Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 06:42
Static task
static1
Behavioral task
behavioral1
Sample
6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe
-
Size
13.1MB
-
MD5
6a9c6979794cb76418468436863d9c0a
-
SHA1
45827af07a21ad6ce9625e229e2b99f6c81f9a39
-
SHA256
7d5d3ada6092553b21d75c4fe407a4692c63bd0548cb9d0a1675de61f1946c9c
-
SHA512
58475f6c34bf8252f823ee234a3950c5e89f2dac29697578643d3de8f9fdb47b1528bbf71b9280855ee279d385fde7e5d0522339830f67dd9814fb6f4082d681
-
SSDEEP
49152:ArilWvdYEbdDYCJ6TRBsDL9A9TK4FfpV3203HCnBTaXMdYrkTcH:AriSkBcF4Fhl2gUBTaXMmrg
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 2072 Builder.exe 2060 avguix.exe 2172 avguix.exe 320 avguix.exe 2080 avguix.exe 2736 avguix.exe 2868 avguix.exe 2896 avguix.exe 3024 avguix.exe 2892 avguix.exe 2472 avguix.exe 2920 avguix.exe 2988 avguix.exe 2744 avguix.exe 2648 avguix.exe 2604 avguix.exe 2624 avguix.exe 2676 avguix.exe 2224 avguix.exe 2476 avguix.exe 1940 avguix.exe 272 avguix.exe 1748 avguix.exe 1372 avguix.exe 652 avguix.exe 268 avguix.exe 2428 avguix.exe 1892 avguix.exe 1620 avguix.exe 1952 avguix.exe 1876 avguix.exe 2004 avguix.exe 2816 avguix.exe 2860 avguix.exe 1960 avguix.exe 2948 avguix.exe 2924 avguix.exe 2824 avguix.exe 2508 avguix.exe 2468 avguix.exe 2200 avguix.exe 2236 avguix.exe 288 avguix.exe 804 avguix.exe 444 avguix.exe 2588 avguix.exe 1968 avguix.exe 1944 avguix.exe 1608 avguix.exe 1228 avguix.exe 1324 avguix.exe 1728 avguix.exe 976 avguix.exe 1948 avguix.exe 2980 avguix.exe 1664 avguix.exe 1364 avguix.exe 780 avguix.exe 2304 avguix.exe 3052 avguix.exe 2968 avguix.exe 2336 avguix.exe 1484 avguix.exe 304 avguix.exe -
Loads dropped DLL 3 IoCs
pid Process 1412 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe 1412 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe 2072 Builder.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVG Internet Security = "C:\\Users\\Admin\\AppData\\Local\\avguix.exe" 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Builder Security = "C:\\Users\\Admin\\AppData\\Local\\Builder.exe" Builder.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\Oik54BE5577.sys 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe File created C:\windows\SysWOW64\Oikx54BE5577.sys 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avguix.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe 2072 Builder.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1412 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1412 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe 2060 avguix.exe 2172 avguix.exe 320 avguix.exe 2080 avguix.exe 2736 avguix.exe 2868 avguix.exe 2896 avguix.exe 3024 avguix.exe 2892 avguix.exe 2472 avguix.exe 2920 avguix.exe 2988 avguix.exe 2744 avguix.exe 2648 avguix.exe 2604 avguix.exe 2624 avguix.exe 2676 avguix.exe 2224 avguix.exe 2476 avguix.exe 1940 avguix.exe 272 avguix.exe 1748 avguix.exe 1372 avguix.exe 652 avguix.exe 268 avguix.exe 2428 avguix.exe 1892 avguix.exe 1620 avguix.exe 1952 avguix.exe 1876 avguix.exe 2004 avguix.exe 2816 avguix.exe 2860 avguix.exe 1960 avguix.exe 2948 avguix.exe 2924 avguix.exe 2824 avguix.exe 2508 avguix.exe 2468 avguix.exe 2200 avguix.exe 2236 avguix.exe 288 avguix.exe 804 avguix.exe 444 avguix.exe 2588 avguix.exe 1968 avguix.exe 1944 avguix.exe 1608 avguix.exe 1228 avguix.exe 1324 avguix.exe 1728 avguix.exe 976 avguix.exe 1948 avguix.exe 2980 avguix.exe 1664 avguix.exe 1364 avguix.exe 780 avguix.exe 2304 avguix.exe 3052 avguix.exe 2968 avguix.exe 2336 avguix.exe 1484 avguix.exe 304 avguix.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1412 wrote to memory of 2072 1412 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe 30 PID 1412 wrote to memory of 2072 1412 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe 30 PID 1412 wrote to memory of 2072 1412 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe 30 PID 1412 wrote to memory of 2072 1412 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe 30 PID 2072 wrote to memory of 2060 2072 Builder.exe 31 PID 2072 wrote to memory of 2060 2072 Builder.exe 31 PID 2072 wrote to memory of 2060 2072 Builder.exe 31 PID 2072 wrote to memory of 2060 2072 Builder.exe 31 PID 2072 wrote to memory of 2172 2072 Builder.exe 33 PID 2072 wrote to memory of 2172 2072 Builder.exe 33 PID 2072 wrote to memory of 2172 2072 Builder.exe 33 PID 2072 wrote to memory of 2172 2072 Builder.exe 33 PID 2072 wrote to memory of 320 2072 Builder.exe 34 PID 2072 wrote to memory of 320 2072 Builder.exe 34 PID 2072 wrote to memory of 320 2072 Builder.exe 34 PID 2072 wrote to memory of 320 2072 Builder.exe 34 PID 2072 wrote to memory of 2080 2072 Builder.exe 35 PID 2072 wrote to memory of 2080 2072 Builder.exe 35 PID 2072 wrote to memory of 2080 2072 Builder.exe 35 PID 2072 wrote to memory of 2080 2072 Builder.exe 35 PID 2072 wrote to memory of 2736 2072 Builder.exe 36 PID 2072 wrote to memory of 2736 2072 Builder.exe 36 PID 2072 wrote to memory of 2736 2072 Builder.exe 36 PID 2072 wrote to memory of 2736 2072 Builder.exe 36 PID 2072 wrote to memory of 2868 2072 Builder.exe 37 PID 2072 wrote to memory of 2868 2072 Builder.exe 37 PID 2072 wrote to memory of 2868 2072 Builder.exe 37 PID 2072 wrote to memory of 2868 2072 Builder.exe 37 PID 2072 wrote to memory of 2896 2072 Builder.exe 38 PID 2072 wrote to memory of 2896 2072 Builder.exe 38 PID 2072 wrote to memory of 2896 2072 Builder.exe 38 PID 2072 wrote to memory of 2896 2072 Builder.exe 38 PID 2072 wrote to memory of 3024 2072 Builder.exe 39 PID 2072 wrote to memory of 3024 2072 Builder.exe 39 PID 2072 wrote to memory of 3024 2072 Builder.exe 39 PID 2072 wrote to memory of 3024 2072 Builder.exe 39 PID 2072 wrote to memory of 2892 2072 Builder.exe 40 PID 2072 wrote to memory of 2892 2072 Builder.exe 40 PID 2072 wrote to memory of 2892 2072 Builder.exe 40 PID 2072 wrote to memory of 2892 2072 Builder.exe 40 PID 2072 wrote to memory of 2472 2072 Builder.exe 41 PID 2072 wrote to memory of 2472 2072 Builder.exe 41 PID 2072 wrote to memory of 2472 2072 Builder.exe 41 PID 2072 wrote to memory of 2472 2072 Builder.exe 41 PID 2072 wrote to memory of 2920 2072 Builder.exe 42 PID 2072 wrote to memory of 2920 2072 Builder.exe 42 PID 2072 wrote to memory of 2920 2072 Builder.exe 42 PID 2072 wrote to memory of 2920 2072 Builder.exe 42 PID 2072 wrote to memory of 2988 2072 Builder.exe 43 PID 2072 wrote to memory of 2988 2072 Builder.exe 43 PID 2072 wrote to memory of 2988 2072 Builder.exe 43 PID 2072 wrote to memory of 2988 2072 Builder.exe 43 PID 2072 wrote to memory of 2744 2072 Builder.exe 44 PID 2072 wrote to memory of 2744 2072 Builder.exe 44 PID 2072 wrote to memory of 2744 2072 Builder.exe 44 PID 2072 wrote to memory of 2744 2072 Builder.exe 44 PID 2072 wrote to memory of 2648 2072 Builder.exe 45 PID 2072 wrote to memory of 2648 2072 Builder.exe 45 PID 2072 wrote to memory of 2648 2072 Builder.exe 45 PID 2072 wrote to memory of 2648 2072 Builder.exe 45 PID 2072 wrote to memory of 2604 2072 Builder.exe 46 PID 2072 wrote to memory of 2604 2072 Builder.exe 46 PID 2072 wrote to memory of 2604 2072 Builder.exe 46 PID 2072 wrote to memory of 2604 2072 Builder.exe 46 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1412 -
C:\Users\Admin\AppData\Local\Builder.exeC:\Users\Admin\AppData\Local\Builder.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2172
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:320
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2080
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2736
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2868
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2896
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3024
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2892
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2920
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2988
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2744
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2604
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2624
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2676
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2224
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2476
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1940
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:272
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1372
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:652
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:268
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2428
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1876
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2860
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2948
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2824
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2508
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2468
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2200
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:288
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:804
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:444
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1608
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1228
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:976
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2980
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1664
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:780
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2304
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3052
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2968
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2336
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:304
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1288
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1988
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1972
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2464
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1588
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1684
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1596
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2412
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2568
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2152
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2548
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2172
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2080
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2792
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2880
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2088
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2044
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2768
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2884
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2744
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1632
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1864
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2620
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2804
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2320
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2476
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2348
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2872
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:272
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1816
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2632
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1704
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2672
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2852
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2912
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:628
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1384
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1720
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2616
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2004
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2600
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1072
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1960
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2952
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2924
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2220
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2180
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2728
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:484
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2992
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2928
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:804
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:3032
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2588
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1956
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1292
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1228
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1512
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:976
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1948
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2372
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1664
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1408
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:780
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:296
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1492
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1668
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:708
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2692
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2336
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2496
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1536
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2448
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1860
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:468
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2104
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:2312
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:1972
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵
- System Location Discovery: System Language Discovery
PID:1976
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:940
-
-
C:\Users\Admin\AppData\Local\avguix.exeC:\Users\Admin\AppData\Local\avguix.exe3⤵PID:2340
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
MD55e31e7bf5871b8698ab9ab744ee06470
SHA189ff5acbd648f081b44ad80a5979dcb3f20c803a
SHA25693c706af57ea44405ebfcc7beea6ac47836224938b363cbc3148fd3f20604f96
SHA512653d01db57feb647898ee15d09f55e8efffcab0c3f29a12a0d50782d0ad87bf0a4503037b0a497681e26e9bd2ed50ffe10ab9529eca8b7db4f610165f842ce63
-
Filesize
13.1MB
MD56a9c6979794cb76418468436863d9c0a
SHA145827af07a21ad6ce9625e229e2b99f6c81f9a39
SHA2567d5d3ada6092553b21d75c4fe407a4692c63bd0548cb9d0a1675de61f1946c9c
SHA51258475f6c34bf8252f823ee234a3950c5e89f2dac29697578643d3de8f9fdb47b1528bbf71b9280855ee279d385fde7e5d0522339830f67dd9814fb6f4082d681