Analysis
- max time kernel
298s - max time network
281s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
DocuSignReader6.7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
DocuSignReader6.7.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
300 seconds
General
- Target DocuSignReader6.7.exe
- Size 423KB
- Sample261113-tk35wsdw4j
- SHA256 c2183acf1c20a3ecf8ea6f543f0bb570a8ab5d32daa82c99d699fd4a93a6123a
- MD5 f8b436ead3c783de303d01e9e3ce2414
- SHA1 2a3078a5d9e69c6f7e965179dd414be4606f40f4
- SHA512 fc5bcdbea054e9882a851c1b6ae88e003f27516e90f423b4551946d54ed6565833f8f5ad18a33c9a1adbd2ebeebd5f1bde7339a662379d20e868c9a516ac0517
- SSDEEP 6144:pKWNxA/glpCWJ9CC0ol022SLwFrwTnnYCb9x49q1JNhCZsi7ksvmacDMNiMutS:pVNx1loVy022SL+G9xxJa6i7BvmZDDM1
- TLSH T13494AE11FA40E436D26709316B5ED7694D7DBCB16F6146CBB3C01AEEA9306C0AB24F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avg\Av NiniteAgent.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus NiniteAgent.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop NiniteAgent.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avg\Av NiniteAgent.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus NiniteAgent.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop NiniteAgent.exe - Drops file in System32 directory 28 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_075790FA5C1E21C8ED5EFBA7913E8942 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_EA2C23EE3406CAE87155E7447F8BFEFA NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_9CE548EFBF60B12764E6ED043F831A4A NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_EA2C23EE3406CAE87155E7447F8BFEFA NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\Desktop\desktop.ini NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_9A3287BB7CD9C0E504E9DCCE3E0377D8 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_075790FA5C1E21C8ED5EFBA7913E8942 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_9A3287BB7CD9C0E504E9DCCE3E0377D8 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164 NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_9CE548EFBF60B12764E6ED043F831A4A NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\Desktop NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA NiniteAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA NiniteAgent.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe.65bda647-df7c-11f1-9b43-e2a751dc967b.tmp DocuSignReader6.7.exe - Executes dropped EXE 6 IoCs
pid Process 5576 NiniteAgent.exe 2344 NiniteAgent.exe 4552 NiniteAgent.exe 2736 NiniteAgent.exe 4300 NiniteAgent.exe 3540 NiniteAgent.exe - Loads dropped DLL 7 IoCs
pid Process 3428 DocuSignReader6.7.exe 2344 NiniteAgent.exe 2344 NiniteAgent.exe 4552 NiniteAgent.exe 2736 NiniteAgent.exe 4300 NiniteAgent.exe 3540 NiniteAgent.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NiniteAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NiniteAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DocuSignReader6.7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NiniteAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NiniteAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NiniteAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NiniteAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NiniteAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NiniteAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NiniteAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DocuSignReader6.7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NiniteAgent.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DocuSignReader6.7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NiniteAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NiniteAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NiniteAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NiniteAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NiniteAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NiniteAgent.exe - Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs NiniteAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs NiniteAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust NiniteAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates NiniteAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs NiniteAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs NiniteAgent.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 NiniteAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 NiniteAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 NiniteAgent.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4552 NiniteAgent.exe 4552 NiniteAgent.exe 2736 NiniteAgent.exe 2736 NiniteAgent.exe 4300 NiniteAgent.exe 4300 NiniteAgent.exe 3540 NiniteAgent.exe 3540 NiniteAgent.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeAssignPrimaryTokenPrivilege 4552 NiniteAgent.exe Token: SeTcbPrivilege 4552 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeAssignPrimaryTokenPrivilege 2736 NiniteAgent.exe Token: SeTcbPrivilege 2736 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe Token: SeTcbPrivilege 2344 NiniteAgent.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5576 wrote to memory of 2344 5576 NiniteAgent.exe 90 PID 2344 wrote to memory of 4552 2344 NiniteAgent.exe 92 PID 2344 wrote to memory of 2736 2344 NiniteAgent.exe 94 PID 2344 wrote to memory of 4300 2344 NiniteAgent.exe 95 PID 2344 wrote to memory of 3540 2344 NiniteAgent.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\DocuSignReader6.7.exe"C:\Users\Admin\AppData\Local\Temp\DocuSignReader6.7.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3428
-
C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe"C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /stub:service /stub:subdomain remote /agent1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe"C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /stub:child 5576 00000230 "NiniteAgent" /stub:subdomain "remote" "/agent"2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe"C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 2344 00000A38 0000086C /override 36cbaa2b650527acd2f06c5849c7de88a54a35d7 /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll" /audit /silent /nocache /data 6bc0a94f-df7c-11f1-9b43-e2a751dc967b3⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552
-
-
C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe"C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 2344 00000A9C 0000086C /override 36cbaa2b650527acd2f06c5849c7de88a54a35d7 /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll" /audit /silent /nocache /data 7ee89efc-df7c-11f1-9b43-e2a751dc967b3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe"C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 2344 000003C8 000009F8 /override 36cbaa2b650527acd2f06c5849c7de88a54a35d7 /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll" /audit /silent /nocache /data e748bbea-df7c-11f1-9b43-e2a751dc967b3⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4300
-
-
C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe"C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 2344 000003C8 000009F8 /override 36cbaa2b650527acd2f06c5849c7de88a54a35d7 /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll" /audit /silent /nocache /data f59052c5-df7c-11f1-9b43-e2a751dc967b3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3540
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\769F85394FB15C375FF89A7488274D5B_042FC0BE139F72196A338B07721E6413
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E55FEB142F566DFBD0ED964FAB94545
- Size 8KB
- SHA256 0f2cd52a46c8d23d17680c5cf6d088c4d9d3b9650177a6acef042447109b49a9
- MD5 ef742b46ba1e5b67c2c1bc9c60de08a0
- SHA1 259f87376b46365c3488ed1d29b7856e650598a1
- SHA512 b053c8076d75de5e7a37fab4c33167eaec9278c37cce6ee2536f818a18ca341c90fa8ea88590a05b112b1dda2f5d81874c1a7c65e52c9c563e743f2b4834988f
- SSDEEP 192:EXtnCJolZe5V3IFfaTLHke1sXk3SPykBUMljvwFM:EXtblZe5V3gfaTLkSSUsjY2
- TLSH T1670253D1AFBD2CA4F689CFB200CD9A2F677375DA76031A4056F85A90E9067C11F3D424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4
- Size 1KB
- SHA256 dd12c5733bc4b682e1da6353c8c27650f53d11a8ada8fd8a2d06f23cecae5ebd
- MD5 2ffbdb98df2a2b022a48adeb94a3af50
- SHA1 6c86923b5c5832bb102f041cb7d38db397074f12
- SHA512 a5f29661ac78ea205dd945fcc53e015152277426af4bcce688231ca1a564dc49144b2953409651737733fec72e9042468c780917543c007d7de74ed44058dbfb
- TLSH T1073145968E7D3C55E3139DB0C6CFED6B9E30E4C617C1AC2A523896805581FC24EF4494
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\65bda646-df7c-11f1-9b43-e2a751dc967b
- Size 414KB
- SHA256 3058c3857915c496a4de04dbdd3fea38c8b449dac0932756773b4b04933450a9
- MD5 b1f41512afef698fb2aa7b4e06950006
- SHA1 e164af0fde698145991a80b05519d88ac1dc473d
- SHA512 ddeffd1280a90db7c0501bc6da672aa7da7196ec94fb883ca8e4356b67d1555a38d07525f9ead0eadee48de7cba468c3efe09901a6e489e26b44d8bf48f6f5cb
- SSDEEP 12288:ARiTll0UlKLElxOqAXuiieFkgRuvxUSHwi7BvmZnN8RJU:iW1lKwPOvfcvUnGJU
- TLSH T12A94AE117685C437D2B30A335669D26919BDF8316D618A9BB3C41BBEED307C2AA10F37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\65bda643-df7c-11f1-9b43-e2a751dc967b\Ninite.dll
- Size 850KB
- SHA256 15646217deb09ed9e91b28584b498f1be4745906e8aeef937539ce877c9d5edd
- MD5 a77a8efb26adff1593e851ae3876a35d
- SHA1 78af199d7c4c89d3e94751f731d68209bedf7c44
- SHA512 776383ffe57fcb9d3cfb0b4efb03c46e0ce9d8a8319c9a0f05efce4f8455193d4aca07aa91666ec92bec9b4fb5f7982271f48675ac84de85ce8ebc32b767ec03
- SSDEEP 12288:a2FiA+4qKllVh804Mq4MaL1hIvVZlc7IvVulTmkISbgJ7wTai7BvmZj3Gbfld9TX:NFiA++ovLlbvTkISbgmTfvUj2Tld9TX
- TLSH T1F7057C237A89C03AF17E0270652D977918B5EC304AB195CB77C477AE2A74BC0A729F17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
- Size 174B
- SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
- MD5 17d5d0735deaa1fb4b41a7c406763c0a
- SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
- SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
- TLSH T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
- Size 174B
- SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
- MD5 a2d31a04bc38eeac22fca3e30508ba47
- SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
- SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
- TLSH T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\NiniteAgent.log
- Size 87B
- SHA256 779df12638b83a97ef3b64b8767ccb08d7d83f0d66cbd10823098c1d99ae2e01
- MD5 ba876c14e7883623fbf2ba05cd8ce9f0
- SHA1 faabea8f70fce486b2e0ac893ca4644d41a7ddae
- SHA512 655c094ba5a270705a3361caf37c5525a1fe9849625193a71b33dab860d667f70a45c0e3e8547dbf2111581327744c4e8814caf60899d0d0ceeb9527df3db701
- TLSH T1A2B0121482C330001EC190C00C39184710401C3F303C3A8D31F0E324D42A11189530C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\Ninite.tmp\2C1D849DDB5A73C1EBA8ADF77845D022EED7EB42\5776C5F469792F20ADC4EA620C2E8E5C81D08AEB\Ninite.dll
- Size 414KB
- SHA256 16f1b6883b73a758a1959a4e3b0cba5bee03f2fa45e451f941afa168f54ad938
- MD5 c44b6c52d403ff8331dc796426617c94
- SHA1 5776c5f469792f20adc4ea620c2e8e5c81d08aeb
- SHA512 7f38773f235b2063a509b1f39cb385721504d872d035eb92add21b19b41144076f26118f070058187696ab7c1739c45ee404a8963aee9ca5a7a26261c0193a82
- SSDEEP 6144:JB7Eeseb9MhRERxf4xFj8kCnl8aeNPCR+JOhlMi7ksvmacD54Buf:JBaeZzf4xFj8EPnBi7BvmZD5cW
- TLSH T15994AD21F9458436D66F06303528DA651D7DBC717FE0D9CBA3C01DAEA9726C0EB24B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1575\Ninite.dll
- Size 2.0MB
- SHA256 ce00d2ba81db44e80e67ee18dc61fed7ad879818e3e85cf695e37ff1eb198b70
- MD5 edeae1c3f8b8e13b77a5f5b56fd3f6be
- SHA1 975fe4b1c5d859d557967e3fc788f6039104096b
- SHA512 00380797c32a8d2d13d40bee3d26f93d7326c04f56c9b65e0ffcaf01b8f4749476889db8f89977f04d7c9a1c423b31f37ae8d54ece5400ea2be4a5c87c0d3a8e
- SSDEEP 49152:44aM+TR95F4sO7f1aZ+hucZEXMcuOVz42wtIU/n2/HFFbVum:44anF4sOTlucZStugzbgfY
- TLSH T1D5A58C23B7948039E07E02B0712D93581DB5FDB10AB1C59F63D43B9EB9B9AC0961AF17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\Ninite.tmp\^1B949094E9119BD8865FFF0224295CA523B363C0
- Size 81B
- SHA256 d626e706fb0ae9b1836eae9c7d2aaa41af6503a3ba4c739385a4130f8df441ff
- MD5 174ed32f1419d2633835ab626501923c
- SHA1 f1a750b74a608a844776117fe0a8ec5c0bf25699
- SHA512 f7147ed762fff07d404f2fd00edf3636778fba7397d4e23c29b363b04065222681b30922b45d9b8b1cf86e45a2eca182cac55894711c4cc7ec417009e707bbed
- TLSH T1E2A012C0B62C49420161CF0444D150C100C81280098601296C0014E1D42041C108DB70
- MD5 SHA1 SHA512 TLSH