5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

Analysis

max time kernel
152s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.Blocker.exe
Size

12.8MB
MD5

de49bd95024c0aa621789ba53447e55a
SHA1

5139a6afc1c3efb0a81ce0c126291ea5565b517f
SHA256

5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572
SHA512

d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc
SSDEEP

98304:h6HgvfRICM0U1mHBaZnPCFilTgUBTaXMmrgv:h6HDCMfmH7glyMPv

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	Trojan-Ransom.Win32.Blocker.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan-Ransom.Win32.Blocker.exe:*:Enabled:Microsoft Windows Update Platform"	Trojan-Ransom.Win32.Blocker.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.exe

Executes dropped EXE 64 IoCs

pid	Process
544	Builder.exe
1224	avguix.exe
1292	avguix.exe
580	avguix.exe
112	avguix.exe
1752	avguix.exe
1448	avguix.exe
2044	avguix.exe
1196	avguix.exe
1828	avguix.exe
1192	avguix.exe
1260	avguix.exe
964	avguix.exe
1920	avguix.exe
1408	avguix.exe
1692	avguix.exe
1604	avguix.exe
1460	avguix.exe
860	avguix.exe
1952	avguix.exe
748	avguix.exe
1068	avguix.exe
1832	avguix.exe
1072	avguix.exe
2012	avguix.exe
980	avguix.exe
1584	avguix.exe
944	avguix.exe
1204	avguix.exe
1224	avguix.exe
456	avguix.exe
1768	avguix.exe
820	avguix.exe
696	avguix.exe
572	avguix.exe
364	avguix.exe
992	avguix.exe
1680	avguix.exe
1828	avguix.exe
1192	avguix.exe
1260	avguix.exe
964	avguix.exe
1996	avguix.exe
1924	avguix.exe
664	avguix.exe
884	avguix.exe
972	avguix.exe
1836	avguix.exe
1908	avguix.exe
904	avguix.exe
1048	avguix.exe
840	avguix.exe
852	avguix.exe
1580	avguix.exe
1548	avguix.exe
676	avguix.exe
1352	avguix.exe
1720	avguix.exe
1292	avguix.exe
1080	avguix.exe
1764	avguix.exe
1316	avguix.exe
1448	avguix.exe
1324	avguix.exe

Loads dropped DLL 3 IoCs

pid	Process
2024	Trojan-Ransom.Win32.Blocker.exe
2024	Trojan-Ransom.Win32.Blocker.exe
544	Builder.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Avguix Securiti = "C:\\Users\\Admin\\AppData\\Local\\Builder.exe"	Builder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVG Internet Security = "C:\\Users\\Admin\\AppData\\Local\\avguix.exe"	Trojan-Ransom.Win32.Blocker.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\OikCCDEEFF1.sys	Trojan-Ransom.Win32.Blocker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe
544	Builder.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2024	Trojan-Ransom.Win32.Blocker.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2024	Trojan-Ransom.Win32.Blocker.exe
1224	avguix.exe
1292	avguix.exe
580	avguix.exe
112	avguix.exe
1752	avguix.exe
1448	avguix.exe
2044	avguix.exe
1196	avguix.exe
1828	avguix.exe
1192	avguix.exe
1260	avguix.exe
964	avguix.exe
1920	avguix.exe
1408	avguix.exe
1692	avguix.exe
1604	avguix.exe
1460	avguix.exe
860	avguix.exe
1952	avguix.exe
748	avguix.exe
1068	avguix.exe
1832	avguix.exe
1072	avguix.exe
2012	avguix.exe
980	avguix.exe
1584	avguix.exe
944	avguix.exe
1204	avguix.exe
1224	avguix.exe
456	avguix.exe
1768	avguix.exe
820	avguix.exe
696	avguix.exe
572	avguix.exe
364	avguix.exe
992	avguix.exe
1680	avguix.exe
1828	avguix.exe
1192	avguix.exe
1260	avguix.exe
964	avguix.exe
1996	avguix.exe
1924	avguix.exe
664	avguix.exe
884	avguix.exe
972	avguix.exe
1836	avguix.exe
1908	avguix.exe
904	avguix.exe
1048	avguix.exe
840	avguix.exe
1580	avguix.exe
1548	avguix.exe
676	avguix.exe
1352	avguix.exe
1720	avguix.exe
1292	avguix.exe
1080	avguix.exe
1764	avguix.exe
1316	avguix.exe
1448	avguix.exe
1324	avguix.exe
364	avguix.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 544	2024	Trojan-Ransom.Win32.Blocker.exe	27
PID 2024 wrote to memory of 544	2024	Trojan-Ransom.Win32.Blocker.exe	27
PID 2024 wrote to memory of 544	2024	Trojan-Ransom.Win32.Blocker.exe	27
PID 2024 wrote to memory of 544	2024	Trojan-Ransom.Win32.Blocker.exe	27
PID 544 wrote to memory of 1224	544	Builder.exe	28
PID 544 wrote to memory of 1224	544	Builder.exe	28
PID 544 wrote to memory of 1224	544	Builder.exe	28
PID 544 wrote to memory of 1224	544	Builder.exe	28
PID 544 wrote to memory of 1292	544	Builder.exe	29
PID 544 wrote to memory of 1292	544	Builder.exe	29
PID 544 wrote to memory of 1292	544	Builder.exe	29
PID 544 wrote to memory of 1292	544	Builder.exe	29
PID 544 wrote to memory of 580	544	Builder.exe	30
PID 544 wrote to memory of 580	544	Builder.exe	30
PID 544 wrote to memory of 580	544	Builder.exe	30
PID 544 wrote to memory of 580	544	Builder.exe	30
PID 544 wrote to memory of 112	544	Builder.exe	31
PID 544 wrote to memory of 112	544	Builder.exe	31
PID 544 wrote to memory of 112	544	Builder.exe	31
PID 544 wrote to memory of 112	544	Builder.exe	31
PID 544 wrote to memory of 1752	544	Builder.exe	32
PID 544 wrote to memory of 1752	544	Builder.exe	32
PID 544 wrote to memory of 1752	544	Builder.exe	32
PID 544 wrote to memory of 1752	544	Builder.exe	32
PID 544 wrote to memory of 1448	544	Builder.exe	33
PID 544 wrote to memory of 1448	544	Builder.exe	33
PID 544 wrote to memory of 1448	544	Builder.exe	33
PID 544 wrote to memory of 1448	544	Builder.exe	33
PID 544 wrote to memory of 2044	544	Builder.exe	34
PID 544 wrote to memory of 2044	544	Builder.exe	34
PID 544 wrote to memory of 2044	544	Builder.exe	34
PID 544 wrote to memory of 2044	544	Builder.exe	34
PID 544 wrote to memory of 1196	544	Builder.exe	35
PID 544 wrote to memory of 1196	544	Builder.exe	35
PID 544 wrote to memory of 1196	544	Builder.exe	35
PID 544 wrote to memory of 1196	544	Builder.exe	35
PID 544 wrote to memory of 1828	544	Builder.exe	36
PID 544 wrote to memory of 1828	544	Builder.exe	36
PID 544 wrote to memory of 1828	544	Builder.exe	36
PID 544 wrote to memory of 1828	544	Builder.exe	36
PID 544 wrote to memory of 1192	544	Builder.exe	37
PID 544 wrote to memory of 1192	544	Builder.exe	37
PID 544 wrote to memory of 1192	544	Builder.exe	37
PID 544 wrote to memory of 1192	544	Builder.exe	37
PID 544 wrote to memory of 1260	544	Builder.exe	38
PID 544 wrote to memory of 1260	544	Builder.exe	38
PID 544 wrote to memory of 1260	544	Builder.exe	38
PID 544 wrote to memory of 1260	544	Builder.exe	38
PID 544 wrote to memory of 964	544	Builder.exe	39
PID 544 wrote to memory of 964	544	Builder.exe	39
PID 544 wrote to memory of 964	544	Builder.exe	39
PID 544 wrote to memory of 964	544	Builder.exe	39
PID 544 wrote to memory of 1920	544	Builder.exe	40
PID 544 wrote to memory of 1920	544	Builder.exe	40
PID 544 wrote to memory of 1920	544	Builder.exe	40
PID 544 wrote to memory of 1920	544	Builder.exe	40
PID 544 wrote to memory of 1408	544	Builder.exe	41
PID 544 wrote to memory of 1408	544	Builder.exe	41
PID 544 wrote to memory of 1408	544	Builder.exe	41
PID 544 wrote to memory of 1408	544	Builder.exe	41
PID 544 wrote to memory of 1692	544	Builder.exe	42
PID 544 wrote to memory of 1692	544	Builder.exe	42
PID 544 wrote to memory of 1692	544	Builder.exe	42
PID 544 wrote to memory of 1692	544	Builder.exe	42

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Trojan-Ransom.Win32.Blocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.exe

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
1⤵
- Modifies firewall policy service
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2024
- C:\Users\Admin\AppData\Local\Builder.exe
  C:\Users\Admin\AppData\Local\Builder.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1224
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1292
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:580
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:112
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1752
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1448
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2044
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1196
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1192
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1260
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:964
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1920
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1408
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1604
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1460
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:860
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1952
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:748
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1068
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1832
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1072
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2012
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:980
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1584
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:944
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1204
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1224
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:456
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1768
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:820
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:696
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:572
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:364
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:992
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1192
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1260
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:964
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1996
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1924
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:664
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:884
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:972
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1836
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1908
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:904
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1048
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:840
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    PID:852
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1580
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1548
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:676
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1352
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1720
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1292
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1080
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1764
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1316
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1448
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1324
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:364
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1196
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1144
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1052
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1040
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1296
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:740
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1464
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Local\avguix.exe
    C:\Users\Admin\AppData\Local\avguix.exe
    3⤵
    PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Builder.exe

Filesize
725KB

MD5
be66c2f585ca3c15426bda505ad9e5a8

SHA1
848dc2b6fe084d9b041a544af731c8805271ec1f

SHA256
b358fcdb906ee7eb46a7d8a8e34c759c4608d303fceff6b35f6049e539d8c207

SHA512
83998322371d2cb75b67a25c2f23f31ab250626e634feb4c5505a24a7176b75ce2f70fb22e04a756811c9b94e91e9d087cdc34746b3e412b8779fc03c9acdb09

Download Submit
C:\Users\Admin\AppData\Local\Builder.exe

Filesize
725KB

MD5
be66c2f585ca3c15426bda505ad9e5a8

SHA1
848dc2b6fe084d9b041a544af731c8805271ec1f

SHA256
b358fcdb906ee7eb46a7d8a8e34c759c4608d303fceff6b35f6049e539d8c207

SHA512
83998322371d2cb75b67a25c2f23f31ab250626e634feb4c5505a24a7176b75ce2f70fb22e04a756811c9b94e91e9d087cdc34746b3e412b8779fc03c9acdb09

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
C:\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
\Users\Admin\AppData\Local\Builder.exe

Filesize
725KB

MD5
be66c2f585ca3c15426bda505ad9e5a8

SHA1
848dc2b6fe084d9b041a544af731c8805271ec1f

SHA256
b358fcdb906ee7eb46a7d8a8e34c759c4608d303fceff6b35f6049e539d8c207

SHA512
83998322371d2cb75b67a25c2f23f31ab250626e634feb4c5505a24a7176b75ce2f70fb22e04a756811c9b94e91e9d087cdc34746b3e412b8779fc03c9acdb09

Download Submit
\Users\Admin\AppData\Local\Builder.exe

Filesize
725KB

MD5
be66c2f585ca3c15426bda505ad9e5a8

SHA1
848dc2b6fe084d9b041a544af731c8805271ec1f

SHA256
b358fcdb906ee7eb46a7d8a8e34c759c4608d303fceff6b35f6049e539d8c207

SHA512
83998322371d2cb75b67a25c2f23f31ab250626e634feb4c5505a24a7176b75ce2f70fb22e04a756811c9b94e91e9d087cdc34746b3e412b8779fc03c9acdb09

Download Submit
\Users\Admin\AppData\Local\avguix.exe

Filesize
12.8MB

MD5
de49bd95024c0aa621789ba53447e55a

SHA1
5139a6afc1c3efb0a81ce0c126291ea5565b517f

SHA256
5cbb3b5944fe2f41dd5c65bf199c006895d9d0c087836fe2c7849fad32c32572

SHA512
d55b943d985e6c1610c7981ab0aaa485ac76b8f63dc2fff55ccce4563647cda123db384b9f311079247170836b6e0259d6385f1d409c082fbdf8355f114cb4cc

Download Submit
memory/2024-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download