32e8f91de32319a57f201f48ba858c805679dce876204d2444f027d9d50fd913

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_q2.0.17.exe
Size 25.4MB
Sample260905-pgm72stgrf
SHA256 32e8f91de32319a57f201f48ba858c805679dce876204d2444f027d9d50fd913
MD5 7fd285b00b93ed14130fdcd237909da4
SHA1 37dc2a1c3c98c2c6e91cb8eda9fa542152098092
SHA512 6a811a9068be93f3981517e54afc0c21a86a671594ed1290b72db9e2da323baf748f286f4925cca1fbcb83b89639fdf66838b8ec81a3100d3d43cc9bb9c56830
SSDEEP 49152:6KL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B46s:TjAIMaQi7kmeHh2yeH7rkfvVsX+N8
TLSH
T14747E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\ed0eSl = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2100	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4636	9DtkH5.exe
3248	9DtkH5.exe

Loads dropped DLL 2 IoCs

pid	Process
4636	9DtkH5.exe
3248	9DtkH5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\ed0eSl\\9DtkH5.exe\""	9DtkH5.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5644	cmd.exe
1320	cmd.exe
4548	cmd.exe
3732	cmd.exe
3084	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	9DtkH5.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ekBE7a	9DtkH5.exe
File created	C:\Program Files (x86)\ekBE7a\thumbs.db	9DtkH5.exe
File opened for modification	C:\Program Files (x86)\ekBE7a\ekBE7a.exe	9DtkH5.exe
File opened for modification	C:\Program Files (x86)\ekBE7a\thumbs.db	9DtkH5.exe
File created	C:\Program Files (x86)\ekBE7a\ekBE7a.exe	9DtkH5.exe
File created	C:\Program Files (x86)\ekBE7a\XPSPLOG.dll	9DtkH5.exe
File created	C:\Program Files (x86)\ekBE7a\image.png	9DtkH5.exe
File opened for modification	C:\Program Files (x86)\ekBE7a\XPSPLOG.dll	9DtkH5.exe
File opened for modification	C:\Program Files (x86)\ekBE7a\image.png	9DtkH5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3528	cmd.exe
1104	cmd.exe
4872	cmd.exe
5556	cmd.exe
3044	cmd.exe
4572	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3348	schtasks.exe
5472	schtasks.exe
5396	schtasks.exe
2528	schtasks.exe
3572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4404	install_q2.0.17.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe
4636	9DtkH5.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeIncreaseQuotaPrivilege	2100	powershell.exe
Token: SeSecurityPrivilege	2100	powershell.exe
Token: SeTakeOwnershipPrivilege	2100	powershell.exe
Token: SeLoadDriverPrivilege	2100	powershell.exe
Token: SeSystemProfilePrivilege	2100	powershell.exe
Token: SeSystemtimePrivilege	2100	powershell.exe
Token: SeProfSingleProcessPrivilege	2100	powershell.exe
Token: SeIncBasePriorityPrivilege	2100	powershell.exe
Token: SeCreatePagefilePrivilege	2100	powershell.exe
Token: SeBackupPrivilege	2100	powershell.exe
Token: SeRestorePrivilege	2100	powershell.exe
Token: SeShutdownPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeSystemEnvironmentPrivilege	2100	powershell.exe
Token: SeRemoteShutdownPrivilege	2100	powershell.exe
Token: SeUndockPrivilege	2100	powershell.exe
Token: SeManageVolumePrivilege	2100	powershell.exe
Token: 33	2100	powershell.exe
Token: 34	2100	powershell.exe
Token: 35	2100	powershell.exe
Token: 36	2100	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2100	4636	9DtkH5.exe	92
PID 4636 wrote to memory of 5644	4636	9DtkH5.exe	94
PID 5644 wrote to memory of 3572	5644	cmd.exe	96
PID 5644 wrote to memory of 2108	5644	cmd.exe	98
PID 4636 wrote to memory of 1320	4636	9DtkH5.exe	101
PID 5644 wrote to memory of 1472	5644	cmd.exe	104
PID 4636 wrote to memory of 4548	4636	9DtkH5.exe	106
PID 1320 wrote to memory of 3348	1320	cmd.exe	108
PID 4548 wrote to memory of 5472	4548	cmd.exe	109
PID 4636 wrote to memory of 3732	4636	9DtkH5.exe	110
PID 1320 wrote to memory of 4340	1320	cmd.exe	112
PID 3732 wrote to memory of 5396	3732	cmd.exe	114
PID 4548 wrote to memory of 4260	4548	cmd.exe	115
PID 3732 wrote to memory of 1820	3732	cmd.exe	116
PID 1320 wrote to memory of 4660	1320	cmd.exe	117
PID 4636 wrote to memory of 3084	4636	9DtkH5.exe	118
PID 4548 wrote to memory of 5188	4548	cmd.exe	120
PID 3732 wrote to memory of 3440	3732	cmd.exe	121
PID 3084 wrote to memory of 2528	3084	cmd.exe	122
PID 3084 wrote to memory of 620	3084	cmd.exe	123
PID 3084 wrote to memory of 2652	3084	cmd.exe	125
PID 1104 wrote to memory of 1456	1104	cmd.exe	129
PID 4572 wrote to memory of 3928	4572	cmd.exe	130
PID 3528 wrote to memory of 4080	3528	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_q2.0.17.exe
"C:\Users\Admin\AppData\Local\Temp\install_q2.0.17.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5568

C:\Users\Public\ed0eSl\9DtkH5.exe
"C:\Users\Public\ed0eSl\9DtkH5.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ed0eSl\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ed0eSl\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4260
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2652
- C:\Program Files (x86)\ekBE7a\ekBE7a.exe
  "C:\Program Files (x86)\ekBE7a\ekBE7a.exe"
  2⤵
  PID:1132
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\ekBE7a" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3044

C:\Users\Public\ed0eSl\9DtkH5.exe
"C:\Users\Public\ed0eSl\9DtkH5.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3248

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ed0eSl" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ed0eSl" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3928

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5340

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4080

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1456

C:\Program Files (x86)\ekBE7a\ekBE7a.exe
"C:\Program Files (x86)\ekBE7a\ekBE7a.exe"
1⤵
PID:5364

C:\Program Files (x86)\3ha0F7\6IUlE.exe
"C:\Program Files (x86)\3ha0F7\6IUlE.exe"
1⤵
PID:5352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\3ha0F7\XPSPLOG.dll
Size 2.9MB
SHA256 3f6af352f3956b9ff712e7656e21d57aeeae6fe23b4fffb1828dbbc270c6fc51
MD5 70f61018b503c7f1740e37b455c3c39f
SHA1 46a40cb349302b132a581e664fada18f2fde3a73
SHA512 5de7fc62407d830257ce076bef60ce6dcd2062fa4911c491fe657bfcafaa59554a224b5f886264a7f82c2a0b595e4f8d1335ba3d0eaa574366f2fd746a813632
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZC3:yCMWmcKfST5t+BceThTHfaCC3
TLSH
T197D533CEAA9B551FE66132792F7CEC7DBABC4AC0431DE845C4A6314F8054BAE903D64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\3ha0F7\XPSPLOG.dll
Size 2.4MB
SHA256 105f1f705d82fb665a5c5b6154673335443316874195ddeda89f9199ff6f2d0f
MD5 4e453e3175c2b92ef995c65039db1979
SHA1 4cea687275efc1749d6b7dff43f65e8a7624a686
SHA512 46e4a15b7f9d2eba134498463dbe44b5221c12496297dbf921ab5d6eacb67cae5e64eb6eaa0d49da861b7f416b4611a9d5b1e7b2c152dc6ea4b06a20d78c45ed
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnU:yCMWmcKfST5t+BceThTHF
TLSH
T16FB5339BF557460EEA6133B82F9DFC6D72BD59C8C22DE548D492308B4014B6E903FA8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\ekBE7a\XPSPLOG.dll
Size 4.6MB
SHA256 88894921f4d4599f1b3fd3d833b3657133b6e7ba8c683a924d900158101efdf5
MD5 00036039ba2bb10320e5912dc0bc0901
SHA1 70b63f7629abdf063ff89e05cef0c6ef3404e9b5
SHA512 98b8942208f423d3de97de929f3aff8b0c403b9e788f4dc25a64aede98883b2f8962d419e378055338ee6387b93d8a596c72a853b3e68345e63380ccd0ae65e0
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyw:BMWKfU+BcUTHCCCfqCiUffnw
TLSH
T148263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\ekBE7a\XPSPLOG.dll
Size 3.4MB
SHA256 d05e4b868de5e1c1fb30e907e22009fcda1ee17b70f23d62d64032ae5fe272f4
MD5 aa65e29b7346045333b87d1b9fb851e2
SHA1 88ac377cea6369da5475bd5126f13e1a4afd2e47
SHA512 d1d0d02e4577db2efdef65d5409a47d75ff9639f938f0bb23fd212d1f7e1b97d9824fc48cd1159ad2208385677b3f9eb23eca134c422554d3c4b484c8b163bdf
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT1588:yCMWmcKfST5t+BceThTHfaCCUqmJPj
TLSH
T1DBF5334DABCB561EE85276785F3DFC7E727829CC430CEC88D4A9354B90A2B6D503990E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ekBE7a.exe

Path C:\Program Files (x86)\ekBE7a\ekBE7a.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\ekBE7a\image.png
Size 4.8MB
SHA256 7991a3864a7e4b812fbb34de34f8856a7920779330e3ecd7fb2786938fb08c5a
MD5 03aa1a3d5ef84ee61bbda286ec1d5855
SHA1 3cd2f1d4c345d4a26988cee27e7c9f88f6c82dcb
SHA512 501cbdbd0aa198f22ac93b08ef2fe7b152ce7f6ba4ed7264d20ae9ea8e7b40d1a082b842603f8a5fd2f642d3c8719862820413583dc6d137ed508fdfb653de48
SSDEEP 98304:d/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:dMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1BD36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\ekBE7a\thumbs.db
Size 358KB
SHA256 ac398374d49ea2c9698115e7ff4c1ad3e0fcf77ea9a0c690fb1e04b066b3b1e9
MD5 5e122228919e21c061484ab8c0992487
SHA1 0dbc563723c3e6d10cf882c8be4a3a0abc59268b
SHA512 92e8d5bbf984988202129e025c569032e5ab78a032bb2dcbeb4f7f8b25d3e52266df779729564db3729e1a2b7b4d387c2f8d7e8f7cd639bb7e9a3fe1c8657da1
SSDEEP 6144:KiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:18u69CghoQxoMTFQqtKFCz7mb/
TLSH
T16074F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 29897a21ff2f1da186c4f66160c86779e7682c1cb376d0a53ade84aeb100c45f
MD5 9e6ec08d97f73a54aeec2d5e21e3607e
SHA1 d4c7ea1a49939784637c87f9dabc9b9bbdb4c245
SHA512 7923fab014d750e5c95b151d7262236ada845e8f4b17a2fb0d9522594373d41fc80f0de060355b1d74dd6022fa88bbb98238137bf4741f371b42e2863742b1e2
TLSH
T1E8C04C9853784358F075A93F2D814AE19F7A5E15A912C3640B74414C8468A200932E66
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

9DtkH5.exe

Path C:\Users\Public\ed0eSl\9DtkH5.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ed0eSl\UxEnhance64.dll
Size 3.1MB
SHA256 ccc2ff33b3052af3ce96098b1166399fdbb97cf0b8454c98ed79c31f01d55363
MD5 ca0baca0c36282fb31aa65c7deb78a37
SHA1 322a0b4c57179af85e082f89b33321c681b188a7
SHA512 8ec14fac74753e3732d1009444309cb877b30791ac57f1935e372c74da183f35a33b440f68f3060de615a7cac6311cd2585bb04605e2c4978b91ce81bf96a699
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+1:P9m29xx3Tiqt06ox6+z2rNNrKo1
TLSH
T102E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\ed0eSl\adoresd.dat
Size 4.7MB
SHA256 8cd9239a9a5f535ce10b02a47bf957f20c7e53f7e1f90d6e6c91d8ab6fac1230
MD5 0169c94eb146f3cfa1616c90ca260c8e
SHA1 032c6844d81c1a88fd762effd5c2ff2267f49a9d
SHA512 ae8e0036ccdc7fd9af745f66f3b2cb3880bb71b89588abad8a6a4e9649d66fa6d9e499d7c454b75a8db88c7d9c484202f843b6139fe895ad097496d03786fd0c
SSDEEP 98304:qKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:qKClqhi0Cv54K2IVS0VQg
TLSH
T1FB3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\ed0eSl\msadox.tb
Size 8KB
SHA256 538bf12b0ebcbf9f8b721f0396738d61b15a792acddf0556d999217a364c3122
MD5 40d82e8e3e5a4737bb6ff5e73653c79e
SHA1 eb3130c28cd00c59c781887239276ea733716e7d
SHA512 fb8ce53eb31f3ac9ea7721a3a7e836dd31b17c819e01ce7769840ba537b65a026256a8fba9aa7b872545e4c770caf5aef62b7193d940e0c7c0b6275eaddf337b
SSDEEP 192:rqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:rsZqZOXQ3uqvR2Kfzp
TLSH
T1C5029E06D7A20DC3D3016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-690-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/1132-685-0x0000000002D30000-0x0000000002D31000-memory.dmp

Download

memory/1132-683-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/1132-686-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/1132-679-0x0000000074B60000-0x00000000752AA000-memory.dmp

Download

memory/1132-678-0x00000000016F0000-0x00000000016F1000-memory.dmp

Download

memory/1132-697-0x00000000055C0000-0x00000000055D4000-memory.dmp

Download

memory/1132-710-0x00000000038C0000-0x000000000409D000-memory.dmp

Download

memory/1132-718-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2100-611-0x000001BD69A40000-0x000001BD69A4A000-memory.dmp

Download

memory/2100-610-0x000001BD69CB0000-0x000001BD69D62000-memory.dmp

Download

memory/2100-609-0x000001BD69A50000-0x000001BD69A6E000-memory.dmp

Download

memory/2100-605-0x000001BD69A00000-0x000001BD69A22000-memory.dmp

Download

memory/3248-582-0x000001BDB2A10000-0x000001BDB3297000-memory.dmp

Download

memory/3248-593-0x00007FFA5AB70000-0x00007FFA5AB72000-memory.dmp

Download

memory/3248-579-0x00007FFA3B4D0000-0x00007FFA3B9EE000-memory.dmp

Download

memory/3248-591-0x000001BDB2A10000-0x000001BDB3297000-memory.dmp

Download

memory/3248-584-0x00007FFA5AB80000-0x00007FFA5AB82000-memory.dmp

Download

memory/3248-586-0x000001BDB2A10000-0x000001BDB3297000-memory.dmp

Download

memory/3248-589-0x000001BDB2A10000-0x000001BDB3297000-memory.dmp

Download

memory/3248-590-0x000001BDB2A10000-0x000001BDB3297000-memory.dmp

Download

memory/3248-592-0x000001BDB2A10000-0x000001BDB3297000-memory.dmp

Download

memory/4404-528-0x00007FFA50E70000-0x00007FFA50E82000-memory.dmp

Download

memory/4404-0-0x00000000005A0000-0x00000000005AE000-memory.dmp

Download

memory/4404-1-0x0000000002050000-0x000000000205C000-memory.dmp

Download

memory/4404-503-0x00007FFA50E70000-0x00007FFA50E82000-memory.dmp

Download

memory/4404-527-0x00000000005A0000-0x00000000005AE000-memory.dmp

Download

memory/4636-561-0x0000024F503C0000-0x0000024F5044A000-memory.dmp

Download

memory/4636-539-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/4636-564-0x0000024F503C0000-0x0000024F5044A000-memory.dmp

Download

memory/4636-570-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/4636-554-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/4636-548-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/4636-549-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/4636-547-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/4636-546-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/4636-542-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/4636-541-0x00007FFA5AB80000-0x00007FFA5AB82000-memory.dmp

Download

memory/4636-565-0x0000024F503C0000-0x0000024F5044A000-memory.dmp

Download

memory/4636-534-0x00007FFA3B4D0000-0x00007FFA3B9EE000-memory.dmp

Download

memory/4636-533-0x00007FFA5AB70000-0x00007FFA5AB72000-memory.dmp

Download

memory/4636-563-0x0000024F503C0000-0x0000024F5044A000-memory.dmp

Download

memory/4636-560-0x0000024F502A0000-0x0000024F502EE000-memory.dmp

Download

memory/4636-567-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/4636-569-0x0000024F4FA10000-0x0000024F50297000-memory.dmp

Download

memory/5364-723-0x0000000074B60000-0x00000000752AA000-memory.dmp

Download

memory/5364-722-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Download

memory/5364-732-0x00000000036F0000-0x0000000003ECD000-memory.dmp

Download