b12feecbf4be824d2da940c61be4f208d9f800bc589e00344de9714c404704b0

Analysis

max time kernel
151s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_j68009.exe
Size 53.8MB
Sample260806-wp8bhs1tet
SHA256 b12feecbf4be824d2da940c61be4f208d9f800bc589e00344de9714c404704b0
MD5 0ecbb0e4477ad8d68b279c4d14dec859
SHA1 c6ca15a8c30e06b66387fd1c4a88458ce91f52ad
SHA512 6b3f6e1ee659ef063984661aeb6424d9f0e197e79113f6b557891468d74cc983447e95bce3f09d05f33a600fb01c7577beae4bc7875aff3a65d94df006485a3d
SSDEEP 196608:0Rnm6/XXV2qJW/uAw1+uyLhAGRjEfM3rGc:QrXOLhJRuG
TLSH
T189C7E803B60ADDD2F546A2348CF582E46339FCF089A5D7437294373A6FBE2885FA1654
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5104	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5624	FuLp1t.exe

Loads dropped DLL 1 IoCs

pid	Process
5624	FuLp1t.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5016	cmd.exe
8	cmd.exe
1708	cmd.exe
4860	cmd.exe
5928	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	FuLp1t.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5908	cmd.exe
2764	cmd.exe
2108	cmd.exe
3712	cmd.exe
2952	cmd.exe
4780	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2800	schtasks.exe
3276	schtasks.exe
1664	schtasks.exe
3800	schtasks.exe
200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5944	setup_j68009.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe
5624	FuLp1t.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_j68009.exe
"C:\Users\Admin\AppData\Local\Temp\setup_j68009.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5944

C:\Users\Public\GqUuth\FuLp1t.exe
"C:\Users\Public\GqUuth\FuLp1t.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\GqUuth\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5016
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\GqUuth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2800
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1828
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:8
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3276
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6104
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1708
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1664
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3800
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1192
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5928
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:200
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5240
- C:\Program Files (x86)\CUb6ck\Yib5Ch.exe
  "C:\Program Files (x86)\CUb6ck\Yib5Ch.exe"
  2⤵
  PID:5936
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CUb6ck" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4780

C:\Users\Public\GqUuth\FuLp1t.exe
"C:\Users\Public\GqUuth\FuLp1t.exe"
1⤵
PID:2620

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\GqUuth" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5908
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\GqUuth" /t REG_DWORD /d 0 /f
  2⤵
  PID:5896

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3516

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2764
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3720

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2108
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:2428

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3712
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:3848

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2952
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:5968

C:\Program Files (x86)\CUb6ck\Yib5Ch.exe
"C:\Program Files (x86)\CUb6ck\Yib5Ch.exe"
1⤵
PID:5252

C:\Program Files (x86)\Gl21G6\3GYYecCc.exe
"C:\Program Files (x86)\Gl21G6\3GYYecCc.exe"
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\CUb6ck\XPSPLOG.dll
Size 416KB
SHA256 6ef128e290e87b7d348efe3a41de50f00c382f142a84e9cc64242bd96a3bc37b
MD5 13c152312a6376432ff58c15561dd1b4
SHA1 9ba921f8d9827463c88dcf28e9aeb3f656c3f18b
SHA512 bc3d4bc7e6313a246636a6df1829b76c516e9e7d31e06d0cc6c69d14d5d555c1db6b924a7443586cd06ebdc3c3bec675dd2419e009e96d42e6de62e66cd7a08e
SSDEEP 6144:VGfQzVDspcR5LOuFQyDsy8OOnk8oNkLBHtDKqlAoW61o0PIhRyySIw1ATnUHUUo:6Qls2PLOuWhkdNkXDKLReoDhRyoTU0Uo
TLSH
T12B9422E22283052AFE457A719B8CFC7C71B565EC1267CD29E4C676834C769F5203928F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\CUb6ck\XPSPLOG.dll
Size 398KB
SHA256 53fbf69345f514952288d1076d5a8e456e70a37d65d39e3488e72e572f76c770
MD5 6f9a5c6c6d946df467f9131d8cbbbadf
SHA1 704953bd88046942fc6c387f2f8b881806bd1e1a
SHA512 67cdd13ba52caecdbefd3a17028a6e6043cf7e2a64943f202f9b4c25286cc6788f39456d0903c9b7b06928986ef4d7316709ddf058edd6c6e8a2fc1b495f5085
SSDEEP 6144:VGfQzVDspcR5LOuFQyDsy8OOnk8oNkLBHtDKqlAoW61o0PIhRyySIw1ATnUHD:6Qls2PLOuWhkdNkXDKLReoDhRyoTUj
TLSH
T1069422E22187092AFE4576719A8CFC7C32B5A6EC1257CD2AE0C576C74C769F5603828F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\CUb6ck\XPSPLOG.dll
Size 102KB
SHA256 97d1ff9d7f8ac28fb2e933768c9ae88d83ac841be14f7561eed66f5513a842a1
MD5 d71936330db1b54534cd68fa4fd54915
SHA1 87f6c32bc6a3bfecf8a2d0423a1060f4d2c8ced0
SHA512 6368a63f287dcccf0198eae0afcbcec3b89b3e4fe44cdf1d6d26bac2c06e4cc19fac1c859a3a0cce5ee6c8cac9f22ba1770359e91018ddf7ea85b050312517b8
SSDEEP 1536:o2gRD26twkyYSle/qhRZi/IaefvxLhHOdX0D15tCXfR4tB3CFaklEeMXSrse+btk:VuDVfyYAkejiAJphPDdCpcB3CFtM+qk
TLSH
T18AA312A583DB0E1AF140B875190DE51D7BFB56F8415E4E08CCA9B4C59C386A530BF6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yib5Ch.exe

Path C:\Program Files (x86)\CUb6ck\Yib5Ch.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yib5Ch.exe

Path C:\Program Files (x86)\CUb6ck\Yib5Ch.exe
Size 101KB
SHA256 46828e4612cbf01f3d59cb7d77a7e1d4eb9d7d30c70daabc2ec382f8f72329f3
MD5 4ebd6a6f454f9f7dbbf0e841f5511ced
SHA1 1f33a1d679b2ca1403605f47628d0c5e0136bde2
SHA512 b49d129f8b4b236a8da0272ee018b70b7ad0842962bdef28e8bc64d30eb025572c9e3f00bab88182404698e9352d72f995759d7f8e33eeed15b9d31dcdaeb4f7
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvt:Yz8upLGaPQDnF
TLSH
T188A30952B6C18461F76A0B311864E9E14A6EFD381E90ED5FF368393A1E305C3893796F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\CUb6ck\image.png
Size 332KB
SHA256 adba1cdbcda42c0c9a1d99baf5b3e6b82c2387ff559c39692376785129ba636b
MD5 585bec66dc0e053e4f5c5560e65a6e0e
SHA1 577aaeb9dca474f7e43ce75780ebc424651ba2e5
SHA512 ceb127ac949756d637324e3a62d930eb4a85e18fa26361e3a4eb75b176561bd00f432e98eb0947689444dcf4ba8252cc675499ff08d96d3033b1ff638e997b31
SSDEEP 6144:y+iVdDjOLxqmi+h2FJKNzgTmYssB8ljKTLr+5UnGCCTgL36YSJ0dLGLCK6R:y+iVdOLoz+h2igqpsBtyOnDCTsKYSJ0R
TLSH
T15B742332E1FE491B4BCA45D6AEC06551CA6D21F0C2B0CD5317DE534AFFCA4A0362ADB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\CUb6ck\thumbs.db
Size 156KB
SHA256 bac30576561c774bedf559bdafa9e42d7cc814d392b2ced8d760155c80a6ad0a
MD5 658c1ab5e876a344f47731f6f3544eb0
SHA1 467ace0e9d0d37a99d9e374d65a7d827cafb2e41
SHA512 751596fa0c99b92f2d8981e4629e77c14163ca4228fe069a2cb281de2d60f0ecffdde7f11df50e4ce29fa0934763feeaf217de5cd5d5e5d3c2e6f15a7f02ea49
SSDEEP 3072:3HOKbHuACkEJOfY56psul290aneNoSRowxHWxvVJRyzD1ow:JiACk/u6n9aBOmmD1ow
TLSH
T1FBF31298B5812ECB5E27DF6CF0871C2DD88E9457179900163BF2C4C1CA146BBC68EE6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3GYYecCc.exe

Path C:\Program Files (x86)\Gl21G6\3GYYecCc.exe
Size 118KB
SHA256 0ea69cc18d2c6fa33c8ac94f79469a4609e40fc371bbe92f0501cc7ec9a4da96
MD5 70be4e8468b5eef8f9d4cf7ddf26923a
SHA1 412842cf974d887f746757051885875da21b13e2
SHA512 755112c13cd8435afc60853fe04a99c40d27da6cfc84e0fab8bd53b58410647771fa082f78e0cd6bc07bb7c4f9e1a9dc0509a3c6aca1cd1e1177714c0539da11
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzg:Yz8upLGaPQDnFzg
TLSH
T117C3F852B6C18464F76E0B311865E9E04A6AED380AA0E95FF37C7D3A1E311838E3755F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3GYYecCc.exe

Path C:\Program Files (x86)\Gl21G6\3GYYecCc.exe
Size 93KB
SHA256 fbbb3a736807b5e59a295839a3636e6743844c3e9c3e7d20ecc8ee3090b4fe4e
MD5 a6fa3c15916ee662ce47e7b08200a85d
SHA1 b3b66c5e7daff64cb69651d18a481a5ec0ba156d
SHA512 4353294e351c8dca0b35695dff3d3f0be1a1f2476cf5ac957d699f74beaaf8bdc5dc111c6c92feb928b2d2e6b21593abe8541211d57bd422b99fd9f216e22dbb
SSDEEP 1536:AOJ5kh1iOUcZGuYDKM95YRTqWLGzwzzBCLHvaOkYrofdRsW+3cdxtBQDTCCvt1:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCO
TLSH
T1D2931B52B6D19475DB7A1B310864C9614A6EFD300E60AE6FF3783D3B1E305838E2796E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\Gl21G6\XPSPLOG.dll
Size 384KB
SHA256 097a9769d9495ef12bae5126c6272c2080092f1280c2ec93dbad81c4aa9fe496
MD5 7a23a536f72ee2f8da9e121b2ead9733
SHA1 61f8fc0dc87957e6bce273cfc6336456807ef4bb
SHA512 3de78ab8e108d01b8c04cf0bc2d7e22fa4292eb5ff47b05a25fd09cdda541ea00d831339091bc2780f46be3036ef6faeb41282fd09db380799dcd7d792c997f4
SSDEEP 6144:VGfQzVDspcR5LOuFQyDsy8OOnk8oNkLBHtDKqlAoW61o0PIhRyySIw1ATnU+:6Qls2PLOuWhkdNkXDKLReoDhRyoTU+
TLSH
T1B28412E22197092AEE057A719A4CFC3C32F665EC135ACD2AE0C5B6C348765F5603958F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\Gl21G6\XPSPLOG.dll
Size 167KB
SHA256 992d55893054e920c4a6aa273a91d3d915cdc49c32f96c97a0450e2dc0f34825
MD5 c31756e75e7f768ddab3147affc6815f
SHA1 bfe54136f8a5a631cdd2d1b1a3121bee6d347a86
SHA512 4dc5911bbcd695d03b2ef5947ab2fbb9bf31ad5d24c110735036377c1b8809f98c61cefdc619bdbe14a72b52e682705ce6b6b326a5abf5bebba12d30e96f0799
SSDEEP 3072:VuDVfyYAkejiAJphPDdCpcB3CFtM+qOuF6cdmFyrf/snch8O1E4t6Hw:VGfQzVDspcR5LOuFQyDsy8OOw
TLSH
T10FF312E143D70D0AEE01B9715A4DBA5C71FB6AFC464B4E19D8C5B0CAA87A2B1307D4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FuLp1t.exe

Path C:\Users\Public\GqUuth\FuLp1t.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\GqUuth\UxEnhance64.dll
Size 3.1MB
SHA256 8245b23fcff8a20959ad3c6bb449f43082af21f834f59f092e5a16df3f5a260b
MD5 dcd25d7dec7ae7a444007d01675043fe
SHA1 58b255ae89ab81cd6d119a8fb35d0a3fb9a2727a
SHA512 a89c26097ed0802c36b7a3bedd2dcf7555e1ac31ea2ce7ac0809767710227395cc1076e913d53417339da39176d830856141247d89959b2f5478b98ee08e794f
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+x:P9m29xx3Tiqt06ox6+z2rNNrKox
TLSH
T1C5E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\GqUuth\UxEnhance64.dll
Size 1.8MB
SHA256 b01ed15a0184a3ba6cacffb397e3cb6b9b39a660237e169c89b34aa8bf24fe80
MD5 9254a741ccdd17c21be67b1005a8ba8f
SHA1 a20fa10aa7618bd03efcab0504ed76717a3f0288
SHA512 5ef0087ba79a00610010d42f2caa2939bd3df59ce9e9bc6ebedaab77f25058b9da0eba70ee4b50e15e1bd931ee5465aebe3acc6558aed08c12b10e2fd2724211
SSDEEP 24576:WTa0QKHReqZIMlcseQCIHfrPqxkglC6BKVu/ayHXBTswHCMJU5bmNlKQ3w8BtSeM:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXw
TLSH
T1639523F563A738F3E9361AF4FD7197C61D142E203F07648F275B20164A991BB83AA394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\GqUuth\adoresd.dat
Size 3.1MB
SHA256 c8eb9836a5cb8b97e7d898cd5983d5172b1fa9fde113a596add472a87f34851c
MD5 85cfe7a812426975c0d09d5664be5303
SHA1 18cbd4e33cb329897149e020aeb047ab1a96ea3c
SHA512 1a388114e80677fee8c2131fd4b4cb04f59b615b6306ac78dcf9d746b9a7a591f9ed32b3a80ebca8cf77cc691b4f9ce5fb927bbd38ad5d439681e58bc1ee9f48
SSDEEP 98304:gmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2iU:7u1SwOflfZPF6Ma0bI
TLSH
T1ACE533798BDB908693DB2745F26EC8E82EF1F73A7DAD628581B5200DE9714CF5012F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\GqUuth\msadox.tb
Size 8KB
SHA256 def6965db0d3f12f3802c5c1e8916634aad920b35a54850b91a99edfce09a1af
MD5 9c33dfbf120798313882b428ef475a80
SHA1 3520d11ed4f831123ad7615aeeaa958ba9d5c656
SHA512 7c630fc5a128dd6e2d96f1f330171d52b37582a53c86ed94e9461f201327ced9b3a6d608850a126f9e750096f3c51683b213402157ed168533f8e5b0ddfcb42a
SSDEEP 192:2qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:2sZqZOXQ3uqvR2Kfzp
TLSH
T1F7029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2316-722-0x0000000074570000-0x0000000074CBA000-memory.dmp

Download

memory/2620-586-0x00007FF800630000-0x00007FF800632000-memory.dmp

Download

memory/2620-583-0x0000022115C90000-0x0000022116521000-memory.dmp

Download

memory/2620-577-0x00007FF800640000-0x00007FF800642000-memory.dmp

Download

memory/2620-574-0x0000022115C90000-0x0000022116521000-memory.dmp

Download

memory/2620-571-0x00007FFFDD990000-0x00007FFFDDEAE000-memory.dmp

Download

memory/2620-578-0x0000022115C90000-0x0000022116521000-memory.dmp

Download

memory/2620-584-0x0000022115C90000-0x0000022116521000-memory.dmp

Download

memory/2620-582-0x0000022115C90000-0x0000022116521000-memory.dmp

Download

memory/2620-585-0x0000022115C90000-0x0000022116521000-memory.dmp

Download

memory/5104-592-0x0000021CA4900000-0x0000021CA4922000-memory.dmp

Download

memory/5104-601-0x0000021CA4B70000-0x0000021CA4B8E000-memory.dmp

Download

memory/5104-602-0x0000021CA4B90000-0x0000021CA4C42000-memory.dmp

Download

memory/5104-605-0x0000021CA4960000-0x0000021CA496A000-memory.dmp

Download

memory/5252-711-0x0000000075130000-0x000000007587A000-memory.dmp

Download

memory/5624-543-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5624-537-0x00007FF800640000-0x00007FF800642000-memory.dmp

Download

memory/5624-565-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5624-562-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5624-555-0x00000173EA8F0000-0x00000173EA93E000-memory.dmp

Download

memory/5624-556-0x00000173EC1F0000-0x00000173EC27A000-memory.dmp

Download

memory/5624-560-0x00000173EC1F0000-0x00000173EC27A000-memory.dmp

Download

memory/5624-558-0x00000173EC1F0000-0x00000173EC27A000-memory.dmp

Download

memory/5624-557-0x00000173EC1F0000-0x00000173EC27A000-memory.dmp

Download

memory/5624-549-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5624-545-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5624-544-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5624-531-0x00007FFFDD990000-0x00007FFFDDEAE000-memory.dmp

Download

memory/5624-529-0x00007FF800630000-0x00007FF800632000-memory.dmp

Download

memory/5624-542-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5624-535-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5624-564-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5624-538-0x00000173ECCD0000-0x00000173ED561000-memory.dmp

Download

memory/5936-686-0x00000000038E0000-0x00000000040E7000-memory.dmp

Download

memory/5936-683-0x00000000038E0000-0x00000000040E7000-memory.dmp

Download

memory/5936-681-0x00000000016C0000-0x00000000016C1000-memory.dmp

Download

memory/5936-693-0x0000000002DA0000-0x0000000002DB4000-memory.dmp

Download

memory/5936-679-0x00000000038E0000-0x00000000040E7000-memory.dmp

Download

memory/5936-674-0x00000000016A0000-0x00000000016A1000-memory.dmp

Download

memory/5936-705-0x00000000038E0000-0x00000000040E7000-memory.dmp

Download

memory/5936-675-0x0000000075130000-0x000000007587A000-memory.dmp

Download

memory/5944-0-0x00000000055A0000-0x00000000055AD000-memory.dmp

Download

memory/5944-524-0x00007FFFF0E50000-0x00007FFFF0E62000-memory.dmp

Download

memory/5944-523-0x00000000055A0000-0x00000000055AD000-memory.dmp

Download

memory/5944-503-0x00007FFFF0E50000-0x00007FFFF0E62000-memory.dmp

Download

memory/5944-1-0x00000000055B0000-0x00000000055BB000-memory.dmp

Download