Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 02:40
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe
- Size 8.7MB
- Sample240601-c6al2afb3w
- SHA256 fc5eae732950828b4742ea2c44284e4b8b1ea4c10a6d5ac12b23a2aa3515e89b
- MD5 8a5be6a863514baf275d11343f3e1cb0
- SHA1 b9a2cf6c31f43f4367e63c87b83a68b46f515e0a
- SHA512 a685f0165390160e5b11a570d0732a2e0e2de025e192f8ba9741e5f45019983e6f7564135f56124271b181f96e88a55adade4749ce9fc1bd37dfe8dc2b5e3696
- SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb6:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmm
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
jjj
C2
-
youri.mooo.com:1605
Mutex
-
e936a10f968ac948cd351c9629dbd36d
Attributes
-
reg_key
e936a10f968ac948cd351c9629dbd36d
-
splitter
|'|'|
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3300 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation cmd.exe - Executes dropped EXE 3 IoCs
pid Process 3000 winmgr107.exe 2580 winmgr107.exe 1164 winmgr107.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" winmgr107.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x00080000000233c3-9.dat autoit_exe behavioral2/files/0x00070000000233bc-11.dat autoit_exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3000 set thread context of 1768 3000 winmgr107.exe 99 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 26 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 872 schtasks.exe 2328 schtasks.exe 3968 schtasks.exe 1384 schtasks.exe 3200 schtasks.exe 1512 schtasks.exe 2216 schtasks.exe 3108 schtasks.exe 4444 schtasks.exe 2276 schtasks.exe 3136 schtasks.exe 804 schtasks.exe 908 schtasks.exe 3164 schtasks.exe 208 schtasks.exe 5060 schtasks.exe 4392 schtasks.exe 2492 schtasks.exe 4276 schtasks.exe 2524 schtasks.exe 720 schtasks.exe 2964 schtasks.exe 5076 schtasks.exe 2528 schtasks.exe 2392 schtasks.exe 1732 schtasks.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings cmd.exe - NTFS ADS 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe:Zone.Identifier:$DATA 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe File created C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4436 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe 4436 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 2580 winmgr107.exe 2580 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 1164 winmgr107.exe 1164 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe - Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe Token: 33 1768 RegAsm.exe Token: SeIncBasePriorityPrivilege 1768 RegAsm.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 4012 4436 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe 95 PID 4436 wrote to memory of 4012 4436 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe 95 PID 4436 wrote to memory of 4012 4436 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe 95 PID 4012 wrote to memory of 5012 4012 cmd.exe 97 PID 4012 wrote to memory of 5012 4012 cmd.exe 97 PID 4012 wrote to memory of 5012 4012 cmd.exe 97 PID 4436 wrote to memory of 3000 4436 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe 98 PID 4436 wrote to memory of 3000 4436 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe 98 PID 4436 wrote to memory of 3000 4436 8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe 98 PID 3000 wrote to memory of 1768 3000 winmgr107.exe 99 PID 3000 wrote to memory of 1768 3000 winmgr107.exe 99 PID 3000 wrote to memory of 1768 3000 winmgr107.exe 99 PID 3000 wrote to memory of 1768 3000 winmgr107.exe 99 PID 3000 wrote to memory of 1768 3000 winmgr107.exe 99 PID 3000 wrote to memory of 872 3000 winmgr107.exe 100 PID 3000 wrote to memory of 872 3000 winmgr107.exe 100 PID 3000 wrote to memory of 872 3000 winmgr107.exe 100 PID 3000 wrote to memory of 2528 3000 winmgr107.exe 102 PID 3000 wrote to memory of 2528 3000 winmgr107.exe 102 PID 3000 wrote to memory of 2528 3000 winmgr107.exe 102 PID 1768 wrote to memory of 3300 1768 RegAsm.exe 105 PID 1768 wrote to memory of 3300 1768 RegAsm.exe 105 PID 1768 wrote to memory of 3300 1768 RegAsm.exe 105 PID 3000 wrote to memory of 2328 3000 winmgr107.exe 108 PID 3000 wrote to memory of 2328 3000 winmgr107.exe 108 PID 3000 wrote to memory of 2328 3000 winmgr107.exe 108 PID 3000 wrote to memory of 2964 3000 winmgr107.exe 110 PID 3000 wrote to memory of 2964 3000 winmgr107.exe 110 PID 3000 wrote to memory of 2964 3000 winmgr107.exe 110 PID 3000 wrote to memory of 4444 3000 winmgr107.exe 112 PID 3000 wrote to memory of 4444 3000 winmgr107.exe 112 PID 3000 wrote to memory of 4444 3000 winmgr107.exe 112 PID 3000 wrote to memory of 2392 3000 winmgr107.exe 114 PID 3000 wrote to memory of 2392 3000 winmgr107.exe 114 PID 3000 wrote to memory of 2392 3000 winmgr107.exe 114 PID 3000 wrote to memory of 2492 3000 winmgr107.exe 116 PID 3000 wrote to memory of 2492 3000 winmgr107.exe 116 PID 3000 wrote to memory of 2492 3000 winmgr107.exe 116 PID 3000 wrote to memory of 804 3000 winmgr107.exe 118 PID 3000 wrote to memory of 804 3000 winmgr107.exe 118 PID 3000 wrote to memory of 804 3000 winmgr107.exe 118 PID 3000 wrote to memory of 2216 3000 winmgr107.exe 120 PID 3000 wrote to memory of 2216 3000 winmgr107.exe 120 PID 3000 wrote to memory of 2216 3000 winmgr107.exe 120 PID 3000 wrote to memory of 908 3000 winmgr107.exe 123 PID 3000 wrote to memory of 908 3000 winmgr107.exe 123 PID 3000 wrote to memory of 908 3000 winmgr107.exe 123 PID 3000 wrote to memory of 3164 3000 winmgr107.exe 125 PID 3000 wrote to memory of 3164 3000 winmgr107.exe 125 PID 3000 wrote to memory of 3164 3000 winmgr107.exe 125 PID 3000 wrote to memory of 3968 3000 winmgr107.exe 127 PID 3000 wrote to memory of 3968 3000 winmgr107.exe 127 PID 3000 wrote to memory of 3968 3000 winmgr107.exe 127 PID 3000 wrote to memory of 1384 3000 winmgr107.exe 129 PID 3000 wrote to memory of 1384 3000 winmgr107.exe 129 PID 3000 wrote to memory of 1384 3000 winmgr107.exe 129 PID 3000 wrote to memory of 5076 3000 winmgr107.exe 131 PID 3000 wrote to memory of 5076 3000 winmgr107.exe 131 PID 3000 wrote to memory of 5076 3000 winmgr107.exe 131 PID 3000 wrote to memory of 4276 3000 winmgr107.exe 133 PID 3000 wrote to memory of 4276 3000 winmgr107.exe 133 PID 3000 wrote to memory of 4276 3000 winmgr107.exe 133 PID 3000 wrote to memory of 208 3000 winmgr107.exe 135 PID 3000 wrote to memory of 208 3000 winmgr107.exe 135
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\PROGRA~3\8A5BE6~1.TXT2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe.txt3⤵PID:5012
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:3300
-
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:872
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2528
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2328
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2964
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4444
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2392
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2492
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:804
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2216
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:908
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3164
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3968
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1384
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:5076
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4276
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:208
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3200
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:5060
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2524
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2276
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:720
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4392
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1512
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1732
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3136
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3108
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2580
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1164
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~3\8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe.txt
- Size 992B
- SHA256 78bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0
- MD5 c8cf7247d4cfc99a7582a42d13df4c08
- SHA1 317f5588af0b3b6374c436fb00084c522fd78a83
- SHA512 5dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357
- MD5 SHA1 SHA512
- Path C:\ProgramData\winmgr107.exe
- Size 8.7MB
- SHA256 924326d26ef41e5fc05b5ecfd80cd26beb6ec90ee510507baf4dc757951d3680
- MD5 aba4813885db874d56b4567ceba52464
- SHA1 5249d80eefb060bd092e78e6b3e74433faec31e2
- SHA512 c1a65505b75897a9ad14841d094d4a51285b7e373d5b68c83b3b0bef936496999aca520721f0bda335876354cb399b2cf339482f0743664c66a3add69446c68b
- SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCba:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8a5be6a863514baf275d11343f3e1cb0_NeikiAnalytics.exe
- Size 8.7MB
- SHA256 fc5eae732950828b4742ea2c44284e4b8b1ea4c10a6d5ac12b23a2aa3515e89b
- MD5 8a5be6a863514baf275d11343f3e1cb0
- SHA1 b9a2cf6c31f43f4367e63c87b83a68b46f515e0a
- SHA512 a685f0165390160e5b11a570d0732a2e0e2de025e192f8ba9741e5f45019983e6f7564135f56124271b181f96e88a55adade4749ce9fc1bd37dfe8dc2b5e3696
- SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb6:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmm
- MD5 SHA1 SHA512 SSDEEP