1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e

Analysis

max time kernel
243s
max time network
352s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
Size

1.3MB
MD5

8a6a9dd67063c9098447da6fa53a1f13
SHA1

36238cb4ea92b462707328ad5dc72a495007534b
SHA256

1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e
SHA512

6d1b078bf9e61ac73b79c03a1cfce776f9a6b2a9e1a7be81230846da4e879d0c9cbcc562e98985a12da4ee3825e10094b457d02de3d469aa9bd2ed0e82b0c143
SSDEEP

24576:K7Ls6itoOW2mLc3cvu7jWk7cj8L5SiS+AmxAvkGuAsQCi+2GmR2ka:KXGFLmLc34cJL5NfAxTnsQCKBUka

Score

10^/10

agilenet evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hknswc.exe

Executes dropped EXE 4 IoCs

pid	Process
1792	AppMgnt.exe
304	hknswc.exe
1400	AppMgnt.exe
1768	AppMgnt.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
1536	attrib.exe

Loads dropped DLL 2 IoCs

pid	Process
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
1792	AppMgnt.exe

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/files/0x000b0000000122f2-81.dat	agile_net
behavioral1/files/0x000b0000000122f2-80.dat	agile_net
behavioral1/files/0x000b0000000122f2-83.dat	agile_net

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	myip.dnsomatic.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 568 set thread context of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 304 set thread context of 1064	304	hknswc.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1304	schtasks.exe
844	schtasks.exe
964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
1792	AppMgnt.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
304	hknswc.exe
1768	AppMgnt.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
1400	AppMgnt.exe
304	hknswc.exe
1768	AppMgnt.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
1400	AppMgnt.exe
304	hknswc.exe
1768	AppMgnt.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
1400	AppMgnt.exe
304	hknswc.exe
1768	AppMgnt.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
1400	AppMgnt.exe
304	hknswc.exe
1768	AppMgnt.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
1400	AppMgnt.exe
304	hknswc.exe
1768	AppMgnt.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
1400	AppMgnt.exe
304	hknswc.exe
1768	AppMgnt.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
1400	AppMgnt.exe
304	hknswc.exe
1768	AppMgnt.exe
568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
Token: SeDebugPrivilege	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
Token: SeDebugPrivilege	1792	AppMgnt.exe
Token: SeDebugPrivilege	304	hknswc.exe
Token: SeDebugPrivilege	304	hknswc.exe
Token: SeDebugPrivilege	1768	AppMgnt.exe
Token: SeDebugPrivilege	1400	AppMgnt.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1524	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	28
PID 568 wrote to memory of 1792	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	29
PID 568 wrote to memory of 1792	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	29
PID 568 wrote to memory of 1792	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	29
PID 568 wrote to memory of 1792	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	29
PID 1792 wrote to memory of 1304	1792	AppMgnt.exe	30
PID 1792 wrote to memory of 1304	1792	AppMgnt.exe	30
PID 1792 wrote to memory of 1304	1792	AppMgnt.exe	30
PID 1792 wrote to memory of 1304	1792	AppMgnt.exe	30
PID 1792 wrote to memory of 304	1792	AppMgnt.exe	32
PID 1792 wrote to memory of 304	1792	AppMgnt.exe	32
PID 1792 wrote to memory of 304	1792	AppMgnt.exe	32
PID 1792 wrote to memory of 304	1792	AppMgnt.exe	32
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 304 wrote to memory of 1064	304	hknswc.exe	33
PID 568 wrote to memory of 1400	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	34
PID 568 wrote to memory of 1400	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	34
PID 568 wrote to memory of 1400	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	34
PID 568 wrote to memory of 1400	568	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe	34
PID 304 wrote to memory of 1768	304	hknswc.exe	35
PID 304 wrote to memory of 1768	304	hknswc.exe	35
PID 304 wrote to memory of 1768	304	hknswc.exe	35
PID 304 wrote to memory of 1768	304	hknswc.exe	35
PID 1768 wrote to memory of 844	1768	AppMgnt.exe	36
PID 1768 wrote to memory of 844	1768	AppMgnt.exe	36
PID 1768 wrote to memory of 844	1768	AppMgnt.exe	36
PID 1768 wrote to memory of 844	1768	AppMgnt.exe	36
PID 1400 wrote to memory of 964	1400	AppMgnt.exe	38
PID 1400 wrote to memory of 964	1400	AppMgnt.exe	38
PID 1400 wrote to memory of 964	1400	AppMgnt.exe	38
PID 1400 wrote to memory of 964	1400	AppMgnt.exe	38
PID 1524 wrote to memory of 1920	1524	vbc.exe	42
PID 1524 wrote to memory of 1920	1524	vbc.exe	42
PID 1524 wrote to memory of 1920	1524	vbc.exe	42
PID 1524 wrote to memory of 1920	1524	vbc.exe	42
PID 1920 wrote to memory of 1060	1920	WScript.exe	43
PID 1920 wrote to memory of 1060	1920	WScript.exe	43
PID 1920 wrote to memory of 1060	1920	WScript.exe	43
PID 1920 wrote to memory of 1060	1920	WScript.exe	43
PID 1060 wrote to memory of 1536	1060	cmd.exe	45
PID 1060 wrote to memory of 1536	1060	cmd.exe	45
PID 1060 wrote to memory of 1536	1060	cmd.exe	45
PID 1060 wrote to memory of 1536	1060	cmd.exe	45

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hknswc.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1536	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe
"C:\Users\Admin\AppData\Local\Temp\1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:568
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1060
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\RealNetowrks
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1536
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /SC ONLOGON /TN PolicyManager /TR C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1304
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:304
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      4⤵
      PID:1064
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /SC ONLOGON /TN PolicyManager /TR C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:844
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /SC ONLOGON /TN PolicyManager /TR C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe

Filesize
8KB

MD5
07870aab1c5ab63cfeaa3c396ebaac51

SHA1
b3789bc78eb3345af6899f331aded871bd4a27e9

SHA256
feae74003448e0a27cd5e1e9087f54c8a558ad2ae2ce3d04382860ef19081323

SHA512
ae96ab7119784132a6e9fd49312a6ffe53b89504fea72d7618f143b0b432c08f1cc6836367af0fd878873d4ffc8b4356d6f66eea2007cdefba90ff1202d5e7f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe

Filesize
8KB

MD5
07870aab1c5ab63cfeaa3c396ebaac51

SHA1
b3789bc78eb3345af6899f331aded871bd4a27e9

SHA256
feae74003448e0a27cd5e1e9087f54c8a558ad2ae2ce3d04382860ef19081323

SHA512
ae96ab7119784132a6e9fd49312a6ffe53b89504fea72d7618f143b0b432c08f1cc6836367af0fd878873d4ffc8b4356d6f66eea2007cdefba90ff1202d5e7f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe

Filesize
8KB

MD5
07870aab1c5ab63cfeaa3c396ebaac51

SHA1
b3789bc78eb3345af6899f331aded871bd4a27e9

SHA256
feae74003448e0a27cd5e1e9087f54c8a558ad2ae2ce3d04382860ef19081323

SHA512
ae96ab7119784132a6e9fd49312a6ffe53b89504fea72d7618f143b0b432c08f1cc6836367af0fd878873d4ffc8b4356d6f66eea2007cdefba90ff1202d5e7f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe

Filesize
8KB

MD5
07870aab1c5ab63cfeaa3c396ebaac51

SHA1
b3789bc78eb3345af6899f331aded871bd4a27e9

SHA256
feae74003448e0a27cd5e1e9087f54c8a558ad2ae2ce3d04382860ef19081323

SHA512
ae96ab7119784132a6e9fd49312a6ffe53b89504fea72d7618f143b0b432c08f1cc6836367af0fd878873d4ffc8b4356d6f66eea2007cdefba90ff1202d5e7f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe

Filesize
1.3MB

MD5
8a6a9dd67063c9098447da6fa53a1f13

SHA1
36238cb4ea92b462707328ad5dc72a495007534b

SHA256
1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e

SHA512
6d1b078bf9e61ac73b79c03a1cfce776f9a6b2a9e1a7be81230846da4e879d0c9cbcc562e98985a12da4ee3825e10094b457d02de3d469aa9bd2ed0e82b0c143

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe

Filesize
1.3MB

MD5
8a6a9dd67063c9098447da6fa53a1f13

SHA1
36238cb4ea92b462707328ad5dc72a495007534b

SHA256
1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e

SHA512
6d1b078bf9e61ac73b79c03a1cfce776f9a6b2a9e1a7be81230846da4e879d0c9cbcc562e98985a12da4ee3825e10094b457d02de3d469aa9bd2ed0e82b0c143

Download Submit
C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.bat

Filesize
56B

MD5
4a55a5a5ca857637659220aeb1a91d92

SHA1
4c73b21f348ed194dec47bcb0c3a83071be864e8

SHA256
0aa9d5a6e2d224e57d44bd4267c6d98479e25b052c878e579cc5d2facbcc601f

SHA512
d7ea2948e2c5f60675c08d6a8308cd7c449e1efaef818a24bf0481b8f5a45412a04b5fd580035127bcd052cc754fb948dc947989528ee9a52ce64457ab2eac51

Download Submit
C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.vbs

Filesize
169B

MD5
3d987aec0fa7269c334d9d52676f7ae6

SHA1
c912e179bfcad6b0d10061cfe4eb84bfa069a5f5

SHA256
757a187de0343591d7d49a2fa71ef8a8f8325f61df8f2bff905c36d599bdd549

SHA512
8ff828024cfdb0db4bc0474ce4b5f00e691c0d9c4193ebd67bb57b4ba7907690e688c6c0a78863a8ece6e244ef21e89c0aa1b7f073146fad0a2b0e59beb58e63

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\AppMgnt.exe

Filesize
8KB

MD5
07870aab1c5ab63cfeaa3c396ebaac51

SHA1
b3789bc78eb3345af6899f331aded871bd4a27e9

SHA256
feae74003448e0a27cd5e1e9087f54c8a558ad2ae2ce3d04382860ef19081323

SHA512
ae96ab7119784132a6e9fd49312a6ffe53b89504fea72d7618f143b0b432c08f1cc6836367af0fd878873d4ffc8b4356d6f66eea2007cdefba90ff1202d5e7f3

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\hknswc.exe

Filesize
1.3MB

MD5
8a6a9dd67063c9098447da6fa53a1f13

SHA1
36238cb4ea92b462707328ad5dc72a495007534b

SHA256
1fe6260c3d2de26599b72c225bf430352e4a2f83371c37eb19dbb9d4e091df3e

SHA512
6d1b078bf9e61ac73b79c03a1cfce776f9a6b2a9e1a7be81230846da4e879d0c9cbcc562e98985a12da4ee3825e10094b457d02de3d469aa9bd2ed0e82b0c143

Download Submit
memory/304-117-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/304-86-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/568-85-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/568-55-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/568-54-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/1064-105-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1400-118-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/1400-115-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/1524-65-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1524-67-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1524-100-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1524-56-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1524-63-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1524-61-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1524-71-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1524-59-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1524-77-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1524-57-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1768-116-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/1768-119-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/1792-101-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/1792-106-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/1792-78-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download