Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
02/11/2022, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target file.exe
- Size 322KB
- Sample221102-e3nqlaaaej
- SHA256 de219eb4ea8aa0886fc938555a58a49644c95f55c1c2d733f7cf41eea3f8d7e6
- MD5 026d736d765edae4e227ffb243a8bf38
- SHA1 0be6b2386895082b8de31db31e15054891826268
- SHA512 294b7b0be51b60142f25afe137d0c193f7ad8412dcfa620aa2746fac2e78d189a65df1f43d47c830fe97374e6539d11a7dee7e7b0174255dcf32e9ff461dc6d4
- SSDEEP 3072:pFi82E8ou2rhc5homnMxGBu0bqkhJVxWxjsbq8EKgDgrVggjcGkNIVqI8:a82R294o/Gotwzbb7gO7ITsqF
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/5040-133-0x0000000002D90000-0x0000000002D99000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 4344 CCBB.exe 1656 vgcisdj - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4344 set thread context of 4292 4344 CCBB.exe 88 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vgcisdj Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vgcisdj Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vgcisdj - Checks processor information in registry 2 TTPs 40 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet CCBB.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CCBB.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status CCBB.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision CCBB.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier CCBB.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet CCBB.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier CCBB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision CCBB.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2720 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5040 file.exe 5040 file.exe 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found 2720 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2720 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 5040 file.exe 1656 vgcisdj - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 4292 rundll32.exe Token: SeShutdownPrivilege 2720 Process not Found Token: SeCreatePagefilePrivilege 2720 Process not Found Token: SeShutdownPrivilege 2720 Process not Found Token: SeCreatePagefilePrivilege 2720 Process not Found Token: SeShutdownPrivilege 2720 Process not Found Token: SeCreatePagefilePrivilege 2720 Process not Found Token: SeShutdownPrivilege 2720 Process not Found Token: SeCreatePagefilePrivilege 2720 Process not Found Token: SeShutdownPrivilege 2720 Process not Found Token: SeCreatePagefilePrivilege 2720 Process not Found Token: SeShutdownPrivilege 2720 Process not Found Token: SeCreatePagefilePrivilege 2720 Process not Found Token: SeShutdownPrivilege 2720 Process not Found Token: SeCreatePagefilePrivilege 2720 Process not Found Token: SeShutdownPrivilege 2720 Process not Found Token: SeCreatePagefilePrivilege 2720 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4292 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2720 Process not Found 2720 Process not Found - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2720 wrote to memory of 4344 2720 Process not Found 86 PID 2720 wrote to memory of 4344 2720 Process not Found 86 PID 2720 wrote to memory of 4344 2720 Process not Found 86 PID 4344 wrote to memory of 4292 4344 CCBB.exe 88 PID 4344 wrote to memory of 4292 4344 CCBB.exe 88 PID 4344 wrote to memory of 4292 4344 CCBB.exe 88 PID 4344 wrote to memory of 4292 4344 CCBB.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5040
-
C:\Users\Admin\AppData\Local\Temp\CCBB.exeC:\Users\Admin\AppData\Local\Temp\CCBB.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4292
-
-
C:\Users\Admin\AppData\Roaming\vgcisdjC:\Users\Admin\AppData\Roaming\vgcisdj1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1656
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
- Size 1KB
- SHA256 ab5bbad92eb5b118a83152c34f7d011cd7ebd55e0774e7649b5bd6084c6bb807
- MD5 f100bb8b2cb884eaeb980fec005fda2a
- SHA1 35b381fb5f67e27d337a9be9a9a80f99a62ade7b
- SHA512 f199706af09ab1ec2fd2e1a23055f1d898271bb27ef067b992dece2677e74854023188a7c7c2f8836e7f64854b0bc6b190684b300f0da973d8bd96c3497346b2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CCBB.exe
- Size 4.9MB
- SHA256 ebf90b3ad9338b153cd77ba9c1337345c764347fc12e9e14bd9988bc7a3048d0
- MD5 ba975e4c21d0e480997f5d2ecc96f890
- SHA1 13bb68f46f1499324077f5d2395702d52fa67619
- SHA512 267dc9cd3e1ae405af4f0f3a493f922f059e99463d761216b33010938a30b0ea4d334e803a3193c7cfbc510079a501005eae6b29469de064ce3e5ff50bcb8fac
- SSDEEP 98304:GmHSoBIbUXQdGjuV7eixBEvz95ipNd4gR/7Saa5XeIGiT:vytJF7etvB5ut/79QeL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CCBB.exe
- Size 4.9MB
- SHA256 ebf90b3ad9338b153cd77ba9c1337345c764347fc12e9e14bd9988bc7a3048d0
- MD5 ba975e4c21d0e480997f5d2ecc96f890
- SHA1 13bb68f46f1499324077f5d2395702d52fa67619
- SHA512 267dc9cd3e1ae405af4f0f3a493f922f059e99463d761216b33010938a30b0ea4d334e803a3193c7cfbc510079a501005eae6b29469de064ce3e5ff50bcb8fac
- SSDEEP 98304:GmHSoBIbUXQdGjuV7eixBEvz95ipNd4gR/7Saa5XeIGiT:vytJF7etvB5ut/79QeL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20220812_191749306.html
- Size 94KB
- SHA256 fe6525b8436cfb0df02ae2cd7e7054bd706b3fa6f68ba4ded69308ed0bbfc350
- MD5 da6b45af25ddc7d9a34a5a425b253bb2
- SHA1 b94cc8311d176c735ef39586086ba5293808c3a9
- SHA512 6a56d232768ad1f999bea5c61c58561e870c26c5de539d73e84984c0a806093251d060a359c55de71f46442f0752e96f6375ac8d8a79d7f957486c1e0e4c6e23
- SSDEEP 768:fdsOTLyUFJFEWUxFzvWvcKvQfpOxdx/DQT:fdsWyUr+WUxpvWkKvQHT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Rpiidpytrto.tmp
- Size 3.5MB
- SHA256 8c67a70fe070595fda6ec977af7da0085d40df299f04cdd5669156752fee3f31
- MD5 c597ca48af580cb2755914474a787ddf
- SHA1 427cdbd19eadb94f1f89b51a7c3647a3ff7d3925
- SHA512 c41ab851b712c484184934b2dab7015d329ec485b454b645411f69a97ef4a46351fe892f86522abf19c08cf1b7b6a5212954053b8218046cdfab24ef734e47ab
- SSDEEP 98304:+8pOYyhtcnyr8HijecRnl+SjK+hN8B8NWdMJHfNEGp:+8pxyhi8K4emltTClKJHFvp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI50B8.txt
- Size 426KB
- SHA256 37c69c02974b85d856e00765ff6b978bc55f03f1254b5f50754d5acd7c32c296
- MD5 cd406b2d2202bec1d657b0042c2a2cb8
- SHA1 87d639c4dc350106f0e2cd2364d78df223aac7e4
- SHA512 09a482f2fe99f4b6a45f8acb8953705cc834a8e92be2f579f62e5aa784d972b63e1dc8d0a4bf25442623a3f251f9a675121c3a402e1b5748424acceeaf547ee0
- SSDEEP 1536:D0LrTEvCMI7DIWv2+2fDGw1NWNw8wzfnFNeYTJ3ERsIvPEm6JJNlZ+KdzbjZsRL9:D0NTj7XprZUoBNr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jusched.log
- Size 265KB
- SHA256 31027983935b7afcf422452e2ab35d583aad46a68ba867e0bfaeb2d0ca3268a6
- MD5 55d18fd015e28a95ae56b4e8389250dc
- SHA1 f040e628caba414a46cf2ea5007cc15b5cfefc19
- SHA512 8ee86c7a9248245c5053def53f407357c85deb0759f99198a392185c00e4d536640b69b05739ed304f08f999824eab96a1d76438528daef96be36ad3c1eeb3bd
- SSDEEP 3072:hmcF/yT6UqQeFgV+3CKjbgTYeIe3m/JggeEQDk0jUDBcJFBL3n4gGW5JQzYOUSN9:B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wct1F1D.tmp
- Size 62KB
- SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
- MD5 7185e716980842db27c3b3a88e1fe804
- SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
- SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
- SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\vgcisdj
- Size 322KB
- SHA256 de219eb4ea8aa0886fc938555a58a49644c95f55c1c2d733f7cf41eea3f8d7e6
- MD5 026d736d765edae4e227ffb243a8bf38
- SHA1 0be6b2386895082b8de31db31e15054891826268
- SHA512 294b7b0be51b60142f25afe137d0c193f7ad8412dcfa620aa2746fac2e78d189a65df1f43d47c830fe97374e6539d11a7dee7e7b0174255dcf32e9ff461dc6d4
- SSDEEP 3072:pFi82E8ou2rhc5homnMxGBu0bqkhJVxWxjsbq8EKgDgrVggjcGkNIVqI8:a82R294o/Gotwzbb7gO7ITsqF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\vgcisdj
- Size 322KB
- SHA256 de219eb4ea8aa0886fc938555a58a49644c95f55c1c2d733f7cf41eea3f8d7e6
- MD5 026d736d765edae4e227ffb243a8bf38
- SHA1 0be6b2386895082b8de31db31e15054891826268
- SHA512 294b7b0be51b60142f25afe137d0c193f7ad8412dcfa620aa2746fac2e78d189a65df1f43d47c830fe97374e6539d11a7dee7e7b0174255dcf32e9ff461dc6d4
- SSDEEP 3072:pFi82E8ou2rhc5homnMxGBu0bqkhJVxWxjsbq8EKgDgrVggjcGkNIVqI8:a82R294o/Gotwzbb7gO7ITsqF
- MD5 SHA1 SHA512 SSDEEP