7cd7a77d5de4cbfe67dd9f80d6e6e5bd57d83e0fd792573a292b87979daa400e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
appinst_up012.exe
Size 37.3MB
Sample260815-l322jsvsaz
SHA256 7cd7a77d5de4cbfe67dd9f80d6e6e5bd57d83e0fd792573a292b87979daa400e
MD5 fce6296ba1bdef5908cd42950ea005ed
SHA1 3bfe2a43df56e8a0d2b119355e0f7aa82733d949
SHA512 53682026ccd27509489c9cf150f1aa6cc05fc8b25c114dd0607a3a7c01a9db6e7eddd75d283b9de94d46e678d89fde803e48a46562d069b39ae2481170d328dc
SSDEEP 98304:dCWklLxG8rPZQi7kmeHh2yeH7rkfvVsJ6nwiNXUeAfT6sGFajFHFK8OeY:TcRQi7ZkfvVsNiVA+TajFHk8OeY
TLSH
T13387D712B607D99AE06652B9C4470FE0F321DCB09670873B23A97A5C7FFA74CADE5124
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	97PasO.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\SGD0bS = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4432	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	97PasO.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Executes dropped EXE 5 IoCs

pid	Process
1276	4g28bI.exe
3420	4g28bI.exe
5944	97PasO.exe
3488	97PasO.exe
3744	C9C6gF.exe

Loads dropped DLL 5 IoCs

pid	Process
1276	4g28bI.exe
3420	4g28bI.exe
5944	97PasO.exe
3488	97PasO.exe
3744	C9C6gF.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2388	icacls.exe
3388	icacls.exe
3632	icacls.exe
4364	icacls.exe
3176	icacls.exe
5640	icacls.exe
4468	icacls.exe
564	icacls.exe
3800	icacls.exe
824	icacls.exe
2608	icacls.exe
3040	icacls.exe
4976	icacls.exe
4312	icacls.exe
1380	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\kClnWt\\97PasO.exe\""	97PasO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\SGD0bS\\4g28bI.exe\""	4g28bI.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2300	cmd.exe
5160	cmd.exe
2976	cmd.exe
4276	cmd.exe
4040	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	4g28bI.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\kClnWt\97PasO.exe	4g28bI.exe
File opened for modification	C:\Program Files (x86)\kClnWt\image.png	4g28bI.exe
File opened for modification	C:\Program Files (x86)\T8BdiPn	97PasO.exe
File created	C:\Program Files (x86)\T8BdiPn\C9C6gF.exe	97PasO.exe
File opened for modification	C:\Program Files (x86)\T8BdiPn\image.png	97PasO.exe
File created	C:\Program Files (x86)\T8BdiPn\thumbs.db	97PasO.exe
File opened for modification	C:\Program Files (x86)\T8BdiPn\C9C6gF.exe	97PasO.exe
File created	C:\Program Files (x86)\T8BdiPn\XPSPLOG.dll	97PasO.exe
File opened for modification	C:\Program Files (x86)\T8BdiPn\XPSPLOG.dll	97PasO.exe
File created	C:\Program Files (x86)\kClnWt\97PasO.exe	4g28bI.exe
File created	C:\Program Files (x86)\kClnWt\image.png	4g28bI.exe
File created	C:\Program Files (x86)\kClnWt\thumbs.db	4g28bI.exe
File opened for modification	C:\Program Files (x86)\kClnWt\XPSPLOG.dll	4g28bI.exe
File opened for modification	C:\Program Files (x86)\kClnWt\thumbs.db	4g28bI.exe
File created	C:\Program Files (x86)\T8BdiPn\image.png	97PasO.exe
File opened for modification	C:\Program Files (x86)\kClnWt	4g28bI.exe
File created	C:\Program Files (x86)\kClnWt\XPSPLOG.dll	4g28bI.exe
File opened for modification	C:\Program Files (x86)\T8BdiPn\thumbs.db	97PasO.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\ScreenSaveActive = "0"	97PasO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	97PasO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\SCRNSAVE.EXE	97PasO.exe

Executes a command shell one-liner 1 TTPs 19 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5844	cmd.exe
204	cmd.exe
2912	cmd.exe
5716	cmd.exe
2140	cmd.exe
3956	cmd.exe
5824	cmd.exe
720	cmd.exe
1788	cmd.exe
3816	cmd.exe
5028	cmd.exe
1740	cmd.exe
4368	cmd.exe
2992	cmd.exe
1324	cmd.exe
752	cmd.exe
6092	cmd.exe
3068	cmd.exe
3844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	97PasO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	97PasO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C9C6gF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	97PasO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	97PasO.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\ScreenSaveActive = "0"	97PasO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	97PasO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	97PasO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\SCRNSAVE.EXE	97PasO.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1764	schtasks.exe
5780	schtasks.exe
2684	schtasks.exe
5112	schtasks.exe
3068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1612	appinst_up012.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe
1276	4g28bI.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeIncreaseQuotaPrivilege	4432	powershell.exe
Token: SeSecurityPrivilege	4432	powershell.exe
Token: SeTakeOwnershipPrivilege	4432	powershell.exe
Token: SeLoadDriverPrivilege	4432	powershell.exe
Token: SeSystemProfilePrivilege	4432	powershell.exe
Token: SeSystemtimePrivilege	4432	powershell.exe
Token: SeProfSingleProcessPrivilege	4432	powershell.exe
Token: SeIncBasePriorityPrivilege	4432	powershell.exe
Token: SeCreatePagefilePrivilege	4432	powershell.exe
Token: SeBackupPrivilege	4432	powershell.exe
Token: SeRestorePrivilege	4432	powershell.exe
Token: SeShutdownPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeSystemEnvironmentPrivilege	4432	powershell.exe
Token: SeRemoteShutdownPrivilege	4432	powershell.exe
Token: SeUndockPrivilege	4432	powershell.exe
Token: SeManageVolumePrivilege	4432	powershell.exe
Token: 33	4432	powershell.exe
Token: 34	4432	powershell.exe
Token: 35	4432	powershell.exe
Token: 36	4432	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4432	1276	4g28bI.exe	91
PID 1276 wrote to memory of 4040	1276	4g28bI.exe	93
PID 4040 wrote to memory of 3068	4040	cmd.exe	96
PID 1276 wrote to memory of 2300	1276	4g28bI.exe	98
PID 4040 wrote to memory of 2736	4040	cmd.exe	101
PID 1276 wrote to memory of 5160	1276	4g28bI.exe	104
PID 4040 wrote to memory of 3400	4040	cmd.exe	105
PID 2300 wrote to memory of 1764	2300	cmd.exe	107
PID 1276 wrote to memory of 2976	1276	4g28bI.exe	108
PID 5160 wrote to memory of 5780	5160	cmd.exe	110
PID 2300 wrote to memory of 200	2300	cmd.exe	111
PID 2976 wrote to memory of 2684	2976	cmd.exe	112
PID 5160 wrote to memory of 4156	5160	cmd.exe	114
PID 2300 wrote to memory of 6004	2300	cmd.exe	115
PID 1276 wrote to memory of 4276	1276	4g28bI.exe	118
PID 2976 wrote to memory of 4556	2976	cmd.exe	119
PID 5160 wrote to memory of 2296	5160	cmd.exe	121
PID 4276 wrote to memory of 5112	4276	cmd.exe	122
PID 2976 wrote to memory of 4496	2976	cmd.exe	123
PID 4276 wrote to memory of 4664	4276	cmd.exe	124
PID 4276 wrote to memory of 5340	4276	cmd.exe	125
PID 5844 wrote to memory of 940	5844	cmd.exe	126
PID 752 wrote to memory of 4512	752	cmd.exe	127
PID 1276 wrote to memory of 5944	1276	4g28bI.exe	129
PID 5944 wrote to memory of 6092	5944	97PasO.exe	131
PID 5944 wrote to memory of 2140	5944	97PasO.exe	132
PID 5944 wrote to memory of 1740	5944	97PasO.exe	136
PID 2140 wrote to memory of 3040	2140	cmd.exe	138
PID 5944 wrote to memory of 4368	5944	97PasO.exe	139
PID 4368 wrote to memory of 3388	4368	cmd.exe	142
PID 5944 wrote to memory of 5028	5944	97PasO.exe	143
PID 5028 wrote to memory of 2388	5028	cmd.exe	145
PID 5944 wrote to memory of 204	5944	97PasO.exe	146
PID 204 wrote to memory of 4976	204	cmd.exe	148
PID 5944 wrote to memory of 3956	5944	97PasO.exe	149
PID 3956 wrote to memory of 3632	3956	cmd.exe	151
PID 5944 wrote to memory of 2912	5944	97PasO.exe	152
PID 2912 wrote to memory of 4364	2912	cmd.exe	154
PID 5944 wrote to memory of 1324	5944	97PasO.exe	155
PID 1324 wrote to memory of 4468	1324	cmd.exe	157
PID 5944 wrote to memory of 3816	5944	97PasO.exe	158
PID 3816 wrote to memory of 564	3816	cmd.exe	160
PID 5944 wrote to memory of 5716	5944	97PasO.exe	161
PID 5716 wrote to memory of 4312	5716	cmd.exe	163
PID 5944 wrote to memory of 3068	5944	97PasO.exe	164
PID 3068 wrote to memory of 3176	3068	cmd.exe	166
PID 5944 wrote to memory of 1788	5944	97PasO.exe	167
PID 1788 wrote to memory of 5640	1788	cmd.exe	169
PID 5944 wrote to memory of 2992	5944	97PasO.exe	170
PID 2992 wrote to memory of 3800	2992	cmd.exe	172
PID 5944 wrote to memory of 5824	5944	97PasO.exe	173
PID 5824 wrote to memory of 824	5824	cmd.exe	175
PID 5944 wrote to memory of 3844	5944	97PasO.exe	176
PID 3844 wrote to memory of 2608	3844	cmd.exe	178
PID 5944 wrote to memory of 720	5944	97PasO.exe	179
PID 720 wrote to memory of 1380	720	cmd.exe	181

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	97PasO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	97PasO.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\appinst_up012.exe
"C:\Users\Admin\AppData\Local\Temp\appinst_up012.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Users\Public\SGD0bS\4g28bI.exe
"C:\Users\Public\SGD0bS\4g28bI.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\SGD0bS\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\SGD0bS\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:200
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5780
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4664
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5340
- C:\Program Files (x86)\kClnWt\97PasO.exe
  "C:\Program Files (x86)\kClnWt\97PasO.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5944
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6092
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\97PasO.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\97PasO.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\97PasO.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\97PasO.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\97PasO.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\97PasO.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5640
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3800
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\kClnWt\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\kClnWt\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1380

C:\Users\Public\SGD0bS\4g28bI.exe
"C:\Users\Public\SGD0bS\4g28bI.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3420

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\SGD0bS" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\SGD0bS" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:940

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3112

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4512

C:\Program Files (x86)\kClnWt\97PasO.exe
"C:\Program Files (x86)\kClnWt\97PasO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3488

C:\Program Files (x86)\T8BdiPn\C9C6gF.exe
"C:\Program Files (x86)\T8BdiPn\C9C6gF.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\T8BdiPn\XPSPLOG.dll
Size 4.6MB
SHA256 7a7c81cf03d374805915f9b0d1816172a2d10f18b98210700b516d08934d643e
MD5 4a3a18b00e93c4251a393129698a8fd1
SHA1 69205e731de06698e5997a1223a982f1bc09a0fa
SHA512 7d1aab6e3f5f6da05f32cd29157c4ef98fa57009213592e1c963ffc055c2f5b51aec3e1f8cb43d0c0864d4ffb6ceef336e3143f9ca7c948482f054a0f758b34c
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyj:BMWKfU+BcUTHCCCfqCiUffnj
TLSH
T1E3263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\T8BdiPn\image.png
Size 5.0MB
SHA256 82df6553ab74342ac2e10e9ed89b19c2217669df052f2a78ef01c1170e243b15
MD5 7622ffbbdcf094583f133a6936179718
SHA1 ce79b0f439866e7e7328d0ecbdc33454e08b87de
SHA512 e37c178c7078c4c222a6e7c3acf339963d8cb42ae22ffa9c9d626a6916e18dad8abc478ccd5fc23ec3209efd19e38661ea5b6dea4e893fe8fb3572900321cf68
SSDEEP 98304:0FYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:RRIUjDgAk+jkn/IXhVaK
TLSH
T14E3633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97PasO.exe

Path C:\Program Files (x86)\kClnWt\97PasO.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\kClnWt\XPSPLOG.dll
Size 4.6MB
SHA256 14978b442a2bb2d5bc7be183899aa005110dd8a8cacd021cea9ff803fe7fc209
MD5 cf1eea09b3f80ebe399b21524401d5ce
SHA1 bb2b8f1eb5e0f4c34a887723e7074621c6e7eb7e
SHA512 bc51fa7ba09a1b50538783f74392ba76e6a91baf396c99c3e1e90e29bbafbae0841bf58df1d4dfa7efcd49875e02f1fdd3a7b5d5babe2b9d438710be98af74ba
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy1:BMWKfU+BcUTHCCCfqCiUffn1
TLSH
T1A7263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\kClnWt\image.png
Size 5.0MB
SHA256 1ee39a3681846d19a201a26d51abc6245f947820c1a8eec0eccb4c74201dd008
MD5 f54b249ee5335d3397e37eb787658c6e
SHA1 5a872b96f38c72ad3a39d04e4de2f48cbb9ad1c1
SHA512 7311b0a8a1193ea14b3d00764c2340d7db249c46fe9e9322f7f18c6173703b3c49536fbdb9b2a335cca097b1701374afc9595134769cb665133e668074fb2ae4
SSDEEP 98304:mFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:rRIUjDgAk+jkn/IXhVaK
TLSH
T1443633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\kClnWt\thumbs.db
Size 358KB
SHA256 53087f423365ccabe05b01e50d4f5f3fa5f8d4f1574e7ee05fc885910e387b31
MD5 bd2370df316e2f3e7858c0c7d48f35d0
SHA1 1d3ba34cb60196ad2728a8feaf8fef8d847f8899
SHA512 f3deaa9c1d65a06000d9de485b212489eacd12eaa233ee91ffa56f91b09b4c8bd98cf84ec7e7591001be1bb7c4c6b872e3f7ed6bee18d3a0c3044c6542582a27
SSDEEP 6144:FiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:s8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T14F74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 034d04d79c088501517bff406c20d10b7fd0d3c3de7869ba101293d39ebf7bb3
MD5 f036931806aaccf84f58e173e8212377
SHA1 1bc72ad6309e18e264d7424d99885345355608b0
SHA512 ab05c8070028a7fee28c035b8536967a9b8a0d5326e2f737047130f8bd5d49343d43bda5561715a34e46f3788c3722458d83b0d7ceabef3af22a343955a55f80
TLSH
T13521E6CB8AB61590FE81DD4132D9C9236DE62BC0186D002E4126CC893A023697F5202A
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 2dd896010325bd90ce0e3b1238f74aa055133e9bb2923efdcef03d895b573f03
MD5 40bf908dd99e912b75f1e7c76577f121
SHA1 2fa2a72aff75064b4b1252939f18c7da6b974a7f
SHA512 b7b7e3ec86194e5b5bf2fd3ff704fd9cc09406459c8b7455fc8e1bbb0ae4a0969cd95fe9bb1df4dd0851144a1a8f869ccaee8184c9af31284c994dc014d2e633
TLSH
T1D72194CB46BB3137E352CD4E15C8AF322CF5D7D061ED1418B00FC2AA28013F2AA4D42A
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 41a381b45b8ee74a8b24dc63d194801575f03dd630583787bb01bf5e243db736
MD5 fcf99b30942aec210692dd16d2449afe
SHA1 f4dedfbbc7fb325eb742d825cfc4e9f24a2e39f0
SHA512 6f6fc1f088c998a2fa578962e81fcf83abce48b0866d9e79a943acc5b8e3e9e7c1b98a0a68051257aabf966406e99897eaec463dca74bb6c7f3f8bd0668caad1
TLSH
T13EF0DC2848F8823FF072C93897CE30E2D6B7FA06200846A416D4CB0CBA66B022D0153D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 9228816578338fa9d5a1aab87f8fe076f481b55a18dabb95b8394469287c6c2f
MD5 6de962fc59bbeb5abf885c37ceeee630
SHA1 81aee7f60345ee5f18cac073f74e8d7d0d8c1968
SHA512 82e8fe4952e25c5d28453149b7c5edde7ef4a9d6915d5fb8c474b2b0f83cb5bac31382bdd63609e538d0fdc5ff4c4b46883bea44bd01244dfdd0d8f2c2f8cd72
TLSH
T1E5F05C3845B85019F137CA7C16D977F0E32BBB13641506FF05E5465CAB58E106C85B79
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

4g28bI.exe

Path C:\Users\Public\SGD0bS\4g28bI.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\SGD0bS\UxEnhance64.dll
Size 3.1MB
SHA256 d49935c7e388307429ac01c4fb3e8f3ef111d94a8ae946bfe62117aa1168299f
MD5 b6a443a4f7b6c96dc7774a3a81078721
SHA1 6dce5a3bd36f3f92fcf9f0918c3eeb952c02e2e9
SHA512 3d33c90a12bed7ba81e732e4ee450351e49a5452fb3e11c44dcb676686bde457ee4756d08568d8ae97a8258e14e4fef27f333b0af0f789942892cd5fbdfa81ef
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+u:P9m29xx3Tiqt06ox6+z2rNNrKou
TLSH
T1CEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\SGD0bS\adoresd.dat
Size 4.7MB
SHA256 6dfba6aadb2e86ff9eeecec591fdf0d32a3a2fc92934005c892446f356132bfe
MD5 5763534f1565cba36800d870c866477c
SHA1 03cfe1f82b30e185004a951dd7ddd081954b224c
SHA512 c02dcc789e8e3102289e3cfef268e1d957baefbf1614d87de1f82edd889ea89b06e7bedfa13e1ad7b83f01fbcd474ed440f4a901911bee6a02a5e01d5d28dc9d
SSDEEP 98304:CKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:CKClqhi0Cv54K2IVS0VQg
TLSH
T1B73633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\SGD0bS\msadox.tb
Size 8KB
SHA256 5368457a7f59ecdc26023448a2441eefa0c8df1ae99de5591aad6b68b840a96b
MD5 50b388cd4a6c6458187c7c6244342913
SHA1 978f778162bdf1732741a10e4b9c45452f6e2df7
SHA512 c5b4a97f78f85a48cf475a25fedd449a094a90ad4c2f5d3d5233f4150398c166bb93a6e15c517b1d8d676ed332a935c37e20e8c774833d6500d0f2f514ce4d0b
SSDEEP 192:uxqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:csZqZOXQ3uqvR2Kfzp
TLSH
T1DE029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C1670B2ED2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-558-0x00000201E8640000-0x00000201E86CA000-memory.dmp

Download

memory/1276-531-0x00007FFD08F20000-0x00007FFD0943E000-memory.dmp

Download

memory/1276-546-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1276-544-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1276-550-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1276-559-0x00000201E8640000-0x00000201E86CA000-memory.dmp

Download

memory/1276-556-0x00000201E72A0000-0x00000201E72EE000-memory.dmp

Download

memory/1276-561-0x00000201E8640000-0x00000201E86CA000-memory.dmp

Download

memory/1276-560-0x00000201E8640000-0x00000201E86CA000-memory.dmp

Download

memory/1276-538-0x00007FFD2BBA0000-0x00007FFD2BBA2000-memory.dmp

Download

memory/1276-563-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1276-565-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1276-566-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1276-530-0x00007FFD2BB90000-0x00007FFD2BB92000-memory.dmp

Download

memory/1276-545-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1276-536-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1276-539-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1276-543-0x00000201E7DB0000-0x00000201E8637000-memory.dmp

Download

memory/1612-525-0x00007FFD20AA0000-0x00007FFD20AB2000-memory.dmp

Download

memory/1612-1-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/1612-2-0x00000000008B0000-0x00000000008BC000-memory.dmp

Download

memory/1612-504-0x00007FFD20AA0000-0x00007FFD20AB2000-memory.dmp

Download

memory/1612-0-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/1612-524-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/3420-585-0x000001FBA2210000-0x000001FBA2A97000-memory.dmp

Download

memory/3420-576-0x000001FBA2210000-0x000001FBA2A97000-memory.dmp

Download

memory/3420-573-0x00007FFD08F20000-0x00007FFD0943E000-memory.dmp

Download

memory/3420-578-0x00007FFD2BBA0000-0x00007FFD2BBA2000-memory.dmp

Download

memory/3420-583-0x000001FBA2210000-0x000001FBA2A97000-memory.dmp

Download

memory/3420-584-0x000001FBA2210000-0x000001FBA2A97000-memory.dmp

Download

memory/3420-579-0x000001FBA2210000-0x000001FBA2A97000-memory.dmp

Download

memory/3420-586-0x000001FBA2210000-0x000001FBA2A97000-memory.dmp

Download

memory/3420-587-0x00007FFD2BB90000-0x00007FFD2BB92000-memory.dmp

Download

memory/3488-733-0x00000000752C0000-0x0000000075A0A000-memory.dmp

Download

memory/3488-744-0x0000000001130000-0x0000000001131000-memory.dmp

Download

memory/3488-749-0x0000000001110000-0x0000000001111000-memory.dmp

Download

memory/3488-745-0x00000000035B0000-0x0000000003DB3000-memory.dmp

Download

memory/3488-739-0x00000000035B0000-0x0000000003DB3000-memory.dmp

Download

memory/3488-732-0x0000000001110000-0x0000000001111000-memory.dmp

Download

memory/3744-740-0x0000000001940000-0x0000000001941000-memory.dmp

Download

memory/3744-753-0x0000000003D80000-0x0000000004583000-memory.dmp

Download

memory/3744-752-0x0000000001970000-0x0000000001971000-memory.dmp

Download

memory/3744-750-0x0000000003D80000-0x0000000004583000-memory.dmp

Download

memory/3744-756-0x0000000001940000-0x0000000001941000-memory.dmp

Download

memory/3744-741-0x0000000073E00000-0x000000007454A000-memory.dmp

Download

memory/4432-608-0x000001C263110000-0x000001C26311A000-memory.dmp

Download

memory/4432-607-0x000001C2633A0000-0x000001C263452000-memory.dmp

Download

memory/4432-606-0x000001C2630F0000-0x000001C26310E000-memory.dmp

Download

memory/4432-602-0x000001C263090000-0x000001C2630B2000-memory.dmp

Download

memory/5944-724-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/5944-675-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download

memory/5944-736-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/5944-676-0x00000000752C0000-0x0000000075A0A000-memory.dmp

Download

memory/5944-680-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/5944-683-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/5944-700-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5944-758-0x0000000005AE0000-0x0000000005B11000-memory.dmp

Download

memory/5944-695-0x0000000003280000-0x0000000003A83000-memory.dmp

Download

memory/5944-682-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/5944-694-0x0000000000F90000-0x0000000000FA4000-memory.dmp

Download

memory/5944-687-0x0000000003280000-0x0000000003A83000-memory.dmp

Download