Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 02:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe
- Size 8.7MB
- Sample240511-c3xbmabc52
- SHA256 7b47b73ceae7947d66eea37ff2d8d2b71f2ad8317cc88cafb92a6b43c2264cf1
- MD5 5d532285a3f85c4046f251fe8070b020
- SHA1 50144fe0f70d8fa4f32d790608d1df394983b24d
- SHA512 7f4b50b695edf70c52924261458485b979219632014c952e3dfc0a1779f3057c7c618f255e3c273e5ee6dda3974c7a859f21923ce99345c7af938f21a73e6283
- SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbt:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmB
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
jjj
C2
-
youri.mooo.com:1605
Mutex
-
e936a10f968ac948cd351c9629dbd36d
Attributes
-
reg_key
e936a10f968ac948cd351c9629dbd36d
-
splitter
|'|'|
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3156 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation cmd.exe - Executes dropped EXE 3 IoCs
pid Process 3680 winmgr107.exe 3960 winmgr107.exe 4952 winmgr107.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" winmgr107.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x00080000000233a2-9.dat autoit_exe behavioral2/files/0x000700000002342f-11.dat autoit_exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3680 set thread context of 5028 3680 winmgr107.exe 101 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4932 schtasks.exe 2820 schtasks.exe 1248 schtasks.exe 1732 schtasks.exe 3876 schtasks.exe 3532 schtasks.exe 2604 schtasks.exe 3092 schtasks.exe 4564 schtasks.exe 5016 schtasks.exe 2356 schtasks.exe 1484 schtasks.exe 4704 schtasks.exe 3080 schtasks.exe 5072 schtasks.exe 1192 schtasks.exe 4656 schtasks.exe 4712 schtasks.exe 4556 schtasks.exe 3148 schtasks.exe 2364 schtasks.exe 3516 schtasks.exe 2976 schtasks.exe 2476 schtasks.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings cmd.exe - NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File created C:\Users\Admin\AppData\Local\Temp\5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe:Zone.Identifier:$DATA 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe File created C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 3952 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe 3952 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3960 winmgr107.exe 3960 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 4952 winmgr107.exe 4952 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe 3680 winmgr107.exe - Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe Token: 33 5028 RegAsm.exe Token: SeIncBasePriorityPrivilege 5028 RegAsm.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 2488 3952 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe 96 PID 3952 wrote to memory of 2488 3952 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe 96 PID 3952 wrote to memory of 2488 3952 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe 96 PID 2488 wrote to memory of 5024 2488 cmd.exe 98 PID 2488 wrote to memory of 5024 2488 cmd.exe 98 PID 2488 wrote to memory of 5024 2488 cmd.exe 98 PID 3952 wrote to memory of 3680 3952 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe 99 PID 3952 wrote to memory of 3680 3952 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe 99 PID 3952 wrote to memory of 3680 3952 5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe 99 PID 3680 wrote to memory of 5028 3680 winmgr107.exe 101 PID 3680 wrote to memory of 5028 3680 winmgr107.exe 101 PID 3680 wrote to memory of 5028 3680 winmgr107.exe 101 PID 3680 wrote to memory of 5028 3680 winmgr107.exe 101 PID 3680 wrote to memory of 5028 3680 winmgr107.exe 101 PID 3680 wrote to memory of 5016 3680 winmgr107.exe 102 PID 3680 wrote to memory of 5016 3680 winmgr107.exe 102 PID 3680 wrote to memory of 5016 3680 winmgr107.exe 102 PID 3680 wrote to memory of 2356 3680 winmgr107.exe 105 PID 3680 wrote to memory of 2356 3680 winmgr107.exe 105 PID 3680 wrote to memory of 2356 3680 winmgr107.exe 105 PID 5028 wrote to memory of 3156 5028 RegAsm.exe 107 PID 5028 wrote to memory of 3156 5028 RegAsm.exe 107 PID 5028 wrote to memory of 3156 5028 RegAsm.exe 107 PID 3680 wrote to memory of 5072 3680 winmgr107.exe 109 PID 3680 wrote to memory of 5072 3680 winmgr107.exe 109 PID 3680 wrote to memory of 5072 3680 winmgr107.exe 109 PID 3680 wrote to memory of 2820 3680 winmgr107.exe 111 PID 3680 wrote to memory of 2820 3680 winmgr107.exe 111 PID 3680 wrote to memory of 2820 3680 winmgr107.exe 111 PID 3680 wrote to memory of 1248 3680 winmgr107.exe 113 PID 3680 wrote to memory of 1248 3680 winmgr107.exe 113 PID 3680 wrote to memory of 1248 3680 winmgr107.exe 113 PID 3680 wrote to memory of 1484 3680 winmgr107.exe 115 PID 3680 wrote to memory of 1484 3680 winmgr107.exe 115 PID 3680 wrote to memory of 1484 3680 winmgr107.exe 115 PID 3680 wrote to memory of 4704 3680 winmgr107.exe 117 PID 3680 wrote to memory of 4704 3680 winmgr107.exe 117 PID 3680 wrote to memory of 4704 3680 winmgr107.exe 117 PID 3680 wrote to memory of 1732 3680 winmgr107.exe 119 PID 3680 wrote to memory of 1732 3680 winmgr107.exe 119 PID 3680 wrote to memory of 1732 3680 winmgr107.exe 119 PID 3680 wrote to memory of 2364 3680 winmgr107.exe 122 PID 3680 wrote to memory of 2364 3680 winmgr107.exe 122 PID 3680 wrote to memory of 2364 3680 winmgr107.exe 122 PID 3680 wrote to memory of 3532 3680 winmgr107.exe 125 PID 3680 wrote to memory of 3532 3680 winmgr107.exe 125 PID 3680 wrote to memory of 3532 3680 winmgr107.exe 125 PID 3680 wrote to memory of 1192 3680 winmgr107.exe 127 PID 3680 wrote to memory of 1192 3680 winmgr107.exe 127 PID 3680 wrote to memory of 1192 3680 winmgr107.exe 127 PID 3680 wrote to memory of 2604 3680 winmgr107.exe 129 PID 3680 wrote to memory of 2604 3680 winmgr107.exe 129 PID 3680 wrote to memory of 2604 3680 winmgr107.exe 129 PID 3680 wrote to memory of 3876 3680 winmgr107.exe 131 PID 3680 wrote to memory of 3876 3680 winmgr107.exe 131 PID 3680 wrote to memory of 3876 3680 winmgr107.exe 131 PID 3680 wrote to memory of 3516 3680 winmgr107.exe 133 PID 3680 wrote to memory of 3516 3680 winmgr107.exe 133 PID 3680 wrote to memory of 3516 3680 winmgr107.exe 133 PID 3680 wrote to memory of 4932 3680 winmgr107.exe 138 PID 3680 wrote to memory of 4932 3680 winmgr107.exe 138 PID 3680 wrote to memory of 4932 3680 winmgr107.exe 138 PID 3680 wrote to memory of 2976 3680 winmgr107.exe 143 PID 3680 wrote to memory of 2976 3680 winmgr107.exe 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\PROGRA~3\5D5322~1.TXT2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe.txt3⤵PID:5024
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:3156
-
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:5016
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2356
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:5072
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2820
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1248
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1484
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4704
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1732
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2364
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3532
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1192
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2604
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3876
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3516
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4932
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2976
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2476
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3092
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4712
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4556
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4564
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3148
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3080
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4656
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3960
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4952
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~3\5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe.txt
- Size 992B
- SHA256 78bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0
- MD5 c8cf7247d4cfc99a7582a42d13df4c08
- SHA1 317f5588af0b3b6374c436fb00084c522fd78a83
- SHA512 5dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357
- MD5 SHA1 SHA512
- Path C:\ProgramData\winmgr107.exe
- Size 8.7MB
- SHA256 e63d581c049201e9e55c88063b46f79b634413098cf194754fd6b82c73dc7828
- MD5 8be8babfe9595be879e5169d9f0d7a8d
- SHA1 c1602423209d11097e4be9f682cac7afe7dbd893
- SHA512 73390def3ef141ec568be22fb0f54cbf1d16eb8f7f26417ec9f068ce26e04c169ca79d8ecfa60fd1ae0da38d8ba102adf33bcb28eb2e5c9c418f80e1ab241278
- SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb3:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\5d532285a3f85c4046f251fe8070b020_NeikiAnalytics.exe
- Size 8.7MB
- SHA256 7b47b73ceae7947d66eea37ff2d8d2b71f2ad8317cc88cafb92a6b43c2264cf1
- MD5 5d532285a3f85c4046f251fe8070b020
- SHA1 50144fe0f70d8fa4f32d790608d1df394983b24d
- SHA512 7f4b50b695edf70c52924261458485b979219632014c952e3dfc0a1779f3057c7c618f255e3c273e5ee6dda3974c7a859f21923ce99345c7af938f21a73e6283
- SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbt:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmB
- MD5 SHA1 SHA512 SSDEEP