Analysis
- max time kernel
141s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 02:17
Behavioral task
behavioral1
Sample
75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe
- Size 1.8MB
- Sample240518-cq142sff6v
- SHA256 28ffab77a5afe13fdbce08d144f8aa1c750d4c6cf68760e5bcb1b5b4feafe84c
- MD5 75380b5b1da1c990356a411f5d38e290
- SHA1 d9b8aaf2f3f7ee8f93667b12025d1438e469f951
- SHA512 17636fe6f617cd42a0e7a1f21b70e2741260658883afd771f83c9db91ab19762b42d1b2418b104084dab33b2229b1c4cc437849378bbcf9a866ec7afb9d8f8c1
- SSDEEP 49152:0C+dFCIoUZaYpzp/XhuemO50mhWlMQWbjcREOWFXXUR:0CrQaY3/xuM50mCMQWbDOWFi
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Neshta payload 14 IoCs
resource yara_rule behavioral2/files/0x00060000000201d7-88.dat family_neshta behavioral2/files/0x00070000000235ec-106.dat family_neshta behavioral2/files/0x00070000000235e8-104.dat family_neshta behavioral2/files/0x00070000000235e9-100.dat family_neshta behavioral2/files/0x00070000000235ed-112.dat family_neshta behavioral2/files/0x00070000000235f3-118.dat family_neshta behavioral2/files/0x0007000000023630-276.dat family_neshta behavioral2/files/0x00070000000235f8-218.dat family_neshta behavioral2/files/0x00070000000235f7-217.dat family_neshta behavioral2/files/0x00070000000235f4-214.dat family_neshta behavioral2/files/0x00070000000235ee-208.dat family_neshta behavioral2/memory/4276-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4276-278-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4276-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 596 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\ASUS\Temp\GUTEFC0.tmp 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\AS251C~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_el.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_mr.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_sk.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI9C33~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\AsusCrashHandler.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_en-GB.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_ms.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_sr.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_sv.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\GET-AP~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\AsusUpdateBroker.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\AsusUpdateComRegisterShell64.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_ja.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\AsusUpdateOnDemand.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_sl.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\ASUSUP~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_ar.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\AS9B6F~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\psmachine.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_ca.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_proxy.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\psuser.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_fr.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_kn.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_no.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_hi.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_lt.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_ml.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_ru.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedgewebview2.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\notification_click_helper.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File created C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\asupdateres_fa.dll 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4276 wrote to memory of 596 4276 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe 92 PID 4276 wrote to memory of 596 4276 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe 92 PID 4276 wrote to memory of 596 4276 75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\3582-490\75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:81⤵PID:4580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\AS251C~1.EXE
- Size 277KB
- SHA256 509434b187c8b56458e078b3a4f6c50834ed1a505ce4b86fdb4310ff12afc6af
- MD5 7039c3c0904f3e82b07068576032d382
- SHA1 ef57546b4b007b00c5ea0038c614983e31470f59
- SHA512 8dfcef16b15e2259b6ebd06df218a717d72971e5ae4903defbd0d391a184eb8afdd7b1f503f87438f0004270e8ea741f4ba891ea73076d4bd6226042526ce03f
- SSDEEP 6144:7LWKn1SYz6l1COVn4zgFh39AOdxxEOWh+4xB8WKn1V:eKn1S1l1COVpN9zE5h+4xBBKn1V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\AS9B6F~1.EXE
- Size 1.8MB
- SHA256 4baff8118d059cebfda5e5dfc7996eca9ccb61b4c0f00c70afa080274e89c5d2
- MD5 3b741a9884ae48e87a724766550afac2
- SHA1 c120d2c4635882b2f36b22d8c4e15ab8d4d4fbdf
- SHA512 f38f735b1d6d21da25cc3d214788ea6e85704f348cd45de392de29998a24f3eca10fd007a51e1ab663f095b8fce7e9eac6fd5e590ccb1328163f7955e4d1f885
- SSDEEP 49152:cHC+dFCIoUZaYpzp/XhuemO50mhWlMQWbjcREOWFXXUR:oCrQaY3/xuM50mCMQWbDOWFi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\ASE63C~1.EXE
- Size 1.1MB
- SHA256 44f630d76d2d4223a110708e7900c51cbb82f7737b6ea5d2e2acf8147453cc32
- MD5 820ad864376ab19587057d85856a9e86
- SHA1 9feb99ffc6fcd4a4e6a5dc6336d44c7758a9db30
- SHA512 4d0f98766cec05f86557d5db7ea43739c234cff1e43dad69dbe79581232df02ab1d8a40c1c06542b6522750d0815e7fd7ec510c1936a7db1efa0b6f1fa83439f
- SSDEEP 24576:cmhiDYH9+/QhhASgXwEiNVeLlSxdTvh6J700+vwoGfukdLAdCn3+mS:cAiDYdUQhhASgXEVeovDh6h00+Y2k6WS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\ASUSCR~1.EXE
- Size 350KB
- SHA256 2b367c67c663b5cec6cc98c88b2bcaeea26c41c1747073170bb7d29d0abf4d51
- MD5 c840e10f9106853a4f532aaeac3a203a
- SHA1 e136a2ed2846421c97332a4426b97d5b116f2201
- SHA512 61d672b91ec997d8f2e7fab3b54ef88deedfa70cfac9c458a69a6e51c85e32a45828af1eb5c1d19dee36258b7a0d6d80506c389e5f305db230b519ea45236b1f
- SSDEEP 6144:k9uYqGI6Zqjdq7sr1wUDL2mheJqmCAOXEPAZh+ImuDU0+owu:dT6kjmE1wUD8JqmClEMh+IRDz+oP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\ASUSCR~2.EXE
- Size 447KB
- SHA256 275516f7fa4135a7a2471006627290e5286f90c592d6d0a692cf8b25b13a0e50
- MD5 afe810a194195170bc8c16d16c463899
- SHA1 9132732dab6e3d3bbe8a7d041439f01fd37a99a4
- SHA512 4ce8d334f58f99accc4c854c78ab095d4b297e48a3773842a9851aaa196e520cb24c56a029af6654107dfb7b843a2868f6f821edf466be25516534f70df299ca
- SSDEEP 12288:FeOwQTLEknIOCh3DvC++72lFmUVPZi8GoW4E7xZVh+A1e+:FeOP/EknIXhTC++72lFht88GKEphve+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\ASUSUP~1.EXE
- Size 283KB
- SHA256 7e63faaef8e9d4a6fee12943cb9c35f578855f6c77b2976096dce1418060c6da
- MD5 5207e4e8b8f9587901f3a0f5f9b89f21
- SHA1 d435a39f472da5ee53196f39187c829d130e7770
- SHA512 461c4a56e8011433eec03f5b9d95b2f3aebcec0cc4aac5e5d21fd0f80c0cabb053c23b5f9fafb8b312b43e8154a103b9ca6e20ef4e5f793f804e9ae7dfeb1ee7
- SSDEEP 6144:k9DQVAYdOuLAYny/jHuWLiVcZB+Q/3PcM9QG9U94g25x/fPG2mWOA3D/iBP/SZ8N:2vcOuLAYny7LQcZB+yWj0u9tL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\ASUSUP~2.EXE
- Size 145KB
- SHA256 0c2de11a48d0254ca1f3d0d58817c7c5e29d53da155c655db7d139ab92ba03a1
- MD5 6fcdea4acc8a7cb0c81967f430de51a5
- SHA1 9fffccc83b93c8af5b8f4ca4109b74fa3b8668ff
- SHA512 3f78ade8b19763e0213b27541135ea0d03b5a6d89b67054d890051cbad075204af674cb314c6ae48999e8a7c2b88c8a7dd2a889fda0554c24b5945be1a03b565
- SSDEEP 3072:sr85CeilXrI9Z+ZCdtEB+8FTNC/wg7pJwRhqIt3dGwead/ryt:k9rMRtEB+6TNCfJwFJd1/M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\ASUSUP~3.EXE
- Size 145KB
- SHA256 3f0c0ac4cc0bec154b70fba30d0cd2f54c44502632b8140886bdb63ed1e81466
- MD5 1dc513f2f04f1b06fd1ef6c6e8d77e00
- SHA1 12f60458bf7272f47d32b618a1cc98ce3eb23a8c
- SHA512 9de5e90b329abb564abbc7d286f65ff0c4e539c6f09f416fc2abc3b9258cd2c7e7113889f5a9aa61aec8ff0794a053f38524a1e940cf083871abdec0ea2d73bb
- SSDEEP 3072:sr85CeimXrI9Z+ACdtEB+8hTN8/0DpJwRhqIt3dGwead/ryt:k9EM0tEB+mTN8uJwFJd1/M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\ASUSUP~4.EXE
- Size 189KB
- SHA256 e31abbf3a0b962e27d2fb08f4c86464b97c66efbd6df7b76352916081e762f76
- MD5 ece704c3c644330935a392b14aba21e8
- SHA1 84abdb476a02d61dd61f632c12e556603d409ac8
- SHA512 93864b92c5140e2d129163d863639b7b590a6c392337f656ff271b3d58c212c1bb4025fcf944ac2a9536b241fc9d79dd2d3215f71e3fa0fc508ddd469d80d275
- SSDEEP 3072:tJxPk8LB57VaInR8R1xGBbuq+vseJ3Bwt5WNUoY46V2TTDDtEvl4X/Lm:tJx8CB578+R8RGBbuXkY6ohzTDZENSTm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\ASUS\Temp\GUMEFBF.tmp\GET-AP~1.EXE
- Size 84KB
- SHA256 e09de61621280a3c0f0c8bcbbd780b17c52b562066a27c01059c1c3b04ee806d
- MD5 5c313c1ea973bf7c936c0a3ae419f52b
- SHA1 a6f90311a0cf1e7ce950c5486ad6d621f298fbe9
- SHA512 c638bc95f1f9b3eedd61678533b4a2cb367691f0a44d499a35825d6c48512fc012f5c738c250ae69efd589071be30e95905ada1226b25bb9d3d562f21fd9e55c
- SSDEEP 1536:JxqjQ+P04wsmJC+IbMG+ork/I7lEHVUOtojxhmVclh/7JRPxS:sr85C+IIG4IBEHVUOtojxh8Yh/7xS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
- Size 86KB
- SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
- MD5 3b73078a714bf61d1c19ebc3afc0e454
- SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
- SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
- SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\AsusCrashHandler64.exe
- Size 447KB
- SHA256 85183ff0b1a0171f1a9e71b619b2884219f76a2f74d60d784e218cac0936982e
- MD5 14829730de96b6839331c5307e26aa92
- SHA1 be4ddd26e073237ed53e03d6f05cab23edf82ecf
- SHA512 adcc6cfa7332672e5f8cf711dbdfdb57b442e9e219750b6640e9454a055cd33006968b23c9602ff7d8b4471a234e306d1ddc2fc036257e6a3d512a51b6f19938
- SSDEEP 12288:mwQTLEknIOCh3DvC++72lFmUVPZi8GoW4E7xZVh+A1e+:mP/EknIXhTC++72lFht88GKEphve+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\AsusUpdateComRegisterShell64.exe
- Size 230KB
- SHA256 be4696e64ef63d70486c1b579dfa1aeda5f45003f4ed27f0a562f0166ef37330
- MD5 57eebfad24e775e0b4418a07b03487d2
- SHA1 dd4d339dd9ff0e671bd8a36efc7921e8daee3663
- SHA512 be75ecb271027293d6bd5b6c3b182b6cf9762de95cac41cef3760f93a4452b2a91d146e654fede06efd1c6257f2b417b7ee027bd48addf13138bd1f2a2079b77
- SSDEEP 6144:k9U78+R8RGBbuXkY6ohzTDZENSTDJx8CBE:b8M8ABbK6olxTtKCBE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\AsusUpdateCore.exe
- Size 277KB
- SHA256 3cc75e6267680ee03dfe3fc6288c5f74a2b9cc12c85fe352e6f7904f8d618e23
- MD5 0ea72e7af7bf5a7bcd351d04c4b538f6
- SHA1 b6ff641082702b6be2d1783762f91083b3e031bd
- SHA512 5627c63cf60f7a3513c190b55ef0929de2ba715e5824e2d6708e777bfb09a0cb5c17958fd742eab9c38f07022432f00a7b18becdab54da4a5a7c39527288bd09
- SSDEEP 6144:k9mYz6l1COVn4zgFh39AOdxxEOWh+4xB8WKn1V:31l1COVpN9zE5h+4xBBKn1V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\AsusUpdateSetup.exe
- Size 1.8MB
- SHA256 28ffab77a5afe13fdbce08d144f8aa1c750d4c6cf68760e5bcb1b5b4feafe84c
- MD5 75380b5b1da1c990356a411f5d38e290
- SHA1 d9b8aaf2f3f7ee8f93667b12025d1438e469f951
- SHA512 17636fe6f617cd42a0e7a1f21b70e2741260658883afd771f83c9db91ab19762b42d1b2418b104084dab33b2229b1c4cc437849378bbcf9a866ec7afb9d8f8c1
- SSDEEP 49152:0C+dFCIoUZaYpzp/XhuemO50mhWlMQWbjcREOWFXXUR:0CrQaY3/xuM50mCMQWbDOWFi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ASUS\Temp\GUMEFBF.tmp\AsusUpdater.exe
- Size 1.1MB
- SHA256 204b248a948da981fdf304b3a968555eb1b38838444548168d8e2554ea66ab1e
- MD5 0f725ed3e57157b479bf48e6bf7a79fb
- SHA1 3d8dbd72cf3a00c5e07e2e20536c19759fb1b3fc
- SHA512 e80d2be0cf488b4fa0d9c659bbda7a08769b020f79ee2ee4b6dbef9c34850d3d7fd268e652781446ec8c9487aa68607dff8a0f987ef9da27563d1ea2ea7d5d2a
- SSDEEP 24576:MmhiDYH9+/QhhASgXwEiNVeLlSxdTvh6J700+vwoGfukdLAdCn3+mS:MAiDYdUQhhASgXEVeovDh6h00+Y2k6WS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe
- Size 1.8MB
- SHA256 7401e00729e9f387bcd30098562960e1f2ab2bad6ab982b515506f1e25a13b26
- MD5 cc5c9e450ff520effa228e75550d43ca
- SHA1 9e8dee774df450d1c1a6cfa37a43902b12ea13c2
- SHA512 8d3111016857d5e6aef621aaeacbf618ce8ff985e3c9a39b5298cce37360fc8029817a9ba3f1ee029ddd69789eaa97c82d758494660400db06ca68ed67e6b7dc
- SSDEEP 49152:cHC+dFCIoUZaYpzp/XhuemO50mhWlMQWbjcREOWFXX0:oCrQaY3/xuM50mCMQWbDOWF0
- MD5 SHA1 SHA512 SSDEEP