abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
Size

2.6MB
MD5

ae8bbde35ae59e3f26f0deb76d3b6918
SHA1

54dd77953b08d22ba8427df84318a8441e3bc8b2
SHA256

abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679
SHA512

1b05a9b126f816e2d7fcd003f9a310296a574b54cb14c34d0f800ad2321fb04561a896926ea3a62308a29647bd3b5df06c631379ac0ea266c9a614e4d35fc7d4
SSDEEP

49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7yb:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmDp

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WIJBFSKT = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WIJBFSKT = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WIJBFSKT = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

216 avscan.exe
1648 avscan.exe
996 hosts.exe
2224 hosts.exe
4964 avscan.exe
4380 hosts.exe

pid	process
216	avscan.exe
1648	avscan.exe
996	hosts.exe
2224	hosts.exe
4964	avscan.exe
4380	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.execmd.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exeavscan.exehosts.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

Processes:

abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exeavscan.exehosts.exe

description	ioc	process
File opened for modification	C:\Windows\hosts.exe	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
File created	\??\c:\windows\W_X_C.bat	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.execmd.execmd.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

2616 REG.exe
4448 REG.exe
2460 REG.exe
2348 REG.exe
3776 REG.exe
1396 REG.exe
2896 REG.exe
4348 REG.exe
4520 REG.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

avscan.exehosts.exe

pid process

216 avscan.exe
996 hosts.exe

pid	process
2616	REG.exe
4448	REG.exe
2460	REG.exe
2348	REG.exe
3776	REG.exe
1396	REG.exe
2896	REG.exe
4348	REG.exe
4520	REG.exe

pid	process
216	avscan.exe
996	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exeavscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid	process
1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
216	avscan.exe
1648	avscan.exe
996	hosts.exe
2224	hosts.exe
4964	avscan.exe
4380	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exeavscan.execmd.execmd.exehosts.execmd.exe

description	pid	process	target process
PID 1912 wrote to memory of 2616	1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe	REG.exe
PID 1912 wrote to memory of 2616	1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe	REG.exe
PID 1912 wrote to memory of 2616	1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe	REG.exe
PID 1912 wrote to memory of 216	1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe	avscan.exe
PID 1912 wrote to memory of 216	1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe	avscan.exe
PID 1912 wrote to memory of 216	1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe	avscan.exe
PID 216 wrote to memory of 1648	216	avscan.exe	avscan.exe
PID 216 wrote to memory of 1648	216	avscan.exe	avscan.exe
PID 216 wrote to memory of 1648	216	avscan.exe	avscan.exe
PID 216 wrote to memory of 3820	216	avscan.exe	cmd.exe
PID 216 wrote to memory of 3820	216	avscan.exe	cmd.exe
PID 216 wrote to memory of 3820	216	avscan.exe	cmd.exe
PID 1912 wrote to memory of 3628	1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe	cmd.exe
PID 1912 wrote to memory of 3628	1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe	cmd.exe
PID 1912 wrote to memory of 3628	1912	abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe	cmd.exe
PID 3628 wrote to memory of 2224	3628	cmd.exe	hosts.exe
PID 3628 wrote to memory of 2224	3628	cmd.exe	hosts.exe
PID 3628 wrote to memory of 2224	3628	cmd.exe	hosts.exe
PID 3820 wrote to memory of 996	3820	cmd.exe	hosts.exe
PID 3820 wrote to memory of 996	3820	cmd.exe	hosts.exe
PID 3820 wrote to memory of 996	3820	cmd.exe	hosts.exe
PID 996 wrote to memory of 4964	996	hosts.exe	avscan.exe
PID 996 wrote to memory of 4964	996	hosts.exe	avscan.exe
PID 996 wrote to memory of 4964	996	hosts.exe	avscan.exe
PID 996 wrote to memory of 408	996	hosts.exe	cmd.exe
PID 996 wrote to memory of 408	996	hosts.exe	cmd.exe
PID 996 wrote to memory of 408	996	hosts.exe	cmd.exe
PID 408 wrote to memory of 4380	408	cmd.exe	hosts.exe
PID 408 wrote to memory of 4380	408	cmd.exe	hosts.exe
PID 408 wrote to memory of 4380	408	cmd.exe	hosts.exe
PID 3820 wrote to memory of 3680	3820	cmd.exe	WScript.exe
PID 3628 wrote to memory of 3168	3628	cmd.exe	WScript.exe
PID 3820 wrote to memory of 3680	3820	cmd.exe	WScript.exe
PID 3820 wrote to memory of 3680	3820	cmd.exe	WScript.exe
PID 3628 wrote to memory of 3168	3628	cmd.exe	WScript.exe
PID 3628 wrote to memory of 3168	3628	cmd.exe	WScript.exe
PID 408 wrote to memory of 4040	408	cmd.exe	WScript.exe
PID 408 wrote to memory of 4040	408	cmd.exe	WScript.exe
PID 408 wrote to memory of 4040	408	cmd.exe	WScript.exe
PID 216 wrote to memory of 4448	216	avscan.exe	REG.exe
PID 216 wrote to memory of 4448	216	avscan.exe	REG.exe
PID 216 wrote to memory of 4448	216	avscan.exe	REG.exe
PID 996 wrote to memory of 2460	996	hosts.exe	REG.exe
PID 996 wrote to memory of 2460	996	hosts.exe	REG.exe
PID 996 wrote to memory of 2460	996	hosts.exe	REG.exe
PID 216 wrote to memory of 3776	216	avscan.exe	REG.exe
PID 216 wrote to memory of 3776	216	avscan.exe	REG.exe
PID 216 wrote to memory of 3776	216	avscan.exe	REG.exe
PID 996 wrote to memory of 2348	996	hosts.exe	REG.exe
PID 996 wrote to memory of 2348	996	hosts.exe	REG.exe
PID 996 wrote to memory of 2348	996	hosts.exe	REG.exe
PID 996 wrote to memory of 1396	996	hosts.exe	REG.exe
PID 996 wrote to memory of 1396	996	hosts.exe	REG.exe
PID 996 wrote to memory of 1396	996	hosts.exe	REG.exe
PID 216 wrote to memory of 4348	216	avscan.exe	REG.exe
PID 216 wrote to memory of 4348	216	avscan.exe	REG.exe
PID 216 wrote to memory of 4348	216	avscan.exe	REG.exe
PID 996 wrote to memory of 2896	996	hosts.exe	REG.exe
PID 996 wrote to memory of 2896	996	hosts.exe	REG.exe
PID 996 wrote to memory of 2896	996	hosts.exe	REG.exe
PID 216 wrote to memory of 4520	216	avscan.exe	REG.exe
PID 216 wrote to memory of 4520	216	avscan.exe	REG.exe
PID 216 wrote to memory of 4520	216	avscan.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
"C:\Users\Admin\AppData\Local\Temp\abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:2616

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3820

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:408

C:\windows\hosts.exe
C:\windows\hosts.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4380

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
6⤵
- Adds policy Run key to start application
PID:4040

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:2460

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:2348

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:1396

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:2896

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:3680

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4448

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:3776

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4348

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4520

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3628

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2224

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:3168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
2.6MB

MD5
42ba43ab13ee8881cd5a4373016e75fa

SHA1
36165f834e36578bface866608b7841ec73a98b8

SHA256
5b49d3990abe8e1788905577df2f49868ef0c9a4c1d97b87a536d012a63bd851

SHA512
0429f7c916a9373f715bf38b63bf37cfefe96e7f22b9618ea7f09b69a1fc5050c82cc456590bd617d13bb193432e840cbd38a134e82d98ae65a56a004a41a03c

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
2.6MB

MD5
42ba43ab13ee8881cd5a4373016e75fa

SHA1
36165f834e36578bface866608b7841ec73a98b8

SHA256
5b49d3990abe8e1788905577df2f49868ef0c9a4c1d97b87a536d012a63bd851

SHA512
0429f7c916a9373f715bf38b63bf37cfefe96e7f22b9618ea7f09b69a1fc5050c82cc456590bd617d13bb193432e840cbd38a134e82d98ae65a56a004a41a03c

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
2.6MB

MD5
42ba43ab13ee8881cd5a4373016e75fa

SHA1
36165f834e36578bface866608b7841ec73a98b8

SHA256
5b49d3990abe8e1788905577df2f49868ef0c9a4c1d97b87a536d012a63bd851

SHA512
0429f7c916a9373f715bf38b63bf37cfefe96e7f22b9618ea7f09b69a1fc5050c82cc456590bd617d13bb193432e840cbd38a134e82d98ae65a56a004a41a03c

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
2.6MB

MD5
42ba43ab13ee8881cd5a4373016e75fa

SHA1
36165f834e36578bface866608b7841ec73a98b8

SHA256
5b49d3990abe8e1788905577df2f49868ef0c9a4c1d97b87a536d012a63bd851

SHA512
0429f7c916a9373f715bf38b63bf37cfefe96e7f22b9618ea7f09b69a1fc5050c82cc456590bd617d13bb193432e840cbd38a134e82d98ae65a56a004a41a03c

Download Submit
C:\Windows\W_X_C.vbs
Filesize
195B

MD5
5f95187376125e68821db0d42b6e0a01

SHA1
24db87fd4f2e71873b08b285de3f584ed606bd7d

SHA256
f77ac566569872134310abf6755aaf712f96ddf7e544cd73fa03555415676777

SHA512
cecd0b1ab60ed7471870c6b5bb90d65b2e833d535f9a91aea96aae50a86e17fb15f23cd49da74d3ab6d50e54de75e02d9727d9b1d9ec2c32e3b80a4183c0a31c

Download Submit
C:\Windows\hosts.exe
Filesize
2.6MB

MD5
3adcd6fdf4df907a4fe6971951dc717f

SHA1
aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e

SHA256
8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5

SHA512
9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942

Download Submit
C:\Windows\hosts.exe
Filesize
2.6MB

MD5
3adcd6fdf4df907a4fe6971951dc717f

SHA1
aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e

SHA256
8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5

SHA512
9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942

Download Submit
C:\Windows\hosts.exe
Filesize
2.6MB

MD5
3adcd6fdf4df907a4fe6971951dc717f

SHA1
aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e

SHA256
8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5

SHA512
9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942

Download Submit
C:\Windows\hosts.exe
Filesize
2.6MB

MD5
3adcd6fdf4df907a4fe6971951dc717f

SHA1
aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e

SHA256
8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5

SHA512
9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942

Download Submit
C:\windows\hosts.exe
Filesize
2.6MB

MD5
3adcd6fdf4df907a4fe6971951dc717f

SHA1
aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e

SHA256
8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5

SHA512
9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942

Download Submit
\??\c:\windows\W_X_C.bat
Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/216-135-0x0000000000000000-mapping.dmp

Download
memory/408-161-0x0000000000000000-mapping.dmp

Download
memory/996-149-0x0000000000000000-mapping.dmp

Download
memory/1396-174-0x0000000000000000-mapping.dmp

Download
memory/1648-141-0x0000000000000000-mapping.dmp

Download
memory/2224-148-0x0000000000000000-mapping.dmp

Download
memory/2348-173-0x0000000000000000-mapping.dmp

Download
memory/2460-171-0x0000000000000000-mapping.dmp

Download
memory/2616-134-0x0000000000000000-mapping.dmp

Download
memory/2896-176-0x0000000000000000-mapping.dmp

Download
memory/3168-166-0x0000000000000000-mapping.dmp

Download
memory/3628-146-0x0000000000000000-mapping.dmp

Download
memory/3680-165-0x0000000000000000-mapping.dmp

Download
memory/3776-172-0x0000000000000000-mapping.dmp

Download
memory/3820-145-0x0000000000000000-mapping.dmp

Download
memory/4040-169-0x0000000000000000-mapping.dmp

Download
memory/4348-175-0x0000000000000000-mapping.dmp

Download
memory/4380-163-0x0000000000000000-mapping.dmp

Download
memory/4448-170-0x0000000000000000-mapping.dmp

Download
memory/4520-177-0x0000000000000000-mapping.dmp

Download
memory/4964-157-0x0000000000000000-mapping.dmp

Download