Analysis
- max time kernel
105s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 12:23
Behavioral task
behavioral1
Sample
4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe
- Size 8.8MB
- Sample260825-pkv23aaj21
- SHA256 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5
- MD5 ad675afdd15c783f4381204eb1b9772c
- SHA1 b9fac59e7c649f4bab62835a1244f7f5bf99d2cc
- SHA512 1e2d5cd2d620ae8c795146f6f93c5776e10391ca3f16fbe97f0798538b9f8ef7d2608db0bf473ccbb67026fbe4d449e355dd0b1a0647c6fad8cc017aba0dcb8e
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDah:b70X
- TLSH T1F196AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Lunam 37 IoCs
resource yara_rule behavioral1/files/0x00070000000242cc-9.dat family_lunam behavioral1/files/0x00070000000242cd-13.dat family_lunam behavioral1/files/0x0008000000024139-53.dat family_lunam behavioral1/files/0x000800000002413a-55.dat family_lunam behavioral1/files/0x000700000002413b-57.dat family_lunam behavioral1/files/0x000700000002413c-59.dat family_lunam behavioral1/files/0x000700000002413d-61.dat family_lunam behavioral1/files/0x000700000002413e-63.dat family_lunam behavioral1/files/0x000700000002413f-65.dat family_lunam behavioral1/files/0x0008000000024139-67.dat family_lunam behavioral1/files/0x000800000002413a-69.dat family_lunam behavioral1/files/0x000700000002413b-71.dat family_lunam behavioral1/files/0x000700000002413c-73.dat family_lunam behavioral1/files/0x000700000002413d-75.dat family_lunam behavioral1/files/0x000700000002413e-77.dat family_lunam behavioral1/files/0x000700000002413f-79.dat family_lunam behavioral1/files/0x0008000000024139-81.dat family_lunam behavioral1/files/0x000800000002413a-83.dat family_lunam behavioral1/files/0x000700000002413b-85.dat family_lunam behavioral1/files/0x000700000002413c-87.dat family_lunam behavioral1/files/0x000700000002413d-89.dat family_lunam behavioral1/files/0x000700000002413e-91.dat family_lunam behavioral1/files/0x000700000002413f-93.dat family_lunam behavioral1/files/0x0008000000024139-95.dat family_lunam behavioral1/files/0x000800000002413a-97.dat family_lunam behavioral1/files/0x000700000002413b-99.dat family_lunam behavioral1/files/0x000700000002413c-101.dat family_lunam behavioral1/files/0x0008000000024139-102.dat family_lunam behavioral1/files/0x000700000002413d-104.dat family_lunam behavioral1/files/0x000800000002413a-106.dat family_lunam behavioral1/files/0x000700000002413e-108.dat family_lunam behavioral1/files/0x000700000002413b-110.dat family_lunam behavioral1/files/0x000700000002413f-112.dat family_lunam behavioral1/files/0x000700000002413c-115.dat family_lunam behavioral1/files/0x000700000002413d-117.dat family_lunam behavioral1/files/0x000700000002413e-119.dat family_lunam behavioral1/files/0x000700000002413f-121.dat family_lunam - Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" avscan.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hosts.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" avscan.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hosts.exe - Adds policy Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XWFPSFRW = "W_X_C.bat" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XWFPSFRW = "W_X_C.bat" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XWFPSFRW = "W_X_C.bat" WScript.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation cmd.exe - Executes dropped EXE 6 IoCs
pid Process 1896 avscan.exe 1900 avscan.exe 3320 hosts.exe 3332 hosts.exe 4292 avscan.exe 1260 hosts.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys REG.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power REG.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc REG.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys REG.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager REG.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc REG.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" avscan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" hosts.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
pid Process 4284 WScript.exe 3452 WScript.exe 684 WScript.exe -
resource yara_rule behavioral1/memory/436-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/files/0x00070000000242cc-9.dat upx behavioral1/files/0x00070000000242cd-13.dat upx behavioral1/memory/1900-16-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1900-21-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/436-22-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3332-35-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/4292-39-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1896-41-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1260-44-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3320-45-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/files/0x0008000000024139-53.dat upx behavioral1/files/0x000800000002413a-55.dat upx behavioral1/files/0x000700000002413b-57.dat upx behavioral1/files/0x000700000002413c-59.dat upx behavioral1/files/0x000700000002413d-61.dat upx behavioral1/files/0x000700000002413e-63.dat upx behavioral1/files/0x000700000002413f-65.dat upx behavioral1/files/0x0008000000024139-67.dat upx behavioral1/files/0x000800000002413a-69.dat upx behavioral1/files/0x000700000002413b-71.dat upx behavioral1/files/0x000700000002413c-73.dat upx behavioral1/files/0x000700000002413d-75.dat upx behavioral1/files/0x000700000002413e-77.dat upx behavioral1/files/0x000700000002413f-79.dat upx behavioral1/files/0x0008000000024139-81.dat upx behavioral1/files/0x000800000002413a-83.dat upx behavioral1/files/0x000700000002413b-85.dat upx behavioral1/files/0x000700000002413c-87.dat upx behavioral1/files/0x000700000002413d-89.dat upx behavioral1/files/0x000700000002413e-91.dat upx behavioral1/files/0x000700000002413f-93.dat upx behavioral1/files/0x0008000000024139-95.dat upx behavioral1/files/0x000800000002413a-97.dat upx behavioral1/files/0x000700000002413b-99.dat upx behavioral1/files/0x000700000002413c-101.dat upx behavioral1/files/0x0008000000024139-102.dat upx behavioral1/files/0x000700000002413d-104.dat upx behavioral1/files/0x000800000002413a-106.dat upx behavioral1/files/0x000700000002413e-108.dat upx behavioral1/files/0x000700000002413b-110.dat upx behavioral1/files/0x000700000002413f-112.dat upx behavioral1/files/0x000700000002413c-115.dat upx behavioral1/files/0x000700000002413d-117.dat upx behavioral1/files/0x000700000002413e-119.dat upx behavioral1/files/0x000700000002413f-121.dat upx - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\windows\W_X_C.vbs 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe File created \??\c:\windows\W_X_C.bat 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe File opened for modification C:\Windows\hosts.exe 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe File opened for modification C:\Windows\hosts.exe avscan.exe File opened for modification C:\Windows\hosts.exe hosts.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2816 cmd.exe 1836 cmd.exe 4992 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings cmd.exe - Modifies registry key 1 TTPs 7 IoCs
pid Process 2764 REG.exe 3212 REG.exe 2372 REG.exe 1840 REG.exe 4640 REG.exe 3604 REG.exe 3496 REG.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1896 avscan.exe 3320 hosts.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 436 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe 1896 avscan.exe 1900 avscan.exe 3320 hosts.exe 3332 hosts.exe 4292 avscan.exe 1260 hosts.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 436 wrote to memory of 2764 436 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe 84 PID 436 wrote to memory of 1896 436 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe 86 PID 1896 wrote to memory of 1900 1896 avscan.exe 87 PID 1896 wrote to memory of 4992 1896 avscan.exe 88 PID 436 wrote to memory of 1836 436 4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe 89 PID 1836 wrote to memory of 3320 1836 cmd.exe 93 PID 4992 wrote to memory of 3332 4992 cmd.exe 94 PID 1836 wrote to memory of 3452 1836 cmd.exe 96 PID 3320 wrote to memory of 4292 3320 hosts.exe 97 PID 4992 wrote to memory of 684 4992 cmd.exe 99 PID 3320 wrote to memory of 2816 3320 hosts.exe 100 PID 2816 wrote to memory of 1260 2816 cmd.exe 103 PID 2816 wrote to memory of 4284 2816 cmd.exe 104 PID 1896 wrote to memory of 3212 1896 avscan.exe 109 PID 3320 wrote to memory of 2372 3320 hosts.exe 111 PID 1896 wrote to memory of 1840 1896 avscan.exe 117 PID 3320 wrote to memory of 4640 3320 hosts.exe 119 PID 1896 wrote to memory of 3604 1896 avscan.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe"C:\Users\Admin\AppData\Local\Temp\4c4e059366771fd5175011fbdf49775cbeaec26882cec7b11e67da0b09bf04f5.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f2⤵
- Impair Defenses: Safe Mode Boot
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat3⤵
- Checks computer location settings
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\hosts.exeC:\windows\hosts.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3332
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"4⤵
- Adds policy Run key to start application
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
PID:684
-
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3212
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1840
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat2⤵
- Checks computer location settings
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\windows\hosts.exeC:\windows\hosts.exe3⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4292
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat4⤵
- Checks computer location settings
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\hosts.exeC:\windows\hosts.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1260
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"5⤵
- Adds policy Run key to start application
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
PID:4284
-
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2372
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4640
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f4⤵
- Modifies registry key
PID:3496
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"3⤵
- Adds policy Run key to start application
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
PID:3452
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2136
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
- Size 8.8MB
- SHA256 a3bced5c0a5e726d94f78ca272a419fc91dd09c6a6ba0172fa4175b96ed68e7a
- MD5 ba8528f9200eb3090b043ba9871f4924
- SHA1 40c6b0d31f6953c0fb5c8420856be876a798396f
- SHA512 6f82c1b23f5b9f5f6cb596a5df978070319d0fc5321ddfe3c5915c16164df03fd3b62295eddd97b31c887ac06846bf80a7aaa3cfd54f416f4defa23270e06f36
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDam:b70Q
- TLSH T18F96AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_128.png
- Size 52.7MB
- SHA256 e3082ebc192156e0b305d7a8d6434a35d8e781832bd57c8cf53952aa581ca8d3
- MD5 a89ddcb163a47c77a48c0924520ce076
- SHA1 a741b17071db45f30d356840243b8091ea4df7c5
- SHA512 1dee77694ff5229b8a997ed6596652145da5ff3aee5d827195330be2427f349f04718b3f542b0bc00d674d8291d7053d8951509391f5b25769cc207a9c8307bf
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDa5:b70Q70F70Q70F70Q70lB
- TLSH T189C7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_128.png
- Size 17.6MB
- SHA256 ac953194568074063e987e1629731346219cf240e02d75f5dc2445216e270092
- MD5 e0f9cbb03aa70f05443aa3407ada8e77
- SHA1 d3f12ee29a66c8e4e3a822728d8871089e48e127
- SHA512 bef0388ba9a4ff5fc85ccbbf2e09aa3a65bc59ac8070a81c4f7da60b0dab1318d63dcfd1dbbb1afb79cfd493519cb6db82b44f1fbdda0b4f1738b1428cb5ae92
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaV:b70Q70lx
- TLSH T11607AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_128.png
- Size 26.4MB
- SHA256 dd33dcdaa7c83cd32b2b0dbd95e5f1609370cfa39e6f8db75ed552525700c7b4
- MD5 d9d221c317d9d0537e70d7a92436e808
- SHA1 7ab76b4f0d1fd0086b51d202d04626cb1f38b702
- SHA512 4f2a1fee30cbee7c227c8e58d5b2f9ac256e5305fb87c4619190c105345b15a1c6d33159065255c05c5eea2990484b5ce4598a621f2a7aa89064926d9c1cf8d6
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDar:b70F70Q70lO
- TLSH T1AC57AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_128.png
- Size 35.1MB
- SHA256 0923513cbc6283490edb092fff6877b6a44a9d14e6f0190c6f67bd65dd8c6351
- MD5 a4f011e6411fd0d0602ed49a155cd82f
- SHA1 5900bf59e4b813e4adb5644fb17a9c6483016203
- SHA512 615827fa312db75126838d83ed0fcea36945cfdcc20dcd5aaccc854864bb5fb91e060e971564f28784c79ba88cc305e1aaf1c5acc78452c39536ec6720caa2a0
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaz:b70Q70F70Q70l+
- TLSH T1D687AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_128.png
- Size 43.9MB
- SHA256 9bc57360c326149e3013605bd0d80c26a3cc211ca3d3becbc13e23762b53c8e3
- MD5 1b6383415e2dc4c04b10d0ea7eaa6501
- SHA1 2e7dd98d197391bbfbd4ba65d9ce27e269ace020
- SHA512 3de9b79c9ff74879190adcab4567eb7dd070df1770ff42866ee307bca003714e27b98465b67eae29f6615b2bdca559b3028a2c2e76968425a095104a173618d2
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaC:b70F70Q70F70Q70la
- TLSH T165A7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_16.png
- Size 52.7MB
- SHA256 86c1579b19d669cbac51761f2ec30dc278429b35160b772281cab91c61cfd33a
- MD5 065c9abc3592ffb6ac78df6166838800
- SHA1 30c6668dfaa271c0714152046e14651197b20b01
- SHA512 9c0c9fd7bcbaf9528f044865c23beb569594f04cbacc8156762975ae0f481fc02c488dd569f33043669f3ca6f4a5c6ce224e8d804b030fd375d579fb2ab4419d
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDao:b70Q70F70Q70F70Q70Dy
- TLSH T170C7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_16.png
- Size 8.8MB
- SHA256 ea6bdf93ee2059549ae1852b4eedd9a46ab7ad0fefd75e66a1fdce06e50942ed
- MD5 e9fd521aa98e43ad8a7bf6fb2cb1b924
- SHA1 7864fdfdbdcc51b0312f79c9f31a64e6f4168265
- SHA512 2633b7b09ae5a66f56894b6af1160d87f8d291eb464862473eee29e52d9b0a3865a6128f71cdcff320464164b3ed5b1c00293ceb28605b99f659cc1151cdd194
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDa/:b70Dd
- TLSH T1DB96AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_16.png
- Size 17.6MB
- SHA256 8ef482d6f7146ccb95c9b336eed42956457bf0bd2a347b0c7f0503ebc4febd9c
- MD5 0687b4ea6c1cfd43636d836d95a1325f
- SHA1 3fb2bb78f217431dce2d7364faa44d8a98598eab
- SHA512 50553238c927bd604d4dcca6721b8b52065bd1c02f110c02b021193cc0fb40e23c1f3296579c93b207192bda809506c4ac76dac419bc8192e619addabca6618f
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaZ:b70Q70Df
- TLSH T10307AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_16.png
- Size 35.1MB
- SHA256 302b7c72b5f79aed1a4fa10e5b3f748ffd38d770e5ce7f57eb14a9f419723fcc
- MD5 ac1ec2ca685cbebda008c7561bfcbfac
- SHA1 f3cacc8f4dfc27e1f90edfa043edf7d19aacaeec
- SHA512 d3926976ce5df8685ce96d77e8ff96cb7020a8d9f713e2a6abe4c77bb4b858e99682d6196f299fd3072620f636fec6f5cdada0cd934b55e095c82b48b2377684
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDa1:b70Q70F70Q70Dw
- TLSH T14287AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\icon_16.png
- Size 43.9MB
- SHA256 492f67c55ca077db37448256e46f5230817b3c85ff5ebd3312711105b1160b99
- MD5 6b8a9b442f224893dba9a7a1c84085e6
- SHA1 136aeb22bd3cf21615a6de266f838b870d29614e
- SHA512 9502d6fc766b997109ea1be5f2ab4fceb7667d79e3fa216d80363cc19a505991b96f9939613f1d6447fe4cdaecb645c251e96412bf0579f488c3c38c3244a3a5
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDah:b70F70Q70F70Q70DH
- TLSH T17CA7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button.png
- Size 52.7MB
- SHA256 2623c534cdfeeb8449a9bf079c5add8e2803f1c120ff5f3fdfbe8340c95344a9
- MD5 5ed40607836fec41b2418fbddba7f522
- SHA1 61f218a7055077283e7eb7cbc1a5f1fa9576fa1d
- SHA512 6b370175a09d69257e07abc54317c9cfae51cf905f81a66cbaaf6883f0a976171ae2c489495535ea65c56e2b4923c70a99b95ea7a1c2804dc2ae7e81df069ee6
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDa0:b70F70Q70Q7UQ70Q70z
- TLSH T151C7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button.png
- Size 17.6MB
- SHA256 941fa496efd01b743d35a1b42d9dbb7d2a75126f26ded81c68bc829b5ba3822b
- MD5 0c074d572cb3b2034106b6507cd083d4
- SHA1 85d6b1d64080746939f69b8d9e6c6347ed412f37
- SHA512 e3f36d172990f2c7bf6f9813efd6b4f517bba98a0dc8af852889eadff8def0bb3b188988984fa4e3bd8272a12e935c0fea3c0543a92c408f4b6680bbaaf498c7
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaG:b70Q70c
- TLSH T1AD07AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button.png
- Size 26.4MB
- SHA256 0b1993ea7bb418bfbc04ce1458f24ca06f021b91820f76504a9ee6c37c94cd27
- MD5 10e052d8472b7379a1c7fe7ee1323552
- SHA1 340803827470f5f6704bdd65b39f7a78584f740c
- SHA512 d8f971bbee2426d148f9f9cf80dafec0ec04c9fc6cf2c66afec72794754ce946c4860f81ad3d9aca331cbf77d87c759bcfce11af96290bca5721eaf5f06848c1
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaK:b70F70Q70
- TLSH T18657AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button.png
- Size 35.1MB
- SHA256 8597811b729b3710062cfc9c9917aefa3a6b19e8a34268c4ebeea55f4a068a29
- MD5 623914714da41931b2ac84baef233776
- SHA1 085952ce007c8859f81506433bc4f4083e1dbe41
- SHA512 38e4034716aa256b42fdddc9d8af0fed9427a3d745876c68fb65e0ba94f09ca3382fb637f99ccca104c4c122b971e2846aa9b9eb7342517afdc290c0c0b18d03
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaP:b70Q70F70Q70G
- TLSH T1EE87AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button.png
- Size 43.9MB
- SHA256 d559b9abdcb8543f076625b1b07d22424185a4e55dd8dd02148a49b1dff14009
- MD5 fe60b0fed1092aab685547a546b9cdc6
- SHA1 b0d5f3546a51a3a6c68efacd69ad32f1f701311a
- SHA512 aed489ea20ed89fba46c641b38b124385e3b7fbeb5a9ed7301100de455624c01c85672566eeb1e1f2df411d7e28265a6284c5531fe188b19e49ec1e65828208b
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDap:b70Q7XQ70F7OQ70T
- TLSH T199A7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_close.png
- Size 43.9MB
- SHA256 34c426fbfbe7cb864551bd78227365a05c27ff66b19e65d6a21bf9b32bedcfc7
- MD5 91e801c930d619ee8dec1dffddabdb17
- SHA1 0ba3fcb70229b982963b2055b2840cb6ee76442d
- SHA512 fb118c0e8a1a624f2036a279ee90eb439b9ce3e61f6b72fbe808b99876cc1bc84b215b6dbb6cf3534fb274be154aa85a564b9946eac47a1cb5f1a1cbf137717f
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDam:b70F70Q70F70Q70Q
- TLSH T1EAA7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_close.png
- Size 43.5MB
- SHA256 b8904aa95392b5138c0d735427340ad6723ad69bd8f5fff36891e32112c2d3e9
- MD5 b8d536094148a69858b4776dc18083f7
- SHA1 43d66b26dcbea6adc6747178ebb72d2936920952
- SHA512 422a0f8a9d210f6d10b12b226686bf9b64f8d4f48493505d2087e7af583218c7bc91e8e3917298c8bad4924af89dd99b79d251d6f0b18351247a5344e546a8c5
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaA:b70Q70F70Q70F7r
- TLSH T1C0A7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_close.png
- Size 8.8MB
- SHA256 e1f65db0baa5fdb4c8cdcc5de2926be05479c20441b2cc74fbbe627deba8ae7b
- MD5 7c5f63abec1d7597dfc55769784c6e2a
- SHA1 4e588d4704128e65f9a9291d0641abc96f717d02
- SHA512 e52b094e6807de95e80dc118a2784855cd4bf54ea796293e67d1a150450f9b9723416401d6bf027a778c191ad4dc20e5265f32ccdf143317e441f54f06dfae6d
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDar:b70R
- TLSH T1C896AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_close.png
- Size 26.4MB
- SHA256 75c9430491378e0d8aa19eb50c73c8e6d164ed9c3d3d4ee84132a6b14a5921b9
- MD5 171389226f041b3f89c3f8cf4bd7a2c0
- SHA1 af6b90408ea482e2c722def5868061dd86116618
- SHA512 70298e6be3c5479efb8a345449a7dbeaea0258b8a1b570d6bd4a292adda749a363c9ad22c0e927968f70e0bab18613d14dbf393edd456fe20adcf8e98550665f
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaZ:b70F70Q70o
- TLSH T17757AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_close.png
- Size 35.1MB
- SHA256 3609ed291ea7fcb5935ba1bc6051d58de2f48756384822970f6b88ca63256756
- MD5 d2fffeada79402ef7a0917965c011e1b
- SHA1 9b9f3ae50b34329452ba6e5df599849d5f958f1e
- SHA512 5c9cf6bf6819eacc878c7cdb3030e13c2f51a2b92d21c27d02430a66c62ef530ed0b7b2e902fa84d514049aa83328491f72e12340e8472878f5082a820edc393
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaH:b70Q70F70Q70i
- TLSH T1F787AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_hover.png
- Size 43.9MB
- SHA256 c9b4f2d55e9ec2065e005dfae139edaf2e11063944e21361160f25dc80cfa2d9
- MD5 460ebcbd01e28f85681f5d1894b40427
- SHA1 d1175358c327b4637b62d55cc7505f7114ea35b2
- SHA512 1dfce2c3880536750f071308ab95819d70e10e775443883d83a0378f704cdb48daa60db20456c75607336520dad226cd2be4913546b48f2b19536ca99309a55b
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaS:b70F70Q70F70Q70s
- TLSH T138A7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_hover.png
- Size 35.2MB
- SHA256 b42f90a8f6f9a04d83ccd671714a2c31bf8019162fdad3809d66c1080d455565
- MD5 8cd1350dc8932ff496dc4f24c3f908bc
- SHA1 73b2da7d97a8d0f6116c02db74ea69bf8a025059
- SHA512 d949840b417b76c86b3bd2b3b6314385d134b8bf2c9e12c20d504eeee5832adac3f9bfda38a4a16f115081e6dd4cc343ae9d53c835c46a9f6825276f941703ba
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDae:b70Q70F70Q70F7h
- TLSH T1D487AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_hover.png
- Size 17.6MB
- SHA256 d30163e51485b53531455439d4c020863924f60bf3eadbaa9912350b3a16a693
- MD5 2d5c95bfaa652b5d13fda1c27b4b58e0
- SHA1 25a37e5fef94578b9df8fcdbedef1f313b3d0fb3
- SHA512 a4a574d92ee13d3b234c45b8d3c1c1d984a58aa121c36cc714bd8f8fab773db5041134899471eb4771f95f7079bf5c303b8c81fa4f91d813f0f4e425fc252f34
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaj:b70Q70d
- TLSH T18007AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_hover.png
- Size 26.4MB
- SHA256 8572edd13d68cc47ecc324b742b3bd324191399c13488d271f88aa2b17693735
- MD5 7190548904a0cb3701e920851743d251
- SHA1 2f320f758fa4a87953c4e418985be24ff86d6f8e
- SHA512 f70070e249e2a60a5b8da7f998dae4ad096a6ed835e7adcbe15bf1f2126b93a10d6df4113ea0e2c2f8d98bee3a71dfa2957dbc0afb35ea634a75b10dec79d7e1
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDas:b70Q7LQ70
- TLSH T13657AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_hover.png
- Size 35.1MB
- SHA256 231f8b0a9c821f2064a145d5d8d15df8de13b28d417b835a9b8fc4cafcdd6453
- MD5 a265cb5ed248bad6621a77ef09bed576
- SHA1 918f7f53ab4eabe2e42dd90b478020ceaf694f60
- SHA512 b0a2d706d2eec2c7c354392495d1381ebbb979677dda2ee2d1fd118489caac5e9360e700b1b7e01d3a7950094e510870edce57fbf7c6b91985b7ee08248897cd
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaM:b70Q70F70Q70x
- TLSH T15087AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_maximize.png
- Size 43.9MB
- SHA256 02dd88a99287cc82161b0e5c802ee9782a8fd2d918e255109f4e7d9b3ec6aad9
- MD5 82bc24e7f0aab4a564bde54e0c0ab1a1
- SHA1 1aa77db751f64dcaa6794904ee4ff8bfaae7f17b
- SHA512 22cf88207a53d61bc450ce2a684dad59d6ff2ca9097fc43db18234fca57892dab121f8f8ef46d340b571fd391eff26c2fce32ae3c022ba9a24e5320de635c54b
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaK:b70F70Q70F70Q708
- TLSH T15CA7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_maximize.png
- Size 22.4MB
- SHA256 27f7c358705fd9adeb028717ae1daa498d87ab5a026fbb77bdd7357455728f7b
- MD5 ae77ea1bd5e73238ab9a9e7bae7541a6
- SHA1 0255e0ef3becf75eb036310e1552c5d6c1a83269
- SHA512 a44abbbcfe74182c3b14b4b8183f790c2f96cac1599886654f54786ebdafad475d4fa1ade117ab667f072e86dc7bfd64f29428f1732357f91a45a23e6141c911
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaD:b70Q70F7v
- TLSH T1DD37AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_maximize.png
- Size 17.6MB
- SHA256 0c204e5ce9e536f4861425986d8797ba14781c80d5042e0bb0a764f2b2c9eae2
- MD5 05f691ccbe8fda591252e438800271eb
- SHA1 cb6323bbe2846adb24a7be599c2a46354995939e
- SHA512 6e5c52c53c8372acb824c2639023269eca16b94ab1622a7c4b32e99e696d59b8f27db79a948fb29b3b2524580cd6c2987b8affb2e4cd5f31d1c3c3b7fe55bbae
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaO:b70Q70k
- TLSH T17607AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_maximize.png
- Size 26.4MB
- SHA256 e958678fa5bfac3fb7057e1c67a9327472a6655dff3a60a8ce50d44cb89694bb
- MD5 287bd46ab6e4c4ba7b0e03d35a335e12
- SHA1 abcb732217482e1604e921c9af3eb95f94b5348e
- SHA512 d292fe6e841e3739626f88ba3b00f05538931d204556d78ec31962e4b41cefca4f5f51486d4cf4778f881e8a67334601324709dd7f3520934cb6cb073fbf4c92
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDa9:b70F70Q70g
- TLSH T1C257AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_maximize.png
- Size 35.1MB
- SHA256 790a0c4904fc8edbe9cebbeb71663b0f4ff7a4c13c9bf762a22b12c37f7daa36
- MD5 f01bde34c2838cc98c2efb46e60c9a52
- SHA1 30177f778ff49a91d3cbacb7968961376b3dace2
- SHA512 f32aad95ab882b9b332c1cb572415a08b8404b7830cd8a447ca63245610821f76781943e3905dc623808e31a588559cc7282fd04d6cd56e49548d714490245ff
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaH:b70Q70F70Q70O
- TLSH T17487AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_pressed.png
- Size 43.9MB
- SHA256 d5d39cdb4281bca0776729f288a0d9e43c448309e48ac756424b596aa149c9ec
- MD5 ab7a02a3da1b0cec224c69cf1142be99
- SHA1 157961f050815d1480bc5426ac7c156c7fbfeffc
- SHA512 2727e5691b585dc56b27c82a367a72db007c2cccbd7dea2e0a347d9224adb25eef60e8ca3c81c364a3f098f56b1e1cfd3181f6ec1a7c074b5d290d4d1928fe40
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaR:b70F70Q70F70Q70n
- TLSH T1C1A7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_pressed.png
- Size 14.2MB
- SHA256 8b7a6a26857e1dd3513d0ce1f15242efe96bea06cdbdafa7f4bf149a39209357
- MD5 7c95666b19fcfa22d2207a29a752595e
- SHA1 13f1f318618d6dc1947f17655dd252c713f4d730
- SHA512 ac25af2fc01da86cf186f09c1e4c14aba634de6bbc128495dea675687e874425c5654dcc87989f1c6f62d814236dc2fa5e7e6afe6d20274c163ca7c4257d629d
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaM:b70Q75
- TLSH T16AE6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_pressed.png
- Size 17.6MB
- SHA256 db6796809534df89c7ec8e900a547ac800244363e8834587d02dfad553b60824
- MD5 12f42ac49c16bd10b39766b4f087cada
- SHA1 274a76c7efb1595b44d43af6bae96ae2a77f922e
- SHA512 c6c59f5640b6f17429ae02d21984b4da5e0f14676bbda30060ff8967b91226738c0446d8c57a3c6e76ba37d3172232851ba8041008445eae65570dc68d622f75
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaU:b70Q70q
- TLSH T12B07AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_pressed.png
- Size 26.4MB
- SHA256 448b6059b04b003a38375b824fada33b7e46c1c8276485a86d658bfeb3edb562
- MD5 8467430cdee5ed5d26853fb1fa96c33e
- SHA1 11913859fc54611b50d073d292dec183aa54a526
- SHA512 5d5f15f5c37df9a8343a6065d0626a0f08eac6d49940d0a3e11ae6921db3a332a77c3902e591395589354d3de7204c586109f74e3fbfa1fbcb59525b0c44f5d3
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaK:b70F70Q70
- TLSH T13757AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_586460945\CRX_INSTALL\images\topbar_floating_button_pressed.png
- Size 35.1MB
- SHA256 e328d4872c3c5d156fc51f1bcb4879144a1eecaf764d06db6285225b0ebb0878
- MD5 b27aa47db4d4aea2303f63b649eb97b0
- SHA1 462d3eacb0c62eb203cfc013f188cfb0dc8e3525
- SHA512 fe2cd7fadc34375111014f046fc24e1a7003bafca82393067cbc867401a550c5ed4efad4e575c473079da6bcc4e7552b212f1f90a127848c6e5080dbd3151372
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDar:b70Q70F70Q70u
- TLSH T10187AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\W_X_C.vbs
- Size 195B
- SHA256 fcd4caa16972bd061f0f8c90cb83f5918268042675a610eb1ebc7a8772c0d1aa
- MD5 01567f22fae81363155719e1d1f9c002
- SHA1 9e5b54c718983bbaafe12d23dfa55d09a7987dbf
- SHA512 fe36229a55c94cd7837caff42edea58869dc6150001e6e54e2f8eacb812cd8b3ef5ee83bfbe30299e438e3f50f9e6e4620902561719c7653f01d8c30c864f636
- TLSH T1EFD0129266264523927261D10359C44A8774D1413572DB269189A9552132AD6807868F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\hosts.exe
- Size 8.8MB
- SHA256 3093f519e4dbfce0d5021ff10195a1c923fdda73bd4ce14ba616019ce57236ec
- MD5 6171d4e230309803de8a79ae5676323f
- SHA1 79e47458d08a365dc5ec6b2de6cfb6deaf75231e
- SHA512 d71c51b521eff00c6d6a2a736d9b5250b5d07202af0704c78217c4bb51e2b3b7412b63ec1bdeec97b25607ecdedcd3ec35db1fd87e1301208dcd663bc966d50a
- SSDEEP 12288:b7IoSOaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDao:b70G
- TLSH T1E896AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\W_X_C.bat
- Size 336B
- SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
- MD5 4db9f8b6175722b62ececeeeba1ce307
- SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
- SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
- TLSH T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
- MD5 SHA1 SHA512 TLSH