Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
21/06/2024, 23:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
10 signatures
150 seconds
General
- Target 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe
- Size 42KB
- Sample240621-25pr1aydmj
- SHA256 1f72fa89b0fe9a4c6d49d57a690dce4f92cf394443c44695387044962e2534c2
- MD5 002063008bff66e2353170ccb5ff61ed
- SHA1 4665430a7c1c951294c8807abe83e1c45c40900d
- SHA512 18e11203af99740a44b9f471cb27ec20e1f2cc55576a41d69a7c9cdbb53b5b8d8922d6c39de7fca0ce8b07d4da3bcbb16c09732fa6c3de47f0b815dd9263b4ab
- SSDEEP 768:G3NnDVpGfOoMMBDUlAzzLdNfjKlhU2fLZh8r73TWJlQpTPP2EQ3W:GNVpG3M+JdN+LVAr7jWJlQpDeE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 920 regsvr32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe - Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D7ABD81-907A-4755-32CC-02A0BA03455B} regsvr32.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\VJDOTHUZFGQ.txt 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe File created \??\c:\windows\vjdothuzfgq.dll 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Play_Animations = "no" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Display Inline Images = "yes" reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "no" reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Display Inline Videos = "no" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" reg.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\OLEScript regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\JSCRIPT.ENCODE\OLESCRIPT regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCSERVER32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\OLEScript regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D7ABD81-907A-4755-32CC-02A0BA03455B}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\JAVASCRIPT1.3\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author\OLEScript regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3\ = "JScript Language" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories\{F0B7A1A3-9847-11CF-8F20-00805F2CD064} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ECMASCRIPT\OLESCRIPT regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\ = "JScript Compact Profile (ECMA 327)" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ECMASCRIPT\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\ = "xunlei Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author\OLEScript regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\CLSID\ = "{1D7ABD81-907A-4755-32CC-02A0BA03455B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author\OLEScript regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\OLESCRIPT regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCSERVER32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D7ABD81-907A-4755-32CC-02A0BA03455B}\ = "xunlei Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ = "Ixunlei" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2\OLEScript regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript\ = "JScript Language" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\JAVASCRIPT1.3\OLESCRIPT regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript\OLEScript regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3\OLEScript regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\OLESCRIPT regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}\INPROCSERVER32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\ProgID\ = "JScript.Compact" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D7ABD81-907A-4755-32CC-02A0BA03455B} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\JSCRIPT\OLESCRIPT regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}\PROGID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\Implemented Categories regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\JSCRIPT AUTHOR\OLESCRIPT regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\JSCRIPT.COMPACT AUTHOR\CLSID regsvr32.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 4172 reg.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2660 wrote to memory of 920 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 80 PID 2660 wrote to memory of 920 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 80 PID 2660 wrote to memory of 920 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 80 PID 2660 wrote to memory of 1232 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 81 PID 2660 wrote to memory of 1232 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 81 PID 2660 wrote to memory of 1232 2660 002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe 81 PID 1232 wrote to memory of 4160 1232 cmd.exe 83 PID 1232 wrote to memory of 4160 1232 cmd.exe 83 PID 1232 wrote to memory of 4160 1232 cmd.exe 83 PID 1232 wrote to memory of 4484 1232 cmd.exe 84 PID 1232 wrote to memory of 4484 1232 cmd.exe 84 PID 1232 wrote to memory of 4484 1232 cmd.exe 84 PID 1232 wrote to memory of 1148 1232 cmd.exe 85 PID 1232 wrote to memory of 1148 1232 cmd.exe 85 PID 1232 wrote to memory of 1148 1232 cmd.exe 85 PID 1232 wrote to memory of 3468 1232 cmd.exe 86 PID 1232 wrote to memory of 3468 1232 cmd.exe 86 PID 1232 wrote to memory of 3468 1232 cmd.exe 86 PID 1232 wrote to memory of 4172 1232 cmd.exe 87 PID 1232 wrote to memory of 4172 1232 cmd.exe 87 PID 1232 wrote to memory of 4172 1232 cmd.exe 87 PID 1232 wrote to memory of 4412 1232 cmd.exe 88 PID 1232 wrote to memory of 4412 1232 cmd.exe 88 PID 1232 wrote to memory of 4412 1232 cmd.exe 88 PID 1232 wrote to memory of 3500 1232 cmd.exe 89 PID 1232 wrote to memory of 3500 1232 cmd.exe 89 PID 1232 wrote to memory of 3500 1232 cmd.exe 89 PID 1232 wrote to memory of 208 1232 cmd.exe 90 PID 1232 wrote to memory of 208 1232 cmd.exe 90 PID 1232 wrote to memory of 208 1232 cmd.exe 90 PID 1232 wrote to memory of 4860 1232 cmd.exe 91 PID 1232 wrote to memory of 4860 1232 cmd.exe 91 PID 1232 wrote to memory of 4860 1232 cmd.exe 91 PID 1232 wrote to memory of 1492 1232 cmd.exe 92 PID 1232 wrote to memory of 1492 1232 cmd.exe 92 PID 1232 wrote to memory of 1492 1232 cmd.exe 92 PID 1232 wrote to memory of 4116 1232 cmd.exe 93 PID 1232 wrote to memory of 4116 1232 cmd.exe 93 PID 1232 wrote to memory of 4116 1232 cmd.exe 93 PID 1232 wrote to memory of 4204 1232 cmd.exe 94 PID 1232 wrote to memory of 4204 1232 cmd.exe 94 PID 1232 wrote to memory of 4204 1232 cmd.exe 94 PID 1232 wrote to memory of 2064 1232 cmd.exe 95 PID 1232 wrote to memory of 2064 1232 cmd.exe 95 PID 1232 wrote to memory of 2064 1232 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\002063008bff66e2353170ccb5ff61ed_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "c:\windows\vjdothuzfgq.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Q37E5DH.BAT2⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F3⤵
- Modifies Internet Explorer settings
PID:4160
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F3⤵
- Modifies Internet Explorer settings
PID:4484
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s vbscript.dll3⤵PID:1148
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s scrrun.dll3⤵
- Modifies registry class
PID:3468
-
-
C:\Windows\SysWOW64\reg.exereg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F3⤵
- Adds Run key to start application
- Modifies registry key
PID:4172
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F3⤵
- Modifies Internet Explorer settings
PID:4412
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s msvidctl.dll3⤵PID:3500
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s jscript.dll3⤵
- Modifies registry class
PID:208
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F3⤵
- Modifies Internet Explorer settings
PID:4860
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s itss.dll3⤵PID:1492
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F3⤵
- Modifies Internet Explorer settings
PID:4116
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F3⤵
- Modifies Internet Explorer settings
PID:4204
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F3⤵
- Modifies Internet Explorer settings
PID:2064
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Q37E5DH.BAT
- Size 1KB
- SHA256 5c609292beca70adadda6789b23809a77a5a396b146e0e3a82f14ebc99b0fdbc
- MD5 5a8b03ee53c45d2991115c76a60969d3
- SHA1 9d58658ca3422fe124e5f1de03b9d260c8840df0
- SHA512 062e8c90e9cfe5558e61079261fe1f21f2f433a40e5f982e093929118368153b42add2dd4343706184a2f31e8aabf2e2938d23e05e72804ef87fe549db77f7ad
- MD5 SHA1 SHA512
- Path \??\c:\windows\vjdothuzfgq.dll
- Size 28KB
- SHA256 46aaf739cbf79393bf5dc03f392cb03b5f21251cc60498b7907bac57e86e58b7
- MD5 7d758049aad579d3d4ce808815e1f0ac
- SHA1 a155230a37f71de8c6261f6ec410f86e064cd85a
- SHA512 b6bb228134ace1baed17b88e2b7b71e97ed5f7f0df7dd19ccd8994e9df3d3efa3fea6fd30990807b8e388209b9e5544873d7cd877631b84799ab27d1664a3bee
- SSDEEP 192:++Cn40nLBj7p0865I9amtqGVnpRvORvjp3A/a7jjx0D:YhK5fmtqMpdOdjpGa73x
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\vjdothuzfgq.txt
- Size 42KB
- SHA256 eda1df34c15d24aba313d4e33e127672bf21e9db902a857db73b0a133877f0f4
- MD5 e35ac62dbb1a5a0d920b8512ce1884a2
- SHA1 654af0a7705340ada2cced05aa1103cb5714903b
- SHA512 a45eb620de08ffb42bc8dbb43d08bf28c5ac4c3f0150ae33b6d3c9fa4d9d7bd5aa6c62e06c0ef5d9900f5ff87d2ab75ec6e089fab7e50dd908e6a72357eb51e9
- SSDEEP 768:5zA33NnDVpGfOoMMBDUlAzzLdNfjKlhU2fLZh8r73TWJlQpTPP2EQ3W:5eNVpG3M+JdN+LVAr7jWJlQpDeE
- MD5 SHA1 SHA512 SSDEEP