Analysis
- max time kernel
151s - max time network
189s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
29/11/2022, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe
- Size 846KB
- Sample221129-txnwqsef56
- SHA256 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768
- MD5 9dc7df20d8173f8bf49377c5216e5b90
- SHA1 18b5ad898ccad20c47b634d320e4a1581a1dddf7
- SHA512 b5b3a3ddc988b792f8cdb63b70ed750d674cde4e7499011aaae00fac47828dde9046237a178e6c822e052bbb5bc45c9b18d1d900e864abe58df3ea4a78b2a209
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JB3:g72zd72zsg72zd72zs93
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" avscan.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hosts.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" avscan.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hosts.exe - Adds policy Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe - Executes dropped EXE 6 IoCs
pid Process 4868 avscan.exe 4396 avscan.exe 1600 hosts.exe 4348 hosts.exe 1184 avscan.exe 3724 hosts.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run hosts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" hosts.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run avscan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" avscan.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\windows\W_X_C.vbs 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe File created \??\c:\windows\W_X_C.bat 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe File opened for modification C:\Windows\hosts.exe 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe File opened for modification C:\Windows\hosts.exe avscan.exe File opened for modification C:\Windows\hosts.exe hosts.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings cmd.exe - Modifies registry key 1 TTPs 9 IoCs
pid Process 64 REG.exe 1884 REG.exe 2636 REG.exe 4876 REG.exe 4392 REG.exe 2432 REG.exe 3412 REG.exe 3808 REG.exe 4944 REG.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4868 avscan.exe 1600 hosts.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 4868 avscan.exe 4396 avscan.exe 1600 hosts.exe 4348 hosts.exe 1184 avscan.exe 3724 hosts.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 3532 wrote to memory of 4944 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 78 PID 3532 wrote to memory of 4944 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 78 PID 3532 wrote to memory of 4944 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 78 PID 3532 wrote to memory of 4868 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 80 PID 3532 wrote to memory of 4868 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 80 PID 3532 wrote to memory of 4868 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 80 PID 4868 wrote to memory of 4396 4868 avscan.exe 81 PID 4868 wrote to memory of 4396 4868 avscan.exe 81 PID 4868 wrote to memory of 4396 4868 avscan.exe 81 PID 4868 wrote to memory of 4836 4868 avscan.exe 82 PID 4868 wrote to memory of 4836 4868 avscan.exe 82 PID 4868 wrote to memory of 4836 4868 avscan.exe 82 PID 3532 wrote to memory of 4788 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 83 PID 3532 wrote to memory of 4788 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 83 PID 3532 wrote to memory of 4788 3532 9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe 83 PID 4836 wrote to memory of 1600 4836 cmd.exe 86 PID 4836 wrote to memory of 1600 4836 cmd.exe 86 PID 4836 wrote to memory of 1600 4836 cmd.exe 86 PID 4788 wrote to memory of 4348 4788 cmd.exe 87 PID 4788 wrote to memory of 4348 4788 cmd.exe 87 PID 4788 wrote to memory of 4348 4788 cmd.exe 87 PID 1600 wrote to memory of 1184 1600 hosts.exe 88 PID 1600 wrote to memory of 1184 1600 hosts.exe 88 PID 1600 wrote to memory of 1184 1600 hosts.exe 88 PID 1600 wrote to memory of 2316 1600 hosts.exe 89 PID 1600 wrote to memory of 2316 1600 hosts.exe 89 PID 1600 wrote to memory of 2316 1600 hosts.exe 89 PID 4836 wrote to memory of 3788 4836 cmd.exe 92 PID 4836 wrote to memory of 3788 4836 cmd.exe 92 PID 4836 wrote to memory of 3788 4836 cmd.exe 92 PID 4788 wrote to memory of 4036 4788 cmd.exe 93 PID 4788 wrote to memory of 4036 4788 cmd.exe 93 PID 4788 wrote to memory of 4036 4788 cmd.exe 93 PID 2316 wrote to memory of 3724 2316 cmd.exe 94 PID 2316 wrote to memory of 3724 2316 cmd.exe 94 PID 2316 wrote to memory of 3724 2316 cmd.exe 94 PID 2316 wrote to memory of 4064 2316 cmd.exe 95 PID 2316 wrote to memory of 4064 2316 cmd.exe 95 PID 2316 wrote to memory of 4064 2316 cmd.exe 95 PID 4868 wrote to memory of 3412 4868 avscan.exe 98 PID 4868 wrote to memory of 3412 4868 avscan.exe 98 PID 4868 wrote to memory of 3412 4868 avscan.exe 98 PID 1600 wrote to memory of 64 1600 hosts.exe 100 PID 1600 wrote to memory of 64 1600 hosts.exe 100 PID 1600 wrote to memory of 64 1600 hosts.exe 100 PID 4868 wrote to memory of 1884 4868 avscan.exe 110 PID 4868 wrote to memory of 1884 4868 avscan.exe 110 PID 4868 wrote to memory of 1884 4868 avscan.exe 110 PID 1600 wrote to memory of 3808 1600 hosts.exe 108 PID 1600 wrote to memory of 3808 1600 hosts.exe 108 PID 1600 wrote to memory of 3808 1600 hosts.exe 108 PID 4868 wrote to memory of 2636 4868 avscan.exe 112 PID 4868 wrote to memory of 2636 4868 avscan.exe 112 PID 4868 wrote to memory of 2636 4868 avscan.exe 112 PID 1600 wrote to memory of 4876 1600 hosts.exe 113 PID 1600 wrote to memory of 4876 1600 hosts.exe 113 PID 1600 wrote to memory of 4876 1600 hosts.exe 113 PID 1600 wrote to memory of 2432 1600 hosts.exe 118 PID 1600 wrote to memory of 2432 1600 hosts.exe 118 PID 1600 wrote to memory of 2432 1600 hosts.exe 118 PID 4868 wrote to memory of 4392 4868 avscan.exe 117 PID 4868 wrote to memory of 4392 4868 avscan.exe 117 PID 4868 wrote to memory of 4392 4868 avscan.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe"C:\Users\Admin\AppData\Local\Temp\9c9620eca1c19b611830140e2a83168cc2af17145f7deb82ed24868e4357e768.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f2⤵
- Modifies registry key
PID:4944
-
-
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\hosts.exeC:\windows\hosts.exe4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\windows\hosts.exeC:\windows\hosts.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3724
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"6⤵
- Adds policy Run key to start application
PID:4064
-
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f5⤵
- Modifies registry key
PID:64
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f5⤵
- Modifies registry key
PID:3808
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f5⤵
- Modifies registry key
PID:4876
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f5⤵
- Modifies registry key
PID:2432
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"4⤵
- Adds policy Run key to start application
PID:3788
-
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:3412
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1884
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2636
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:4392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\hosts.exeC:\windows\hosts.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4348
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"3⤵
- Adds policy Run key to start application
PID:4036
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2336
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
- Size 846KB
- SHA256 50b5f255afe71a5fb5350ceea049b4ce53f0cab3a480b9a765c2559a0efc799f
- MD5 82d8a379364ad901d5f3c79e8d372513
- SHA1 980521fff4a5680f43ceff369c0a11b3580e2495
- SHA512 9fe9a8326562e9032c7a990200c06db413a1167bf9d130eba67bc434a0feff74999a2ccdcc2151697a0fa1c61d3ecd187fbf2ffcaac6ac4090012289b5915f49
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JBc:g72zd72zsg72zd72zs9c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
- Size 846KB
- SHA256 50b5f255afe71a5fb5350ceea049b4ce53f0cab3a480b9a765c2559a0efc799f
- MD5 82d8a379364ad901d5f3c79e8d372513
- SHA1 980521fff4a5680f43ceff369c0a11b3580e2495
- SHA512 9fe9a8326562e9032c7a990200c06db413a1167bf9d130eba67bc434a0feff74999a2ccdcc2151697a0fa1c61d3ecd187fbf2ffcaac6ac4090012289b5915f49
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JBc:g72zd72zsg72zd72zs9c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
- Size 846KB
- SHA256 50b5f255afe71a5fb5350ceea049b4ce53f0cab3a480b9a765c2559a0efc799f
- MD5 82d8a379364ad901d5f3c79e8d372513
- SHA1 980521fff4a5680f43ceff369c0a11b3580e2495
- SHA512 9fe9a8326562e9032c7a990200c06db413a1167bf9d130eba67bc434a0feff74999a2ccdcc2151697a0fa1c61d3ecd187fbf2ffcaac6ac4090012289b5915f49
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JBc:g72zd72zsg72zd72zs9c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
- Size 846KB
- SHA256 50b5f255afe71a5fb5350ceea049b4ce53f0cab3a480b9a765c2559a0efc799f
- MD5 82d8a379364ad901d5f3c79e8d372513
- SHA1 980521fff4a5680f43ceff369c0a11b3580e2495
- SHA512 9fe9a8326562e9032c7a990200c06db413a1167bf9d130eba67bc434a0feff74999a2ccdcc2151697a0fa1c61d3ecd187fbf2ffcaac6ac4090012289b5915f49
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JBc:g72zd72zsg72zd72zs9c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\W_X_C.vbs
- Size 195B
- SHA256 4785d6a229d0872fe90c75ab620de9a680d7f07ccd27a134da2afc4ee88f34f3
- MD5 5b87381bf407d7c6018a8b11c3e20f92
- SHA1 bb61b28d9c8fd7dfeb13a397c49a1be3abc06ca2
- SHA512 05db1178f671e9d6c3a1c601349093447b04ebddcd071a06f7cc92cbaf7efb53027bc92523a19372a08ca5af715cc9955649255f8be1909b5e594385b3dcbe3d
- MD5 SHA1 SHA512
- Path C:\Windows\hosts.exe
- Size 846KB
- SHA256 6e1db5429596cb42d19a0a51706bacad4c1556df84726286f66e859386b048b5
- MD5 aa8a531ec4cecbba5aef9b653ba72e1c
- SHA1 19a8e28f76253ed7cb099a34766fb3373dcf6238
- SHA512 9d8c828f0f48bc6130229517b447bc645914920c02f9bc830a1fca35c9f0fc77d94f7e5d26171b5ab6423a430c314450538b91d0525d67233d5c59f5972ddf5e
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JBe:g72zd72zsg72zd72zs9e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\hosts.exe
- Size 846KB
- SHA256 6e1db5429596cb42d19a0a51706bacad4c1556df84726286f66e859386b048b5
- MD5 aa8a531ec4cecbba5aef9b653ba72e1c
- SHA1 19a8e28f76253ed7cb099a34766fb3373dcf6238
- SHA512 9d8c828f0f48bc6130229517b447bc645914920c02f9bc830a1fca35c9f0fc77d94f7e5d26171b5ab6423a430c314450538b91d0525d67233d5c59f5972ddf5e
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JBe:g72zd72zsg72zd72zs9e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\hosts.exe
- Size 846KB
- SHA256 6e1db5429596cb42d19a0a51706bacad4c1556df84726286f66e859386b048b5
- MD5 aa8a531ec4cecbba5aef9b653ba72e1c
- SHA1 19a8e28f76253ed7cb099a34766fb3373dcf6238
- SHA512 9d8c828f0f48bc6130229517b447bc645914920c02f9bc830a1fca35c9f0fc77d94f7e5d26171b5ab6423a430c314450538b91d0525d67233d5c59f5972ddf5e
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JBe:g72zd72zsg72zd72zs9e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\hosts.exe
- Size 846KB
- SHA256 6e1db5429596cb42d19a0a51706bacad4c1556df84726286f66e859386b048b5
- MD5 aa8a531ec4cecbba5aef9b653ba72e1c
- SHA1 19a8e28f76253ed7cb099a34766fb3373dcf6238
- SHA512 9d8c828f0f48bc6130229517b447bc645914920c02f9bc830a1fca35c9f0fc77d94f7e5d26171b5ab6423a430c314450538b91d0525d67233d5c59f5972ddf5e
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JBe:g72zd72zsg72zd72zs9e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\windows\hosts.exe
- Size 846KB
- SHA256 6e1db5429596cb42d19a0a51706bacad4c1556df84726286f66e859386b048b5
- MD5 aa8a531ec4cecbba5aef9b653ba72e1c
- SHA1 19a8e28f76253ed7cb099a34766fb3373dcf6238
- SHA512 9d8c828f0f48bc6130229517b447bc645914920c02f9bc830a1fca35c9f0fc77d94f7e5d26171b5ab6423a430c314450538b91d0525d67233d5c59f5972ddf5e
- SSDEEP 12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNP5JBe:g72zd72zsg72zd72zs9e
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\W_X_C.bat
- Size 336B
- SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
- MD5 4db9f8b6175722b62ececeeeba1ce307
- SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
- SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
- MD5 SHA1 SHA512