Analysis
- max time kernel
149s - max time network
118s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
29/01/2024, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
nlg_ns.msi
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
nlg_ns.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target nlg_ns.msi
- Size 14.0MB
- Sample240129-tmcqqadff7
- SHA256 8e12fc5aa85d6953ee731203e945ccacc4ded6a8aa9752c7331dcc17da501eae
- MD5 f1c700707adffb52929de6dff72b2840
- SHA1 190f21ef796aee07a2b4f906e7b2f7d915b18497
- SHA512 6b4c3e69822e83c977b35cd3f0b69fc38282b13dc9b07f97eb011737822624179560f5f5c1488ef487628a42eeea9c313837036d771e25a0e0358e104c5b65a2
- SSDEEP 196608:shhhkmqs4WU7FaOO13cdK1J/9V91xg9idpE1Qhv4RF5HVwZJfYabpY78vAdt2yT:sfiY6pg1MKL9O1QhAr1VwZJf9jvAdP
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1940 bdisc.exe - Loads dropped DLL 7 IoCs
pid Process 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 1940 bdisc.exe 1940 bdisc.exe 1940 bdisc.exe 1940 bdisc.exe - Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: bdisc.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: bdisc.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: bdisc.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f762868.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI28A6.tmp msiexec.exe File created C:\Windows\Installer\f76286b.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2BC5.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSI2A2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76286b.ipi msiexec.exe File created C:\Windows\Installer\f762868.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2991.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3040 msiexec.exe 3040 msiexec.exe 1940 bdisc.exe 1940 bdisc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2316 msiexec.exe Token: SeIncreaseQuotaPrivilege 2316 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeSecurityPrivilege 3040 msiexec.exe Token: SeCreateTokenPrivilege 2316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2316 msiexec.exe Token: SeLockMemoryPrivilege 2316 msiexec.exe Token: SeIncreaseQuotaPrivilege 2316 msiexec.exe Token: SeMachineAccountPrivilege 2316 msiexec.exe Token: SeTcbPrivilege 2316 msiexec.exe Token: SeSecurityPrivilege 2316 msiexec.exe Token: SeTakeOwnershipPrivilege 2316 msiexec.exe Token: SeLoadDriverPrivilege 2316 msiexec.exe Token: SeSystemProfilePrivilege 2316 msiexec.exe Token: SeSystemtimePrivilege 2316 msiexec.exe Token: SeProfSingleProcessPrivilege 2316 msiexec.exe Token: SeIncBasePriorityPrivilege 2316 msiexec.exe Token: SeCreatePagefilePrivilege 2316 msiexec.exe Token: SeCreatePermanentPrivilege 2316 msiexec.exe Token: SeBackupPrivilege 2316 msiexec.exe Token: SeRestorePrivilege 2316 msiexec.exe Token: SeShutdownPrivilege 2316 msiexec.exe Token: SeDebugPrivilege 2316 msiexec.exe Token: SeAuditPrivilege 2316 msiexec.exe Token: SeSystemEnvironmentPrivilege 2316 msiexec.exe Token: SeChangeNotifyPrivilege 2316 msiexec.exe Token: SeRemoteShutdownPrivilege 2316 msiexec.exe Token: SeUndockPrivilege 2316 msiexec.exe Token: SeSyncAgentPrivilege 2316 msiexec.exe Token: SeEnableDelegationPrivilege 2316 msiexec.exe Token: SeManageVolumePrivilege 2316 msiexec.exe Token: SeImpersonatePrivilege 2316 msiexec.exe Token: SeCreateGlobalPrivilege 2316 msiexec.exe Token: SeBackupPrivilege 940 vssvc.exe Token: SeRestorePrivilege 940 vssvc.exe Token: SeAuditPrivilege 940 vssvc.exe Token: SeBackupPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeRestorePrivilege 2576 DrvInst.exe Token: SeRestorePrivilege 2576 DrvInst.exe Token: SeRestorePrivilege 2576 DrvInst.exe Token: SeRestorePrivilege 2576 DrvInst.exe Token: SeRestorePrivilege 2576 DrvInst.exe Token: SeRestorePrivilege 2576 DrvInst.exe Token: SeRestorePrivilege 2576 DrvInst.exe Token: SeLoadDriverPrivilege 2576 DrvInst.exe Token: SeLoadDriverPrivilege 2576 DrvInst.exe Token: SeLoadDriverPrivilege 2576 DrvInst.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2316 msiexec.exe 2316 msiexec.exe 1940 bdisc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1940 bdisc.exe 1940 bdisc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2764 3040 msiexec.exe 32 PID 3040 wrote to memory of 2764 3040 msiexec.exe 32 PID 3040 wrote to memory of 2764 3040 msiexec.exe 32 PID 3040 wrote to memory of 2764 3040 msiexec.exe 32 PID 3040 wrote to memory of 2764 3040 msiexec.exe 32 PID 3040 wrote to memory of 2764 3040 msiexec.exe 32 PID 3040 wrote to memory of 2764 3040 msiexec.exe 32 PID 3040 wrote to memory of 1940 3040 msiexec.exe 33 PID 3040 wrote to memory of 1940 3040 msiexec.exe 33 PID 3040 wrote to memory of 1940 3040 msiexec.exe 33 PID 3040 wrote to memory of 1940 3040 msiexec.exe 33 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\nlg_ns.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2316
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1CA00E4EC0D90385712E746E183CD9B62⤵
- Loads dropped DLL
PID:2764
-
-
C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\bdisc.exe"C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\bdisc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1940
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:940
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003DC" "0000000000000578"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f76286c.rbs
- Size 2KB
- SHA256 8601a51f3a846a19a101dbfce6b6d4300b7ce887f779b79f14d695505bc4d241
- MD5 94ab2995b7c3144058cd94594085af07
- SHA1 325ed38f28b709eb338c2216250e1f39e9f293fb
- SHA512 f29a18bd6bb6f7e27a83e77daafda750aa977ca515beb065eba904f9c6d8cc6d59376922423098d87d7cb32464e79b801c0363f0f22a189ff4ae596c33194302
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\ControlzEx.dll
- Size 482KB
- SHA256 87835f654da870edf44d30079790ee932c3d3ee0a4cc37758c1c292a4482b1f8
- MD5 d8d2d75aee0617e919289d078848cc41
- SHA1 e6679aaaf424b41b7b195110c35539cde8365f72
- SHA512 f052d90df5d0cf63d1f30a68e4f5948788b2264c25b6bfd81ad859a24d02905bfeb664a81a0b0d528eb8961c4df9ccaee83f7cbb886eb063523f2b3ca69d9e37
- SSDEEP 6144:HUKrG6Trv16615Muviiif6VuC/FA+iUUKMoKY3mgHiEEiW1QoNYm0GAOa0FPs:HUKrGM5MuviB60C/FA+Sr1ZNyGIUPs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\apilocal.dll
- Size 817KB
- SHA256 d04fe730e4c72d19d3bcb60a2abe2e083040ed447cffce8fb96587ac07371afd
- MD5 a8aa3ed3605fd21da0c2860a5a2631b4
- SHA1 6bded3b71ce3d394ce7182066389898b4ad49e30
- SHA512 f8910019e963bef83dc17b47864b2f29a4762a5d17449dfc17c1b52e4f3925f5b244e73c2ee0874f7fc7f78a67648316118b0f2c395a4972033924be1f564e1e
- SSDEEP 24576:MBxwbU9oQ73PJqvEhNwmlmqaCjGBsM6HN95h:M8XEH/aUGBsD3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\badatamain.dll
- Size 684KB
- SHA256 9e68b5f36604c265ece89550c1ee1f3fe9e19d6444d410f56faec4fe36d4ce01
- MD5 a6fc07a1d21004fe742798a67663595d
- SHA1 e80d5460b6a68a865c1e3682478955ba5e606dbd
- SHA512 fe10d796539d4ab2634835b71d8fd4a51d067b9fab18a9de5a401e5194fb22187e4261e2eedba11caf713d9a045a4c117c53f7575b3361769f937b6e0e7c5eab
- SSDEEP 12288:GxKn1k3hspu+l1gsNFieMHNjF1ewXS/xSXDm2r:GxKq3hsu+1RNFie+NjF1ewXS/xSTm2r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\bdisc.exe
- Size 3.1MB
- SHA256 a4798fb1d0f930f22ff74245b4900a3a59def59e3d817d56443e04d54beba0f2
- MD5 4cd557a3f0a6ccc94ddcd89f8e075474
- SHA1 6bd9bf07d29889c8119d4efab76165c89cb10088
- SHA512 a9556fff94ee8f8466e8983d8226df3ae936e9c0813da42b107ca2ab506f53caaf6610dbc7c57071e60419312a71444ef02e3ab1e4d443a83c72171bb726b428
- SSDEEP 49152:VJMDJaw8PeOR0SeBqQ2Ngwwsq+3HRt1Pl7xaj:8VzvpLwwsq+Bt1Paj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\tcpipsrc.dll
- Size 417KB
- SHA256 4431dd5d7fcb554732a66798bc19def3f55ddb5d7f27ce57cde5bcdc9921361f
- MD5 2b8205a60dfecc7352b1acdcdb45efd0
- SHA1 89ee2777e62b496e88bf68230625f6b0efd9d265
- SHA512 c9935cad9616a6c689f51d7d0ae66078e8d22c5ecc51adafafad34672291570dead14146fb4923045bc88aabe44178b1cf1266b2491a3b051e989fa39ebb1a67
- SSDEEP 12288:Dm47C4W1oc//////v8QsW113NDahIH+e3h2AtCNVAyl9lSp15:KQW1oc//////Zse4c2AtCXA4W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AGG Software\Network Logger Community\temp.wav
- Size 696KB
- SHA256 69f8061ebc91f2742ac5d221a6fc21dbeab460216bba5025195f9ba50ca75d0f
- MD5 0c4ea8755ccd9605399974eb704cef79
- SHA1 2ee18f7719117727664cbb45dc15c0ac1b11e3ee
- SHA512 59595770841ce43ec3635ce04c021391957410e4963c20310151a11425325929a64e2e2adac1d1e7b3bfb56f5de804fe55e4c4118916529899513a0a08300569
- SSDEEP 12288:unX9M/EnMQlbZAxSzUzk6E5puXPPrP88KhmzP33bqfEUKe3P/K86Pa2L7gS:MX+En8S16ECPT8xmzPutD3aa2vgS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI28A6.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\AGG Software\Network Logger Community\apilocal.dll
- Size 481KB
- SHA256 89d9608271a9931037b47be166be8ccd1f02b7ccb0bb56e4d985cd0ed24be429
- MD5 1624a78063a655d088958104269b9957
- SHA1 55cc8d18aef1908f54acc147d5828acd20189445
- SHA512 86b58f7a775724f20c93e06ac11869c540b8ff7021998ea6b85e76878c415c525555becdf4ec16d87f82c40be91103ec773cb59a5d183603dacbdf8724808e9a
- SSDEEP 12288:rNRYBxwbU9oQ73PgkWzvEIS3PNitmyGmqlGncp90:MBxwbU9oQ73PJqvEhNwmlmqah
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\AGG Software\Network Logger Community\badatamain.dll
- Size 665KB
- SHA256 7806271232ce3dd0f18d428870e01d51322923960e179933f25e6732444348d0
- MD5 65e35ca21503d2341c0da15af5b9cab4
- SHA1 137c78c3ecd3172784efd3a741d5f6fbf37d5254
- SHA512 e5d339a2402154b8056dbf6006c08f5f4f779b32e9044b8dbfa953b7f8bf0716aa545340dec0caee12e8949f16e1e79e1d8470af6702b02faf157fb737ca1bb5
- SSDEEP 12288:GxKn1k3hspu+l1gsNFieMHNjF1ewXS/xSXDmU:GxKq3hsu+1RNFie+NjF1ewXS/xSTmU
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\AGG Software\Network Logger Community\tcpipsrc.dll
- Size 518KB
- SHA256 ef29f5e434f60e635da021030a51f289671cee416b73b8992eee4e420d039b45
- MD5 942ee60432975efc41064040842fbce0
- SHA1 eeb72f80dabf8141cdefcf686b4620a5fd9a071b
- SHA512 2172d75193567a95f30bd3c8381644f1a8537db16e7bb3bbbafc1f8d0396126f5fbe967957b53b35d3a6fcb5ebb8c6b30321f1c11464c25d52babba98f7038bc
- SSDEEP 12288:Dm47C4W1oc//////v8QsW113NDahIH+e3h2AtCNVAyl9lSp1nlyBx7P8r618:KQW1oc//////Zse4c2AtCXA4swTErn
- MD5 SHA1 SHA512 SSDEEP