6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca

Analysis

max time kernel
131s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
Size

169KB
MD5

4790f5e2d604ff6548a6959eb144cab3
SHA1

b113e02b6765be623323ffcfc98f62ac510232d4
SHA256

6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca
SHA512

1d2d90c40515217f87a40e7bdcbb9498e92a7c0d3433432bf970f75d2e54211abbb320617fc6fe57e2e50f898fb79e678a84bbaa6cb0e9c4ba25471ce6da0d3a
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCmzy8Jmky8JI3W:gDCwfG1bnxG8M58CW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

hosts.exe6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exeavscan.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

4988 avscan.exe
4048 avscan.exe
2716 hosts.exe
3740 hosts.exe
5040 avscan.exe
228 hosts.exe

pid	process
4988	avscan.exe
4048	avscan.exe
2716	hosts.exe
3740	hosts.exe
5040	avscan.exe
228	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.execmd.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

avscan.exehosts.exe6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe

Drops file in Windows directory 5 IoCs

Processes:

6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exeavscan.exehosts.exe

description	ioc	process
File created	C:\windows\W_X_C.vbs	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
File created	\??\c:\windows\W_X_C.bat	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
File opened for modification	C:\Windows\hosts.exe	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

cmd.exe6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.execmd.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

2504 REG.exe
3128 REG.exe
4656 REG.exe
4016 REG.exe
3428 REG.exe
3096 REG.exe
1612 REG.exe
4288 REG.exe
2840 REG.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

avscan.exehosts.exe

pid process

4988 avscan.exe
2716 hosts.exe

pid	process
2504	REG.exe
3128	REG.exe
4656	REG.exe
4016	REG.exe
3428	REG.exe
3096	REG.exe
1612	REG.exe
4288	REG.exe
2840	REG.exe

pid	process
4988	avscan.exe
2716	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exeavscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid	process
4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
4988	avscan.exe
4048	avscan.exe
2716	hosts.exe
3740	hosts.exe
5040	avscan.exe
228	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exeavscan.execmd.execmd.exehosts.execmd.exe

description	pid	process	target process
PID 4584 wrote to memory of 3428	4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe	REG.exe
PID 4584 wrote to memory of 3428	4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe	REG.exe
PID 4584 wrote to memory of 3428	4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe	REG.exe
PID 4584 wrote to memory of 4988	4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe	avscan.exe
PID 4584 wrote to memory of 4988	4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe	avscan.exe
PID 4584 wrote to memory of 4988	4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe	avscan.exe
PID 4988 wrote to memory of 4048	4988	avscan.exe	avscan.exe
PID 4988 wrote to memory of 4048	4988	avscan.exe	avscan.exe
PID 4988 wrote to memory of 4048	4988	avscan.exe	avscan.exe
PID 4988 wrote to memory of 4932	4988	avscan.exe	cmd.exe
PID 4988 wrote to memory of 4932	4988	avscan.exe	cmd.exe
PID 4988 wrote to memory of 4932	4988	avscan.exe	cmd.exe
PID 4584 wrote to memory of 4964	4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe	cmd.exe
PID 4584 wrote to memory of 4964	4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe	cmd.exe
PID 4584 wrote to memory of 4964	4584	6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe	cmd.exe
PID 4964 wrote to memory of 3740	4964	cmd.exe	hosts.exe
PID 4964 wrote to memory of 3740	4964	cmd.exe	hosts.exe
PID 4964 wrote to memory of 3740	4964	cmd.exe	hosts.exe
PID 4932 wrote to memory of 2716	4932	cmd.exe	hosts.exe
PID 4932 wrote to memory of 2716	4932	cmd.exe	hosts.exe
PID 4932 wrote to memory of 2716	4932	cmd.exe	hosts.exe
PID 2716 wrote to memory of 5040	2716	hosts.exe	avscan.exe
PID 2716 wrote to memory of 5040	2716	hosts.exe	avscan.exe
PID 2716 wrote to memory of 5040	2716	hosts.exe	avscan.exe
PID 2716 wrote to memory of 3544	2716	hosts.exe	cmd.exe
PID 2716 wrote to memory of 3544	2716	hosts.exe	cmd.exe
PID 2716 wrote to memory of 3544	2716	hosts.exe	cmd.exe
PID 3544 wrote to memory of 228	3544	cmd.exe	hosts.exe
PID 3544 wrote to memory of 228	3544	cmd.exe	hosts.exe
PID 3544 wrote to memory of 228	3544	cmd.exe	hosts.exe
PID 4932 wrote to memory of 3232	4932	cmd.exe	WScript.exe
PID 4932 wrote to memory of 3232	4932	cmd.exe	WScript.exe
PID 4932 wrote to memory of 3232	4932	cmd.exe	WScript.exe
PID 4964 wrote to memory of 2152	4964	cmd.exe	WScript.exe
PID 4964 wrote to memory of 2152	4964	cmd.exe	WScript.exe
PID 4964 wrote to memory of 2152	4964	cmd.exe	WScript.exe
PID 3544 wrote to memory of 380	3544	cmd.exe	WScript.exe
PID 3544 wrote to memory of 380	3544	cmd.exe	WScript.exe
PID 3544 wrote to memory of 380	3544	cmd.exe	WScript.exe
PID 4988 wrote to memory of 2504	4988	avscan.exe	REG.exe
PID 4988 wrote to memory of 2504	4988	avscan.exe	REG.exe
PID 4988 wrote to memory of 2504	4988	avscan.exe	REG.exe
PID 2716 wrote to memory of 3128	2716	hosts.exe	REG.exe
PID 2716 wrote to memory of 3128	2716	hosts.exe	REG.exe
PID 2716 wrote to memory of 3128	2716	hosts.exe	REG.exe
PID 4988 wrote to memory of 4656	4988	avscan.exe	REG.exe
PID 4988 wrote to memory of 4656	4988	avscan.exe	REG.exe
PID 4988 wrote to memory of 4656	4988	avscan.exe	REG.exe
PID 2716 wrote to memory of 3096	2716	hosts.exe	REG.exe
PID 2716 wrote to memory of 3096	2716	hosts.exe	REG.exe
PID 2716 wrote to memory of 3096	2716	hosts.exe	REG.exe
PID 4988 wrote to memory of 1612	4988	avscan.exe	REG.exe
PID 4988 wrote to memory of 1612	4988	avscan.exe	REG.exe
PID 4988 wrote to memory of 1612	4988	avscan.exe	REG.exe
PID 2716 wrote to memory of 4288	2716	hosts.exe	REG.exe
PID 2716 wrote to memory of 4288	2716	hosts.exe	REG.exe
PID 2716 wrote to memory of 4288	2716	hosts.exe	REG.exe
PID 4988 wrote to memory of 2840	4988	avscan.exe	REG.exe
PID 4988 wrote to memory of 2840	4988	avscan.exe	REG.exe
PID 4988 wrote to memory of 2840	4988	avscan.exe	REG.exe
PID 2716 wrote to memory of 4016	2716	hosts.exe	REG.exe
PID 2716 wrote to memory of 4016	2716	hosts.exe	REG.exe
PID 2716 wrote to memory of 4016	2716	hosts.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe
"C:\Users\Admin\AppData\Local\Temp\6ad1498e5c8bdb678c7d0e566d8ff04f8972582db091647effd82b6e59fff5ca.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:3428

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4048

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4932

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3544

C:\windows\hosts.exe
C:\windows\hosts.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:228

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
6⤵
- Adds policy Run key to start application
PID:380

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:3128

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:3096

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:4288

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:4016

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:3232

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:2504

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4656

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:1612

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:2840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4964

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3740

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:2152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
170KB

MD5
ee34c6df5a793e18309e64dab5dfa43d

SHA1
48b00239804aba42dec177a6a7bfdac41c526634

SHA256
15fa9db3d5922ae64ca27990c8f345acbad2b8b857cf4245a0f166ef0609854b

SHA512
aafd1f3396f1ac1486e2c114d397848240f0d6e047f870f6f2cd1fe1378a34aa83ff282685b4e4de44d27a9c0b0f3837561ab938f5ccff41b3780815d855da16

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
170KB

MD5
ee34c6df5a793e18309e64dab5dfa43d

SHA1
48b00239804aba42dec177a6a7bfdac41c526634

SHA256
15fa9db3d5922ae64ca27990c8f345acbad2b8b857cf4245a0f166ef0609854b

SHA512
aafd1f3396f1ac1486e2c114d397848240f0d6e047f870f6f2cd1fe1378a34aa83ff282685b4e4de44d27a9c0b0f3837561ab938f5ccff41b3780815d855da16

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
170KB

MD5
ee34c6df5a793e18309e64dab5dfa43d

SHA1
48b00239804aba42dec177a6a7bfdac41c526634

SHA256
15fa9db3d5922ae64ca27990c8f345acbad2b8b857cf4245a0f166ef0609854b

SHA512
aafd1f3396f1ac1486e2c114d397848240f0d6e047f870f6f2cd1fe1378a34aa83ff282685b4e4de44d27a9c0b0f3837561ab938f5ccff41b3780815d855da16

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
170KB

MD5
ee34c6df5a793e18309e64dab5dfa43d

SHA1
48b00239804aba42dec177a6a7bfdac41c526634

SHA256
15fa9db3d5922ae64ca27990c8f345acbad2b8b857cf4245a0f166ef0609854b

SHA512
aafd1f3396f1ac1486e2c114d397848240f0d6e047f870f6f2cd1fe1378a34aa83ff282685b4e4de44d27a9c0b0f3837561ab938f5ccff41b3780815d855da16

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
7fc0db81060e343fd209dc050b401f77

SHA1
08ce8975b023bf90c21b8e64cd54fdd39debce04

SHA256
4a21d378652d4291a6b9e88a1934ac51e9eccd5c9a42aa09076219301509367f

SHA512
e0d13ba3713707f7cb9be56240930a8f47d8c302e692b49dcb01f7bdf3e3475f829e1ead60ce6a5f98bed591be96456e9c3ef67bb27f88dc70343c1412e9de57

Download Submit
C:\Windows\hosts.exe

Filesize
170KB

MD5
013b019056d5037eb3e991d83ebb7eeb

SHA1
9b19ce39c07f6efd9d4f0a58c75cbac24e48013a

SHA256
7749aeb0129755536766b4334f59aa72aa42db06d14cf1f599bc5d5f4d0e53ea

SHA512
96c77a8e32c66b9bdb712100b4ba582b65a077ac2b8640c9b26bed0ff04fa6c2bfd86321af2bdc7b3b49621f40e8255e8543a1ddb05df257fcb0fa4bcc9602ba

Download Submit
C:\Windows\hosts.exe

Filesize
170KB

MD5
013b019056d5037eb3e991d83ebb7eeb

SHA1
9b19ce39c07f6efd9d4f0a58c75cbac24e48013a

SHA256
7749aeb0129755536766b4334f59aa72aa42db06d14cf1f599bc5d5f4d0e53ea

SHA512
96c77a8e32c66b9bdb712100b4ba582b65a077ac2b8640c9b26bed0ff04fa6c2bfd86321af2bdc7b3b49621f40e8255e8543a1ddb05df257fcb0fa4bcc9602ba

Download Submit
C:\Windows\hosts.exe

Filesize
170KB

MD5
013b019056d5037eb3e991d83ebb7eeb

SHA1
9b19ce39c07f6efd9d4f0a58c75cbac24e48013a

SHA256
7749aeb0129755536766b4334f59aa72aa42db06d14cf1f599bc5d5f4d0e53ea

SHA512
96c77a8e32c66b9bdb712100b4ba582b65a077ac2b8640c9b26bed0ff04fa6c2bfd86321af2bdc7b3b49621f40e8255e8543a1ddb05df257fcb0fa4bcc9602ba

Download Submit
C:\Windows\hosts.exe

Filesize
170KB

MD5
013b019056d5037eb3e991d83ebb7eeb

SHA1
9b19ce39c07f6efd9d4f0a58c75cbac24e48013a

SHA256
7749aeb0129755536766b4334f59aa72aa42db06d14cf1f599bc5d5f4d0e53ea

SHA512
96c77a8e32c66b9bdb712100b4ba582b65a077ac2b8640c9b26bed0ff04fa6c2bfd86321af2bdc7b3b49621f40e8255e8543a1ddb05df257fcb0fa4bcc9602ba

Download Submit
C:\windows\hosts.exe

Filesize
170KB

MD5
013b019056d5037eb3e991d83ebb7eeb

SHA1
9b19ce39c07f6efd9d4f0a58c75cbac24e48013a

SHA256
7749aeb0129755536766b4334f59aa72aa42db06d14cf1f599bc5d5f4d0e53ea

SHA512
96c77a8e32c66b9bdb712100b4ba582b65a077ac2b8640c9b26bed0ff04fa6c2bfd86321af2bdc7b3b49621f40e8255e8543a1ddb05df257fcb0fa4bcc9602ba

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/228-162-0x0000000000000000-mapping.dmp

Download
memory/380-169-0x0000000000000000-mapping.dmp

Download
memory/1612-174-0x0000000000000000-mapping.dmp

Download
memory/2152-167-0x0000000000000000-mapping.dmp

Download
memory/2504-170-0x0000000000000000-mapping.dmp

Download
memory/2716-149-0x0000000000000000-mapping.dmp

Download
memory/2840-176-0x0000000000000000-mapping.dmp

Download
memory/3096-173-0x0000000000000000-mapping.dmp

Download
memory/3128-171-0x0000000000000000-mapping.dmp

Download
memory/3232-168-0x0000000000000000-mapping.dmp

Download
memory/3428-134-0x0000000000000000-mapping.dmp

Download
memory/3544-161-0x0000000000000000-mapping.dmp

Download
memory/3740-148-0x0000000000000000-mapping.dmp

Download
memory/4016-177-0x0000000000000000-mapping.dmp

Download
memory/4048-141-0x0000000000000000-mapping.dmp

Download
memory/4288-175-0x0000000000000000-mapping.dmp

Download
memory/4656-172-0x0000000000000000-mapping.dmp

Download
memory/4932-145-0x0000000000000000-mapping.dmp

Download
memory/4964-146-0x0000000000000000-mapping.dmp

Download
memory/4988-135-0x0000000000000000-mapping.dmp

Download
memory/5040-157-0x0000000000000000-mapping.dmp

Download