1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065

Analysis

max time kernel
144s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe
Size

181KB
MD5

068ed81b7b7a3426f0f6292e4f41acd2
SHA1

031cca397819188b38482717d254dcd09dbcc9e6
SHA256

1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065
SHA512

a14e0036ee722b72ad4db3c84e0d06328ced0fecb3c883a735df8ab1bcc68ee2ec825351a46815b5ddcf12aa7439d8a892dabb7a5d7c637718fb6c03c263bcde
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQKhsaR2:gDCwfG1bnxLERR9saR2

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

4052 avscan.exe
2032 avscan.exe
1900 hosts.exe
3332 hosts.exe
4868 avscan.exe
3932 hosts.exe

pid	process
4052	avscan.exe
2032	avscan.exe
1900	hosts.exe
3332	hosts.exe
4868	avscan.exe
3932	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.execmd.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exeavscan.exehosts.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe

Drops file in Windows directory 5 IoCs

Processes:

1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exeavscan.exehosts.exe

description	ioc	process
File created	\??\c:\windows\W_X_C.bat	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe
File opened for modification	C:\Windows\hosts.exe	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

cmd.exe1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.execmd.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

3996 REG.exe
3956 REG.exe
4712 REG.exe
4732 REG.exe
3736 REG.exe
2672 REG.exe
1960 REG.exe
1336 REG.exe
4760 REG.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

avscan.exehosts.exe

pid process

4052 avscan.exe
1900 hosts.exe

pid	process
3996	REG.exe
3956	REG.exe
4712	REG.exe
4732	REG.exe
3736	REG.exe
2672	REG.exe
1960	REG.exe
1336	REG.exe
4760	REG.exe

pid	process
4052	avscan.exe
1900	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exeavscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid	process
4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe
4052	avscan.exe
2032	avscan.exe
1900	hosts.exe
3332	hosts.exe
4868	avscan.exe
3932	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exeavscan.execmd.execmd.exehosts.execmd.exe

description	pid	process	target process
PID 4760 wrote to memory of 4732	4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe	REG.exe
PID 4760 wrote to memory of 4732	4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe	REG.exe
PID 4760 wrote to memory of 4732	4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe	REG.exe
PID 4760 wrote to memory of 4052	4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe	avscan.exe
PID 4760 wrote to memory of 4052	4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe	avscan.exe
PID 4760 wrote to memory of 4052	4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe	avscan.exe
PID 4052 wrote to memory of 2032	4052	avscan.exe	avscan.exe
PID 4052 wrote to memory of 2032	4052	avscan.exe	avscan.exe
PID 4052 wrote to memory of 2032	4052	avscan.exe	avscan.exe
PID 4052 wrote to memory of 1256	4052	avscan.exe	cmd.exe
PID 4052 wrote to memory of 1256	4052	avscan.exe	cmd.exe
PID 4052 wrote to memory of 1256	4052	avscan.exe	cmd.exe
PID 4760 wrote to memory of 3272	4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe	cmd.exe
PID 4760 wrote to memory of 3272	4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe	cmd.exe
PID 4760 wrote to memory of 3272	4760	1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe	cmd.exe
PID 1256 wrote to memory of 1900	1256	cmd.exe	hosts.exe
PID 1256 wrote to memory of 1900	1256	cmd.exe	hosts.exe
PID 1256 wrote to memory of 1900	1256	cmd.exe	hosts.exe
PID 3272 wrote to memory of 3332	3272	cmd.exe	hosts.exe
PID 3272 wrote to memory of 3332	3272	cmd.exe	hosts.exe
PID 3272 wrote to memory of 3332	3272	cmd.exe	hosts.exe
PID 1900 wrote to memory of 4868	1900	hosts.exe	avscan.exe
PID 1900 wrote to memory of 4868	1900	hosts.exe	avscan.exe
PID 1900 wrote to memory of 4868	1900	hosts.exe	avscan.exe
PID 1900 wrote to memory of 4416	1900	hosts.exe	cmd.exe
PID 1900 wrote to memory of 4416	1900	hosts.exe	cmd.exe
PID 1900 wrote to memory of 4416	1900	hosts.exe	cmd.exe
PID 4416 wrote to memory of 3932	4416	cmd.exe	hosts.exe
PID 4416 wrote to memory of 3932	4416	cmd.exe	hosts.exe
PID 4416 wrote to memory of 3932	4416	cmd.exe	hosts.exe
PID 1256 wrote to memory of 4256	1256	cmd.exe	WScript.exe
PID 1256 wrote to memory of 4256	1256	cmd.exe	WScript.exe
PID 1256 wrote to memory of 4256	1256	cmd.exe	WScript.exe
PID 3272 wrote to memory of 3452	3272	cmd.exe	WScript.exe
PID 3272 wrote to memory of 3452	3272	cmd.exe	WScript.exe
PID 3272 wrote to memory of 3452	3272	cmd.exe	WScript.exe
PID 4416 wrote to memory of 4616	4416	cmd.exe	WScript.exe
PID 4416 wrote to memory of 4616	4416	cmd.exe	WScript.exe
PID 4416 wrote to memory of 4616	4416	cmd.exe	WScript.exe
PID 4052 wrote to memory of 3736	4052	avscan.exe	REG.exe
PID 4052 wrote to memory of 3736	4052	avscan.exe	REG.exe
PID 4052 wrote to memory of 3736	4052	avscan.exe	REG.exe
PID 1900 wrote to memory of 2672	1900	hosts.exe	REG.exe
PID 1900 wrote to memory of 2672	1900	hosts.exe	REG.exe
PID 1900 wrote to memory of 2672	1900	hosts.exe	REG.exe
PID 4052 wrote to memory of 1960	4052	avscan.exe	REG.exe
PID 4052 wrote to memory of 1960	4052	avscan.exe	REG.exe
PID 4052 wrote to memory of 1960	4052	avscan.exe	REG.exe
PID 1900 wrote to memory of 3996	1900	hosts.exe	REG.exe
PID 1900 wrote to memory of 3996	1900	hosts.exe	REG.exe
PID 1900 wrote to memory of 3996	1900	hosts.exe	REG.exe
PID 4052 wrote to memory of 4712	4052	avscan.exe	REG.exe
PID 4052 wrote to memory of 4712	4052	avscan.exe	REG.exe
PID 4052 wrote to memory of 4712	4052	avscan.exe	REG.exe
PID 1900 wrote to memory of 3956	1900	hosts.exe	REG.exe
PID 1900 wrote to memory of 3956	1900	hosts.exe	REG.exe
PID 1900 wrote to memory of 3956	1900	hosts.exe	REG.exe
PID 1900 wrote to memory of 1336	1900	hosts.exe	REG.exe
PID 1900 wrote to memory of 1336	1900	hosts.exe	REG.exe
PID 1900 wrote to memory of 1336	1900	hosts.exe	REG.exe
PID 4052 wrote to memory of 4760	4052	avscan.exe	REG.exe
PID 4052 wrote to memory of 4760	4052	avscan.exe	REG.exe
PID 4052 wrote to memory of 4760	4052	avscan.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe
"C:\Users\Admin\AppData\Local\Temp\1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:4732

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1256

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4416

C:\windows\hosts.exe
C:\windows\hosts.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3932

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
6⤵
- Adds policy Run key to start application
PID:4616

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:2672

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:3996

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:3956

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:1336

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:4256

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:3736

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:1960

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4712

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3272

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3332

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:3452

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
f7bfd2cf196edb2c82603acb22813d3e

SHA1
fada46efde35c6796e387fff1beb679eef021962

SHA256
e6a507687d0a64d48d12fada462a3b3ab059d0c097bb596f78a39679844e1a79

SHA512
84fc475a6e9488215948bbe3c718d58d7286e1d3c4dfde5f82fcceef21a815d2d862cdd1fe8460cd967873fd7878491158c5d10cb01e008c6390da0846f5ae2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
f7bfd2cf196edb2c82603acb22813d3e

SHA1
fada46efde35c6796e387fff1beb679eef021962

SHA256
e6a507687d0a64d48d12fada462a3b3ab059d0c097bb596f78a39679844e1a79

SHA512
84fc475a6e9488215948bbe3c718d58d7286e1d3c4dfde5f82fcceef21a815d2d862cdd1fe8460cd967873fd7878491158c5d10cb01e008c6390da0846f5ae2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
f7bfd2cf196edb2c82603acb22813d3e

SHA1
fada46efde35c6796e387fff1beb679eef021962

SHA256
e6a507687d0a64d48d12fada462a3b3ab059d0c097bb596f78a39679844e1a79

SHA512
84fc475a6e9488215948bbe3c718d58d7286e1d3c4dfde5f82fcceef21a815d2d862cdd1fe8460cd967873fd7878491158c5d10cb01e008c6390da0846f5ae2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
f7bfd2cf196edb2c82603acb22813d3e

SHA1
fada46efde35c6796e387fff1beb679eef021962

SHA256
e6a507687d0a64d48d12fada462a3b3ab059d0c097bb596f78a39679844e1a79

SHA512
84fc475a6e9488215948bbe3c718d58d7286e1d3c4dfde5f82fcceef21a815d2d862cdd1fe8460cd967873fd7878491158c5d10cb01e008c6390da0846f5ae2d

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
5b87381bf407d7c6018a8b11c3e20f92

SHA1
bb61b28d9c8fd7dfeb13a397c49a1be3abc06ca2

SHA256
4785d6a229d0872fe90c75ab620de9a680d7f07ccd27a134da2afc4ee88f34f3

SHA512
05db1178f671e9d6c3a1c601349093447b04ebddcd071a06f7cc92cbaf7efb53027bc92523a19372a08ca5af715cc9955649255f8be1909b5e594385b3dcbe3d

Download Submit
C:\Windows\hosts.exe

Filesize
182KB

MD5
6632aa4d7c3ce1b06e745b278c63c62d

SHA1
da06a135f356295d1701af7baccb7135762438f4

SHA256
173a6c770542b2412246eed44183f141b73a13ec57b555a59d3d1151db5b7a85

SHA512
d15c1f2ceedd3ca59a60b54b4594d7a169d68c2cd9a78e6ce0e6457ea427d306c9552fff5ecfad6dc01487199ece151d181b97a36a48da701177d98bb1a76510

Download Submit
C:\Windows\hosts.exe

Filesize
182KB

MD5
6632aa4d7c3ce1b06e745b278c63c62d

SHA1
da06a135f356295d1701af7baccb7135762438f4

SHA256
173a6c770542b2412246eed44183f141b73a13ec57b555a59d3d1151db5b7a85

SHA512
d15c1f2ceedd3ca59a60b54b4594d7a169d68c2cd9a78e6ce0e6457ea427d306c9552fff5ecfad6dc01487199ece151d181b97a36a48da701177d98bb1a76510

Download Submit
C:\Windows\hosts.exe

Filesize
182KB

MD5
6632aa4d7c3ce1b06e745b278c63c62d

SHA1
da06a135f356295d1701af7baccb7135762438f4

SHA256
173a6c770542b2412246eed44183f141b73a13ec57b555a59d3d1151db5b7a85

SHA512
d15c1f2ceedd3ca59a60b54b4594d7a169d68c2cd9a78e6ce0e6457ea427d306c9552fff5ecfad6dc01487199ece151d181b97a36a48da701177d98bb1a76510

Download Submit
C:\Windows\hosts.exe

Filesize
182KB

MD5
6632aa4d7c3ce1b06e745b278c63c62d

SHA1
da06a135f356295d1701af7baccb7135762438f4

SHA256
173a6c770542b2412246eed44183f141b73a13ec57b555a59d3d1151db5b7a85

SHA512
d15c1f2ceedd3ca59a60b54b4594d7a169d68c2cd9a78e6ce0e6457ea427d306c9552fff5ecfad6dc01487199ece151d181b97a36a48da701177d98bb1a76510

Download Submit
C:\windows\hosts.exe

Filesize
182KB

MD5
6632aa4d7c3ce1b06e745b278c63c62d

SHA1
da06a135f356295d1701af7baccb7135762438f4

SHA256
173a6c770542b2412246eed44183f141b73a13ec57b555a59d3d1151db5b7a85

SHA512
d15c1f2ceedd3ca59a60b54b4594d7a169d68c2cd9a78e6ce0e6457ea427d306c9552fff5ecfad6dc01487199ece151d181b97a36a48da701177d98bb1a76510

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/1256-145-0x0000000000000000-mapping.dmp

Download
memory/1336-176-0x0000000000000000-mapping.dmp

Download
memory/1900-148-0x0000000000000000-mapping.dmp

Download
memory/1960-172-0x0000000000000000-mapping.dmp

Download
memory/2032-141-0x0000000000000000-mapping.dmp

Download
memory/2672-171-0x0000000000000000-mapping.dmp

Download
memory/3272-146-0x0000000000000000-mapping.dmp

Download
memory/3332-151-0x0000000000000000-mapping.dmp

Download
memory/3452-168-0x0000000000000000-mapping.dmp

Download
memory/3736-170-0x0000000000000000-mapping.dmp

Download
memory/3932-163-0x0000000000000000-mapping.dmp

Download
memory/3956-175-0x0000000000000000-mapping.dmp

Download
memory/3996-173-0x0000000000000000-mapping.dmp

Download
memory/4052-135-0x0000000000000000-mapping.dmp

Download
memory/4256-167-0x0000000000000000-mapping.dmp

Download
memory/4416-162-0x0000000000000000-mapping.dmp

Download
memory/4616-169-0x0000000000000000-mapping.dmp

Download
memory/4712-174-0x0000000000000000-mapping.dmp

Download
memory/4732-134-0x0000000000000000-mapping.dmp

Download
memory/4760-177-0x0000000000000000-mapping.dmp

Download
memory/4868-157-0x0000000000000000-mapping.dmp

Download