0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
Size

169KB
MD5

2599b6a960521a31e699d7be199fa13b
SHA1

14d7fdc40271c2e29742b677ff17c1601e0f9add
SHA256

0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1
SHA512

81fbde0213fc1ddb4b262b41670bf9bd9e40b0a6d50919efcdee3985c50d1d095a4d2d5687ce5c0a97d6776a4294da6824733f6ee3d5137ac2f2aab8909a8a21
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DERzU3B:gDCwfG1bnxLERI

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

4800 avscan.exe
4260 avscan.exe
4092 hosts.exe
100 hosts.exe
4824 avscan.exe
4452 hosts.exe

pid	process
4800	avscan.exe
4260	avscan.exe
4092	hosts.exe
100	hosts.exe
4824	avscan.exe
4452	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.execmd.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hosts.exe0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exeavscan.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

Processes:

0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exeavscan.exehosts.exe

description	ioc	process
File created	\??\c:\windows\W_X_C.bat	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
File opened for modification	C:\Windows\hosts.exe	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

cmd.execmd.execmd.exe0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

4572 REG.exe
432 REG.exe
3932 REG.exe
2432 REG.exe
540 REG.exe
1424 REG.exe
4656 REG.exe
Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exeavscan.exehosts.exe

pid process

4320 0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
4800 avscan.exe
4092 hosts.exe

pid	process
4572	REG.exe
432	REG.exe
3932	REG.exe
2432	REG.exe
540	REG.exe
1424	REG.exe
4656	REG.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exeavscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid	process
4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
4800	avscan.exe
4260	avscan.exe
4092	hosts.exe
100	hosts.exe
4824	avscan.exe
4452	hosts.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exeavscan.execmd.execmd.exehosts.execmd.exe

description	pid	process	target process
PID 4320 wrote to memory of 2432	4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe	REG.exe
PID 4320 wrote to memory of 2432	4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe	REG.exe
PID 4320 wrote to memory of 2432	4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe	REG.exe
PID 4320 wrote to memory of 4800	4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe	avscan.exe
PID 4320 wrote to memory of 4800	4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe	avscan.exe
PID 4320 wrote to memory of 4800	4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe	avscan.exe
PID 4800 wrote to memory of 4260	4800	avscan.exe	avscan.exe
PID 4800 wrote to memory of 4260	4800	avscan.exe	avscan.exe
PID 4800 wrote to memory of 4260	4800	avscan.exe	avscan.exe
PID 4800 wrote to memory of 1460	4800	avscan.exe	cmd.exe
PID 4800 wrote to memory of 1460	4800	avscan.exe	cmd.exe
PID 4800 wrote to memory of 1460	4800	avscan.exe	cmd.exe
PID 4320 wrote to memory of 1400	4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe	cmd.exe
PID 4320 wrote to memory of 1400	4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe	cmd.exe
PID 4320 wrote to memory of 1400	4320	0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe	cmd.exe
PID 1460 wrote to memory of 4092	1460	cmd.exe	hosts.exe
PID 1460 wrote to memory of 4092	1460	cmd.exe	hosts.exe
PID 1460 wrote to memory of 4092	1460	cmd.exe	hosts.exe
PID 1400 wrote to memory of 100	1400	cmd.exe	hosts.exe
PID 1400 wrote to memory of 100	1400	cmd.exe	hosts.exe
PID 1400 wrote to memory of 100	1400	cmd.exe	hosts.exe
PID 4092 wrote to memory of 4824	4092	hosts.exe	avscan.exe
PID 4092 wrote to memory of 4824	4092	hosts.exe	avscan.exe
PID 4092 wrote to memory of 4824	4092	hosts.exe	avscan.exe
PID 4092 wrote to memory of 3860	4092	hosts.exe	cmd.exe
PID 4092 wrote to memory of 3860	4092	hosts.exe	cmd.exe
PID 4092 wrote to memory of 3860	4092	hosts.exe	cmd.exe
PID 3860 wrote to memory of 4452	3860	cmd.exe	hosts.exe
PID 3860 wrote to memory of 4452	3860	cmd.exe	hosts.exe
PID 3860 wrote to memory of 4452	3860	cmd.exe	hosts.exe
PID 1400 wrote to memory of 620	1400	cmd.exe	WScript.exe
PID 1400 wrote to memory of 620	1400	cmd.exe	WScript.exe
PID 1400 wrote to memory of 620	1400	cmd.exe	WScript.exe
PID 3860 wrote to memory of 4532	3860	cmd.exe	WScript.exe
PID 3860 wrote to memory of 4532	3860	cmd.exe	WScript.exe
PID 3860 wrote to memory of 4532	3860	cmd.exe	WScript.exe
PID 1460 wrote to memory of 3176	1460	cmd.exe	WScript.exe
PID 1460 wrote to memory of 3176	1460	cmd.exe	WScript.exe
PID 1460 wrote to memory of 3176	1460	cmd.exe	WScript.exe
PID 4800 wrote to memory of 540	4800	avscan.exe	REG.exe
PID 4800 wrote to memory of 540	4800	avscan.exe	REG.exe
PID 4800 wrote to memory of 540	4800	avscan.exe	REG.exe
PID 4092 wrote to memory of 1424	4092	hosts.exe	REG.exe
PID 4092 wrote to memory of 1424	4092	hosts.exe	REG.exe
PID 4092 wrote to memory of 1424	4092	hosts.exe	REG.exe
PID 4092 wrote to memory of 4572	4092	hosts.exe	REG.exe
PID 4092 wrote to memory of 4572	4092	hosts.exe	REG.exe
PID 4092 wrote to memory of 4572	4092	hosts.exe	REG.exe
PID 4800 wrote to memory of 4656	4800	avscan.exe	REG.exe
PID 4800 wrote to memory of 4656	4800	avscan.exe	REG.exe
PID 4800 wrote to memory of 4656	4800	avscan.exe	REG.exe
PID 4800 wrote to memory of 3932	4800	avscan.exe	REG.exe
PID 4800 wrote to memory of 3932	4800	avscan.exe	REG.exe
PID 4800 wrote to memory of 3932	4800	avscan.exe	REG.exe
PID 4092 wrote to memory of 432	4092	hosts.exe	REG.exe
PID 4092 wrote to memory of 432	4092	hosts.exe	REG.exe
PID 4092 wrote to memory of 432	4092	hosts.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe
"C:\Users\Admin\AppData\Local\Temp\0bcfe293546a8fcb666ba389bb0b9ac7eca8ebba077cc067ef8678921c2213b1.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:2432

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1460

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3860

C:\windows\hosts.exe
C:\windows\hosts.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
6⤵
- Adds policy Run key to start application
PID:4532

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:1424

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:4572

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:432

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:3176

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:540

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4656

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:3932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1400

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:100

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
169KB

MD5
90a28ff35fbc726475027934535508cb

SHA1
d6f5d52ff7ee6bfbbced68724755a0791e9c563e

SHA256
088124276a2161922a2777810c48e251de6ff94267e2494c3039c232b777b0d4

SHA512
9b7c4dcd7b897f739266c9b1fd76149b1d4b537896186c8d6a865f81637fc2d90049e8223c02619a2e64ec5902aad719a98ad6d6e7f454e2d24396566893faf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
169KB

MD5
90a28ff35fbc726475027934535508cb

SHA1
d6f5d52ff7ee6bfbbced68724755a0791e9c563e

SHA256
088124276a2161922a2777810c48e251de6ff94267e2494c3039c232b777b0d4

SHA512
9b7c4dcd7b897f739266c9b1fd76149b1d4b537896186c8d6a865f81637fc2d90049e8223c02619a2e64ec5902aad719a98ad6d6e7f454e2d24396566893faf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
169KB

MD5
90a28ff35fbc726475027934535508cb

SHA1
d6f5d52ff7ee6bfbbced68724755a0791e9c563e

SHA256
088124276a2161922a2777810c48e251de6ff94267e2494c3039c232b777b0d4

SHA512
9b7c4dcd7b897f739266c9b1fd76149b1d4b537896186c8d6a865f81637fc2d90049e8223c02619a2e64ec5902aad719a98ad6d6e7f454e2d24396566893faf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
169KB

MD5
90a28ff35fbc726475027934535508cb

SHA1
d6f5d52ff7ee6bfbbced68724755a0791e9c563e

SHA256
088124276a2161922a2777810c48e251de6ff94267e2494c3039c232b777b0d4

SHA512
9b7c4dcd7b897f739266c9b1fd76149b1d4b537896186c8d6a865f81637fc2d90049e8223c02619a2e64ec5902aad719a98ad6d6e7f454e2d24396566893faf6

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
5b87381bf407d7c6018a8b11c3e20f92

SHA1
bb61b28d9c8fd7dfeb13a397c49a1be3abc06ca2

SHA256
4785d6a229d0872fe90c75ab620de9a680d7f07ccd27a134da2afc4ee88f34f3

SHA512
05db1178f671e9d6c3a1c601349093447b04ebddcd071a06f7cc92cbaf7efb53027bc92523a19372a08ca5af715cc9955649255f8be1909b5e594385b3dcbe3d

Download Submit
C:\Windows\hosts.exe

Filesize
169KB

MD5
7cc265588c19ba9bbb2c66f76b0b645f

SHA1
937aa02d4d385f7074a78095133900c703135076

SHA256
9b7b419d08c726532d9cb895ec0a61f2ae590f47102a991730f1931cee3ffb4c

SHA512
72c377be678ca0516f7d5bb6dfac729bf5ff3842f92237dcae6d7a233fd31ea184c68ebdb03869f58fb1779c54e8912bff91e20d22dbfe649cc756e7d2587d53

Download Submit
C:\Windows\hosts.exe

Filesize
169KB

MD5
7cc265588c19ba9bbb2c66f76b0b645f

SHA1
937aa02d4d385f7074a78095133900c703135076

SHA256
9b7b419d08c726532d9cb895ec0a61f2ae590f47102a991730f1931cee3ffb4c

SHA512
72c377be678ca0516f7d5bb6dfac729bf5ff3842f92237dcae6d7a233fd31ea184c68ebdb03869f58fb1779c54e8912bff91e20d22dbfe649cc756e7d2587d53

Download Submit
C:\Windows\hosts.exe

Filesize
169KB

MD5
7cc265588c19ba9bbb2c66f76b0b645f

SHA1
937aa02d4d385f7074a78095133900c703135076

SHA256
9b7b419d08c726532d9cb895ec0a61f2ae590f47102a991730f1931cee3ffb4c

SHA512
72c377be678ca0516f7d5bb6dfac729bf5ff3842f92237dcae6d7a233fd31ea184c68ebdb03869f58fb1779c54e8912bff91e20d22dbfe649cc756e7d2587d53

Download Submit
C:\Windows\hosts.exe

Filesize
169KB

MD5
7cc265588c19ba9bbb2c66f76b0b645f

SHA1
937aa02d4d385f7074a78095133900c703135076

SHA256
9b7b419d08c726532d9cb895ec0a61f2ae590f47102a991730f1931cee3ffb4c

SHA512
72c377be678ca0516f7d5bb6dfac729bf5ff3842f92237dcae6d7a233fd31ea184c68ebdb03869f58fb1779c54e8912bff91e20d22dbfe649cc756e7d2587d53

Download Submit
C:\windows\hosts.exe

Filesize
169KB

MD5
7cc265588c19ba9bbb2c66f76b0b645f

SHA1
937aa02d4d385f7074a78095133900c703135076

SHA256
9b7b419d08c726532d9cb895ec0a61f2ae590f47102a991730f1931cee3ffb4c

SHA512
72c377be678ca0516f7d5bb6dfac729bf5ff3842f92237dcae6d7a233fd31ea184c68ebdb03869f58fb1779c54e8912bff91e20d22dbfe649cc756e7d2587d53

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/100-149-0x0000000000000000-mapping.dmp

Download
memory/432-175-0x0000000000000000-mapping.dmp

Download
memory/540-170-0x0000000000000000-mapping.dmp

Download
memory/620-169-0x0000000000000000-mapping.dmp

Download
memory/1400-146-0x0000000000000000-mapping.dmp

Download
memory/1424-171-0x0000000000000000-mapping.dmp

Download
memory/1460-145-0x0000000000000000-mapping.dmp

Download
memory/2432-134-0x0000000000000000-mapping.dmp

Download
memory/3176-168-0x0000000000000000-mapping.dmp

Download
memory/3860-161-0x0000000000000000-mapping.dmp

Download
memory/3932-174-0x0000000000000000-mapping.dmp

Download
memory/4092-148-0x0000000000000000-mapping.dmp

Download
memory/4260-141-0x0000000000000000-mapping.dmp

Download
memory/4452-163-0x0000000000000000-mapping.dmp

Download
memory/4532-167-0x0000000000000000-mapping.dmp

Download
memory/4572-172-0x0000000000000000-mapping.dmp

Download
memory/4656-173-0x0000000000000000-mapping.dmp

Download
memory/4800-135-0x0000000000000000-mapping.dmp

Download
memory/4824-156-0x0000000000000000-mapping.dmp

Download