Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
22/05/2024, 22:21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe
- Size 8.7MB
- Sample240522-19vy5sbb82
- SHA256 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a
- MD5 6035e539b2ba7937da9b714466520f93
- SHA1 39ca0887952cd570a7a6a7928b7f8f62df635a24
- SHA512 d5fb89e91a5dd4635371d5f7d6bde0b75ff92570c08c20ddc9cb58dd69f30bedc3fdc500ea6c23896350beef02efa172bed144498ea94acf24ecaaf68db51cd1
- SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbI:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmE
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
jjj
C2
-
youri.mooo.com:1605
Mutex
-
e936a10f968ac948cd351c9629dbd36d
Attributes
-
reg_key
e936a10f968ac948cd351c9629dbd36d
-
splitter
|'|'|
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3248 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation cmd.exe - Executes dropped EXE 1 IoCs
pid Process 3616 winmgr107.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" winmgr107.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a0000000233a5-9.dat autoit_exe behavioral2/files/0x0007000000023447-10.dat autoit_exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3616 set thread context of 4816 3616 winmgr107.exe 101 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 26 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4716 schtasks.exe 4920 schtasks.exe 4404 schtasks.exe 3732 schtasks.exe 4460 schtasks.exe 4260 schtasks.exe 3560 schtasks.exe 2408 schtasks.exe 4304 schtasks.exe 344 schtasks.exe 1832 schtasks.exe 3672 schtasks.exe 4804 schtasks.exe 3944 schtasks.exe 1468 schtasks.exe 3544 schtasks.exe 4988 schtasks.exe 3768 schtasks.exe 5104 schtasks.exe 2084 schtasks.exe 3784 schtasks.exe 3308 schtasks.exe 4328 schtasks.exe 4008 schtasks.exe 1160 schtasks.exe 4344 schtasks.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings cmd.exe - NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe:Zone.Identifier:$DATA 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe File created C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4864 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe 4864 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe 3616 winmgr107.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe Token: 33 4816 RegAsm.exe Token: SeIncBasePriorityPrivilege 4816 RegAsm.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 1920 4864 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe 97 PID 4864 wrote to memory of 1920 4864 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe 97 PID 4864 wrote to memory of 1920 4864 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe 97 PID 1920 wrote to memory of 3980 1920 cmd.exe 99 PID 1920 wrote to memory of 3980 1920 cmd.exe 99 PID 1920 wrote to memory of 3980 1920 cmd.exe 99 PID 4864 wrote to memory of 3616 4864 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe 100 PID 4864 wrote to memory of 3616 4864 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe 100 PID 4864 wrote to memory of 3616 4864 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe 100 PID 3616 wrote to memory of 4816 3616 winmgr107.exe 101 PID 3616 wrote to memory of 4816 3616 winmgr107.exe 101 PID 3616 wrote to memory of 4816 3616 winmgr107.exe 101 PID 3616 wrote to memory of 4816 3616 winmgr107.exe 101 PID 3616 wrote to memory of 4816 3616 winmgr107.exe 101 PID 3616 wrote to memory of 344 3616 winmgr107.exe 102 PID 3616 wrote to memory of 344 3616 winmgr107.exe 102 PID 3616 wrote to memory of 344 3616 winmgr107.exe 102 PID 3616 wrote to memory of 4460 3616 winmgr107.exe 104 PID 3616 wrote to memory of 4460 3616 winmgr107.exe 104 PID 3616 wrote to memory of 4460 3616 winmgr107.exe 104 PID 4816 wrote to memory of 3248 4816 RegAsm.exe 106 PID 4816 wrote to memory of 3248 4816 RegAsm.exe 106 PID 4816 wrote to memory of 3248 4816 RegAsm.exe 106 PID 3616 wrote to memory of 4804 3616 winmgr107.exe 109 PID 3616 wrote to memory of 4804 3616 winmgr107.exe 109 PID 3616 wrote to memory of 4804 3616 winmgr107.exe 109 PID 3616 wrote to memory of 1832 3616 winmgr107.exe 112 PID 3616 wrote to memory of 1832 3616 winmgr107.exe 112 PID 3616 wrote to memory of 1832 3616 winmgr107.exe 112 PID 3616 wrote to memory of 4716 3616 winmgr107.exe 114 PID 3616 wrote to memory of 4716 3616 winmgr107.exe 114 PID 3616 wrote to memory of 4716 3616 winmgr107.exe 114 PID 3616 wrote to memory of 1160 3616 winmgr107.exe 116 PID 3616 wrote to memory of 1160 3616 winmgr107.exe 116 PID 3616 wrote to memory of 1160 3616 winmgr107.exe 116 PID 3616 wrote to memory of 4260 3616 winmgr107.exe 118 PID 3616 wrote to memory of 4260 3616 winmgr107.exe 118 PID 3616 wrote to memory of 4260 3616 winmgr107.exe 118 PID 3616 wrote to memory of 3672 3616 winmgr107.exe 120 PID 3616 wrote to memory of 3672 3616 winmgr107.exe 120 PID 3616 wrote to memory of 3672 3616 winmgr107.exe 120 PID 3616 wrote to memory of 3544 3616 winmgr107.exe 122 PID 3616 wrote to memory of 3544 3616 winmgr107.exe 122 PID 3616 wrote to memory of 3544 3616 winmgr107.exe 122 PID 3616 wrote to memory of 3560 3616 winmgr107.exe 124 PID 3616 wrote to memory of 3560 3616 winmgr107.exe 124 PID 3616 wrote to memory of 3560 3616 winmgr107.exe 124 PID 3616 wrote to memory of 4920 3616 winmgr107.exe 127 PID 3616 wrote to memory of 4920 3616 winmgr107.exe 127 PID 3616 wrote to memory of 4920 3616 winmgr107.exe 127 PID 3616 wrote to memory of 2408 3616 winmgr107.exe 129 PID 3616 wrote to memory of 2408 3616 winmgr107.exe 129 PID 3616 wrote to memory of 2408 3616 winmgr107.exe 129 PID 3616 wrote to memory of 3944 3616 winmgr107.exe 131 PID 3616 wrote to memory of 3944 3616 winmgr107.exe 131 PID 3616 wrote to memory of 3944 3616 winmgr107.exe 131 PID 3616 wrote to memory of 4988 3616 winmgr107.exe 133 PID 3616 wrote to memory of 4988 3616 winmgr107.exe 133 PID 3616 wrote to memory of 4988 3616 winmgr107.exe 133 PID 3616 wrote to memory of 3308 3616 winmgr107.exe 135 PID 3616 wrote to memory of 3308 3616 winmgr107.exe 135 PID 3616 wrote to memory of 3308 3616 winmgr107.exe 135 PID 3616 wrote to memory of 4404 3616 winmgr107.exe 137 PID 3616 wrote to memory of 4404 3616 winmgr107.exe 137
Processes
-
C:\Users\Admin\AppData\Local\Temp\60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe"C:\Users\Admin\AppData\Local\Temp\60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe"1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\PROGRA~3\60D439~1.TXT2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe.txt3⤵PID:3980
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:3248
-
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:344
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4460
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4804
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1832
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4716
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1160
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4260
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3672
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3544
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3560
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4920
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2408
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3944
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4988
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3308
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4404
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4344
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3768
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4008
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4328
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:1468
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:5104
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3732
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:2084
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:3784
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Creates scheduled task(s)
PID:4304
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~3\60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe.txt
- Size 992B
- SHA256 78bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0
- MD5 c8cf7247d4cfc99a7582a42d13df4c08
- SHA1 317f5588af0b3b6374c436fb00084c522fd78a83
- SHA512 5dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357
- MD5 SHA1 SHA512
- Path C:\ProgramData\winmgr107.exe
- Size 8.7MB
- SHA256 2345c3bcf6e04332c0d9e92f0aff0aa6320a9dc4a6e764936d355ebb9822f688
- MD5 f2153d775316ab2de1d0f5cd80863757
- SHA1 37c1f7ad054ff66cf5290c6e9a21673846df7914
- SHA512 e2a6cf405ebbc45df8425d069f7623653149a4515291052e52519de9b5919203817a649d9b4cf688d176b0ce859b93417f30897662a58a32fc72a37d2d821f41
- SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbR:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a.exe
- Size 8.7MB
- SHA256 60d439364a0e029c08df2c5c99fa16e13a078f21b8ef53346f013196e831d06a
- MD5 6035e539b2ba7937da9b714466520f93
- SHA1 39ca0887952cd570a7a6a7928b7f8f62df635a24
- SHA512 d5fb89e91a5dd4635371d5f7d6bde0b75ff92570c08c20ddc9cb58dd69f30bedc3fdc500ea6c23896350beef02efa172bed144498ea94acf24ecaaf68db51cd1
- SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbI:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmE
- MD5 SHA1 SHA512 SSDEEP