  - FuckNiga1.exe (PID: 5084)
  - FuckNiga1.exe (PID: 3332)
  - FuckNiga1.exe (PID: 6572)
  - FuckNiga1.exe (PID: 8184)
  - FuckNiga1.exe (PID: 6960)
  - FuckNiga1.exe (PID: 1040)
  - FuckNiga1.exe (PID: 6736)
  - FuckNiga1.exe (PID: 4212)
  - FuckNiga1.exe (PID: 3008)
  - FuckNiga1.exe (PID: 4844)
  - FuckNiga1.exe (PID: 6540)
  - FuckNiga1.exe (PID: 4724)
  - FuckNiga1.exe (PID: 4000)
  - FuckNiga1.exe (PID: 7432)
  - FuckNiga1.exe (PID: 7596)
  - FuckNiga1.exe (PID: 4896)
  - FuckNiga1.exe (PID: 5136)
  - FuckNiga1.exe (PID: 4464)
  - FuckNiga1.exe (PID: 6760)
  - FuckNiga1.exe (PID: 5600)
  - FuckNiga1.exe (PID: 5404)
  - FuckNiga1.exe (PID: 7452)
  - FuckNiga1.exe (PID: 4424)
  - FuckNiga1.exe (PID: 6208)
  - FuckNiga1.exe (PID: 2084)
  - FuckNiga1.exe (PID: 8224)
  - FuckNiga1.exe (PID: 8208)
  - FuckNiga1.exe (PID: 8240)
  - FuckNiga1.exe (PID: 2064)
  - FuckNiga1.exe (PID: 8256)
  - FuckNiga1.exe (PID: 8288)
  - FuckNiga1.exe (PID: 8316)
  - FuckNiga1.exe (PID: 8332)
  - FuckNiga1.exe (PID: 8348)
  - FuckNiga1.exe (PID: 8364)
  - FuckNiga1.exe (PID: 8408)
  - FuckNiga1.exe (PID: 8440)
  - FuckNiga1.exe (PID: 8488)
  - FuckNiga1.exe (PID: 8384)
  - FuckNiga1.exe (PID: 8424)
  - FuckNiga1.exe (PID: 8464)
  - FuckNiga1.exe (PID: 8536)
  - FuckNiga1.exe (PID: 8556)
  - FuckNiga1.exe (PID: 8572)
  - FuckNiga1.exe (PID: 8512)
  - FuckNiga1.exe (PID: 8620)
  - FuckNiga1.exe (PID: 8636)
  - FuckNiga1.exe (PID: 8660)
  - FuckNiga1.exe (PID: 8680)
  - FuckNiga1.exe (PID: 8700)
  - FuckNiga1.exe (PID: 8600)
  - FuckNiga1.exe (PID: 8752)
  - FuckNiga1.exe (PID: 8776)
  - FuckNiga1.exe (PID: 8836)
  - FuckNiga1.exe (PID: 8720)
- Reads the computer name
  - FuckNiga1.exe (PID: 4040)
- The sample compiled with english language support
  - FuckNiga1.exe (PID: 4040)
  - FuckNiga1.exe (PID: 1184)
  - FuckNiga1.exe (PID: 4272)
  - FuckNiga1.exe (PID: 2108)
  - FuckNiga1.exe (PID: 672)
- Create files in a temporary directory
  - FuckNiga1.exe (PID: 4040)
- PyInstaller has been detected (YARA)
  - FuckNiga1.exe (PID: 4040)
  - FuckNiga1.exe (PID: 2108)
  - FuckNiga1.exe (PID: 1056)
  - FuckNiga1.exe (PID: 1184)
  - FuckNiga1.exe (PID: 5892)
- SQLite executable
  - FuckNiga1.exe (PID: 1184)
  - FuckNiga1.exe (PID: 672)
- Reads the software policy settings
  - slui.exe (PID: 8792)
- Checks proxy server information
  - slui.exe (PID: 8792)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	InstallShield setup (57.6)
.exe	\|	Win64 Executable (generic) (36.9)
.exe	\|	Generic Win/DOS Executable (2.6)
.exe	\|	DOS Executable Generic (2.6)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2025:03:25 05:36:31+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	14.4
CodeSize:	176640
InitializedDataSize:	152576
UninitializedDataSize:	-
EntryPoint:	0xc320
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows command line

No data.

Add for printing

All screenshots are available in the full report

All screenshots are available in the full report

Add for printing

Total processes

250

Monitored processes

128

Malicious processes

9

Suspicious processes

113

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

672

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=6372" "pipe_handle=408"

C:\Users\admin\Desktop\FuckNiga1.exe

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

904

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=6148" "pipe_handle=372"

C:\Users\admin\Desktop\FuckNiga1.exe

—

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

960

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=5892" "pipe_handle=368"

C:\Users\admin\Desktop\FuckNiga1.exe

—

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

1040

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=6676" "pipe_handle=372"

C:\Users\admin\Desktop\FuckNiga1.exe

—

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

1056

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=2108" "pipe_handle=392"

C:\Users\admin\Desktop\FuckNiga1.exe

—

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

1184

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=1056" "pipe_handle=504"

C:\Users\admin\Desktop\FuckNiga1.exe

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

1240

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=1040" "pipe_handle=536"

C:\Users\admin\Desktop\FuckNiga1.exe

—

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

1276

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=2384" "pipe_handle=276"

C:\Users\admin\Desktop\FuckNiga1.exe

—

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

1324

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=3884" "pipe_handle=376"

C:\Users\admin\Desktop\FuckNiga1.exe

—

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

1764

"C:\Users\admin\Desktop\FuckNiga1.exe" "--multiprocessing-fork" "parent_pid=4812" "pipe_handle=380"

C:\Users\admin\Desktop\FuckNiga1.exe

—

FuckNiga1.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\fuckniga1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

Add for printing

Total events

22 754

Read events

22 754

Write events

0

Delete events

0

Modification events

No data

Add for printing

Executable files

154

Suspicious files

4

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
4040	FuckNiga1.exe	C:\Users\admin\AppData\Local\Temp\_MEI40402\_bz2.pyd		executable
		MD5:DD26ED92888DE9C57660A7AD631BB916	SHA256:324268786921EC940CBD4B5E2F71DAFD08E578A12E373A715658527E5B211697
4040	FuckNiga1.exe	C:\Users\admin\AppData\Local\Temp\_MEI40402\libssl-3.dll		executable
		MD5:19A2ABA25456181D5FB572D88AC0E73E	SHA256:2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
4040	FuckNiga1.exe	C:\Users\admin\AppData\Local\Temp\_MEI40402\libcrypto-3.dll		executable
		MD5:E547CF6D296A88F5B1C352C116DF7C0C	SHA256:05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
4040	FuckNiga1.exe	C:\Users\admin\AppData\Local\Temp\_MEI40402\base_library.zip		compressed
		MD5:763D1A751C5D47212FBF0CAEA63F46F5	SHA256:378A4B40F4FA4A8229C93E0AFEE819085251AF03402CCEFA3B469651E50E60B7
4040	FuckNiga1.exe	C:\Users\admin\AppData\Local\Temp\_MEI40402\unicodedata.pyd		executable
		MD5:B848E259FABAF32B4B3C980A0A12488D	SHA256:C65073B65F107E471C9BE3C699FB11F774E9A07581F41229582F7B2154B6FC3C
4040	FuckNiga1.exe	C:\Users\admin\AppData\Local\Temp\_MEI40402\_ctypes.pyd		executable
		MD5:C8AFA1EBB28828E1115C110313D2A810	SHA256:8978972CF341CCD0EDF8435D63909A739DF7EF29EC7DD57ED5CAB64B342891F0
4040	FuckNiga1.exe	C:\Users\admin\AppData\Local\Temp\_MEI40402\libffi-8.dll		executable
		MD5:0F8E4992CA92BAAF54CC0B43AACCCE21	SHA256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
4040	FuckNiga1.exe	C:\Users\admin\AppData\Local\Temp\_MEI40402\select.pyd		executable
		MD5:79CE1AE3A23DFF6ED5FC66E6416600CD	SHA256:678E09AD44BE42FA9BC9C7A18C25DBE995A59B6C36A13EECC09C0F02A647B6F0
1184	FuckNiga1.exe	C:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exe.txt		executable
		MD5:6280AC1831E499B972405890FFF0B5AF	SHA256:1650105226B7E52E26E98A467BA83F58333F9BB72EA2274B2ABABE598AEF8D65
1184	FuckNiga1.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\1.15.0.1\Microsoft.CognitiveServices.Speech.core.dll.txt		executable
		MD5:0EE2B50C85A110689352FCCFA77B5B18	SHA256:62A13D8459E0992C311DC3551BF3C2D1CE167EA7FA40F0EC62193F3BD760B36E

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

3

TCP/UDP connections

21

DNS requests

7

Threats

0

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2104	svchost.exe	GET	200	2.16.164.72:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	192.168.100.255:137	—	—	—	whitelisted
2104	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2104	svchost.exe	2.16.164.72:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
2104	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6964	slui.exe	40.91.76.224:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
8792	slui.exe	40.91.76.224:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
2104	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 51.104.136.2 51.124.78.146	whitelisted
google.com	142.250.185.174	whitelisted
crl.microsoft.com	2.16.164.72 2.16.164.120	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

Threats

No threats detected

Add for printing

No debug info