ee4913068357835daf7d5cb65f4f751747609d2408c12590ddd2b9070d82d952

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inst_smt008.exe
Size 55.2MB
Sample260805-a6vwvsbc22
SHA256 ee4913068357835daf7d5cb65f4f751747609d2408c12590ddd2b9070d82d952
MD5 4d427c0e5bdefb3eb0de90f096160d5e
SHA1 f25c0880f2649449ddfd96a07cddc2fc2e74d267
SHA512 1b72171338f8e72cbff2f6772b9897a4ce21aeda45cdf19b809173f7929bf73c7f9f8687f4e24475f8ad76334a01c5c1cbcbade2b1bd21d08337ede56c22deb5
SSDEEP 196608:InnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps6U:iSRe9QD0
TLSH
T1CEC78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\jJBQw3 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2576	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1524	ALeR0w.exe
2144	ALeR0w.exe

Loads dropped DLL 2 IoCs

pid	Process
1524	ALeR0w.exe
2144	ALeR0w.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\jJBQw3\\ALeR0w.exe\""	ALeR0w.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5984	cmd.exe
2032	cmd.exe
4892	cmd.exe
2772	cmd.exe
4172	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	ALeR0w.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\vCGsDN\bqMqsF.exe	ALeR0w.exe
File created	C:\Program Files (x86)\vCGsDN\thumbs.db	ALeR0w.exe
File opened for modification	C:\Program Files (x86)\vCGsDN\image.png	ALeR0w.exe
File opened for modification	C:\Program Files (x86)\vCGsDN\thumbs.db	ALeR0w.exe
File opened for modification	C:\Program Files (x86)\vCGsDN	ALeR0w.exe
File created	C:\Program Files (x86)\vCGsDN\XPSPLOG.dll	ALeR0w.exe
File created	C:\Program Files (x86)\vCGsDN\image.png	ALeR0w.exe
File opened for modification	C:\Program Files (x86)\vCGsDN\bqMqsF.exe	ALeR0w.exe
File opened for modification	C:\Program Files (x86)\vCGsDN\XPSPLOG.dll	ALeR0w.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5200	cmd.exe
964	cmd.exe
5280	cmd.exe
3360	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3532	schtasks.exe
1572	schtasks.exe
1852	schtasks.exe
4244	schtasks.exe
2428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
4368	inst_smt008.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe
1524	ALeR0w.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeIncreaseQuotaPrivilege	2576	powershell.exe
Token: SeSecurityPrivilege	2576	powershell.exe
Token: SeTakeOwnershipPrivilege	2576	powershell.exe
Token: SeLoadDriverPrivilege	2576	powershell.exe
Token: SeSystemProfilePrivilege	2576	powershell.exe
Token: SeSystemtimePrivilege	2576	powershell.exe
Token: SeProfSingleProcessPrivilege	2576	powershell.exe
Token: SeIncBasePriorityPrivilege	2576	powershell.exe
Token: SeCreatePagefilePrivilege	2576	powershell.exe
Token: SeBackupPrivilege	2576	powershell.exe
Token: SeRestorePrivilege	2576	powershell.exe
Token: SeShutdownPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeSystemEnvironmentPrivilege	2576	powershell.exe
Token: SeRemoteShutdownPrivilege	2576	powershell.exe
Token: SeUndockPrivilege	2576	powershell.exe
Token: SeManageVolumePrivilege	2576	powershell.exe
Token: 33	2576	powershell.exe
Token: 34	2576	powershell.exe
Token: 35	2576	powershell.exe
Token: 36	2576	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2576	1524	ALeR0w.exe	92
PID 1524 wrote to memory of 5984	1524	ALeR0w.exe	94
PID 5984 wrote to memory of 3532	5984	cmd.exe	97
PID 1524 wrote to memory of 2032	1524	ALeR0w.exe	98
PID 5984 wrote to memory of 5512	5984	cmd.exe	99
PID 1524 wrote to memory of 4892	1524	ALeR0w.exe	103
PID 5984 wrote to memory of 1780	5984	cmd.exe	105
PID 2032 wrote to memory of 1572	2032	cmd.exe	107
PID 4892 wrote to memory of 1852	4892	cmd.exe	108
PID 2032 wrote to memory of 556	2032	cmd.exe	109
PID 4892 wrote to memory of 1744	4892	cmd.exe	110
PID 1524 wrote to memory of 2772	1524	ALeR0w.exe	112
PID 4892 wrote to memory of 4304	4892	cmd.exe	114
PID 2032 wrote to memory of 3384	2032	cmd.exe	115
PID 2772 wrote to memory of 4244	2772	cmd.exe	116
PID 2772 wrote to memory of 3488	2772	cmd.exe	117
PID 1524 wrote to memory of 4172	1524	ALeR0w.exe	122
PID 2772 wrote to memory of 3504	2772	cmd.exe	124
PID 4172 wrote to memory of 2428	4172	cmd.exe	125
PID 4172 wrote to memory of 3668	4172	cmd.exe	126
PID 4172 wrote to memory of 4048	4172	cmd.exe	128
PID 3360 wrote to memory of 3256	3360	cmd.exe	130
PID 5280 wrote to memory of 5032	5280	cmd.exe	131
PID 5200 wrote to memory of 3044	5200	cmd.exe	133
PID 964 wrote to memory of 4712	964	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe
"C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368

C:\Users\Public\jJBQw3\ALeR0w.exe
"C:\Users\Public\jJBQw3\ALeR0w.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\jJBQw3\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\jJBQw3\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3532
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4244
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4048
- C:\Program Files (x86)\vCGsDN\bqMqsF.exe
  "C:\Program Files (x86)\vCGsDN\bqMqsF.exe"
  2⤵
  PID:5244

C:\Users\Public\jJBQw3\ALeR0w.exe
"C:\Users\Public\jJBQw3\ALeR0w.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\jJBQw3" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\jJBQw3" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3044

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3188

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4712

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5032

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\vCGsDN\XPSPLOG.dll
Size 4.6MB
SHA256 ec65fe13b6b182a2373a35e73025772b0053326fc1ad87f9e419fcbbb37c0713
MD5 3e78074bc807c0926887fd54c86031e9
SHA1 c166372735fefc2581e621c379e42d80d09e6ead
SHA512 5de130610befd177069fa686561312e0fc5974425a2e3f91f374c6bf299ddf8ecb470ffcec0429bcf435dd3bef6a185965a49af7cda236e939a2d0df6215900d
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyO:BMWKfU+BcUTHCCCfqCiUffnO
TLSH
T1E1263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bqMqsF.exe

Path C:\Program Files (x86)\vCGsDN\bqMqsF.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\vCGsDN\image.png
Size 2.6MB
SHA256 09e1816239252d0db297ae9d242c9c75eb71207f3fcf826236cd82221201b56e
MD5 7d61ba26fadd61afa03ca217e041915c
SHA1 cae74075cfdc8fc188acdd5a0a2984df2eca1fdc
SHA512 bb8221ec9f18860bbc6119bd2da122b0ba6fa82c9b45b7c84dae59c0f7f04f240db0880bc91f29acc8708be16dcafe2fa786e895fc1bf2f1ff8db7ccd2678488
SSDEEP 49152:TVdAvUVBR9J/zSg51dyCub8jkUOp7eD9iL98n/g2ziSsI6lhLO0MMrOao:5qvO3/u21dcwj8esL9KK5MMrOao
TLSH
T1AAD53327923C515B7BE345D89A6012FEE6C208D0E4D0C9B83FCD0B7B667DE3A326A554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ALeR0w.exe

Path C:\Users\Public\jJBQw3\ALeR0w.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\jJBQw3\UxEnhance64.dll
Size 3.1MB
SHA256 1df1253cec94f3d71c4b44221af08b5f7f9b45f288c02a1e374aafae4daf3e07
MD5 e90042cba25dac18e3f6796878fd871c
SHA1 75199a3d627fb1bff157e54915837843207f3ed2
SHA512 21e628c4dbb3ba0135c4560de178c654dda49a7d7f545d959266d5354960f5755c3eb35cc9f26853ad86dadc8553e8a9464157d91e143c18bcf8bfb745a46092
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+r:P9m29xx3Tiqt06ox6+z2rNNrKor
TLSH
T1E6E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\jJBQw3\adoresd.dat
Size 4.7MB
SHA256 d9553b5477f44657173b8a743a8b4b1b0afebaef67ba98504687236bba0568f8
MD5 b3d7b9868956b9c77c32146d36059077
SHA1 79881ba3d49540910dbd119cb1da0574655d9e44
SHA512 264161bc58417c992c335d6560e73ccd6751bc575857634d1cb36a4f93b40358ff2d854647da0c7e6e2b6dc6899213581d183ec97f00fe535437bef690fdcc50
SSDEEP 98304:Umu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Xu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1BC3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\jJBQw3\msadox.tb
Size 8KB
SHA256 8528be2693acc8cf58c61c5777b4292426c1d7e95c54d584ddebd61306201f13
MD5 bc128cde6736b2cdde715a6e72442e93
SHA1 ec0d3284e7ccc3313ba7ace0ebce5859f22517c9
SHA512 40fadd3a076938af3800ebb87961762ab8879de70b178bcfa9ea3d3f6f83c07ac27f6cb9b8f9d6a77aad0adc548306b399c01510972f4ae031134e90481a2525
SSDEEP 192:ZqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ZsZqZOXQ3uqvR2Kfzp
TLSH
T1E1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-556-0x000001F763CB0000-0x000001F763D3A000-memory.dmp

Download

memory/1524-565-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/1524-530-0x00007FFB6D260000-0x00007FFB6D77E000-memory.dmp

Download

memory/1524-529-0x00007FFB8FD70000-0x00007FFB8FD72000-memory.dmp

Download

memory/1524-535-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/1524-537-0x00007FFB8FD80000-0x00007FFB8FD82000-memory.dmp

Download

memory/1524-538-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/1524-542-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/1524-543-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/1524-544-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/1524-545-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/1524-549-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/1524-558-0x000001F763CB0000-0x000001F763D3A000-memory.dmp

Download

memory/1524-560-0x000001F763CB0000-0x000001F763D3A000-memory.dmp

Download

memory/1524-557-0x000001F763CB0000-0x000001F763D3A000-memory.dmp

Download

memory/1524-564-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/1524-555-0x000001F7628B0000-0x000001F7628FE000-memory.dmp

Download

memory/1524-562-0x000001F763380000-0x000001F763C11000-memory.dmp

Download

memory/2144-583-0x000002AFD1CE0000-0x000002AFD2571000-memory.dmp

Download

memory/2144-586-0x00007FFB8FD70000-0x00007FFB8FD72000-memory.dmp

Download

memory/2144-571-0x00007FFB6D260000-0x00007FFB6D77E000-memory.dmp

Download

memory/2144-575-0x000002AFD1CE0000-0x000002AFD2571000-memory.dmp

Download

memory/2144-580-0x000002AFD1CE0000-0x000002AFD2571000-memory.dmp

Download

memory/2144-577-0x00007FFB8FD80000-0x00007FFB8FD82000-memory.dmp

Download

memory/2144-582-0x000002AFD1CE0000-0x000002AFD2571000-memory.dmp

Download

memory/2144-585-0x000002AFD1CE0000-0x000002AFD2571000-memory.dmp

Download

memory/2144-584-0x000002AFD1CE0000-0x000002AFD2571000-memory.dmp

Download

memory/2576-605-0x0000020BB7970000-0x0000020BB7A22000-memory.dmp

Download

memory/2576-604-0x0000020BB7950000-0x0000020BB796E000-memory.dmp

Download

memory/2576-598-0x0000020BB7920000-0x0000020BB7942000-memory.dmp

Download

memory/2576-606-0x0000020BB78A0000-0x0000020BB78AA000-memory.dmp

Download

memory/4368-0-0x0000000000570000-0x000000000057D000-memory.dmp

Download

memory/4368-524-0x00007FFB83E70000-0x00007FFB83E82000-memory.dmp

Download

memory/4368-523-0x0000000000570000-0x000000000057D000-memory.dmp

Download

memory/4368-503-0x00007FFB83E70000-0x00007FFB83E82000-memory.dmp

Download

memory/4368-1-0x0000000000580000-0x000000000058B000-memory.dmp

Download

memory/5244-674-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/5244-675-0x00000000743F0000-0x0000000074B3A000-memory.dmp

Download