479381317a78c3cbefb977f79884b46da35a806e7f9c1c37fe115f778e64a7a4

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_q2.0.18.exe
Size 25.4MB
Sample260905-qgndgsstdt
SHA256 479381317a78c3cbefb977f79884b46da35a806e7f9c1c37fe115f778e64a7a4
MD5 805637744e07e05d0a3e8a3ea39acae2
SHA1 0726bc305168d0e6c85b5effe2859362f94ac3fa
SHA512 acece854a2f258685b05eb9b08f65af02568cd5ac40eb1312bf999ab71418942854afd1ea54d49d916ef13fd88fd4974ee33c96b925f001d433e556d1ce44889
SSDEEP 49152:YKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B46X:djAIMaQi7kmeHh2yeH7rkfvVsX+NH
TLSH
T19247E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\XBzeh4 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2636	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2444	9aYmiU.exe
1536	9aYmiU.exe

Loads dropped DLL 2 IoCs

pid	Process
2444	9aYmiU.exe
1536	9aYmiU.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\XBzeh4\\9aYmiU.exe\""	9aYmiU.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3112	cmd.exe
4752	cmd.exe
1244	cmd.exe
5660	cmd.exe
1368	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	9aYmiU.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\zeaLzP\zeaLzP.exe	9aYmiU.exe
File opened for modification	C:\Program Files (x86)\zeaLzP	9aYmiU.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5060	cmd.exe
3228	cmd.exe
964	cmd.exe
1204	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5624	schtasks.exe
4868	schtasks.exe
3420	schtasks.exe
5668	schtasks.exe
4992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
5752	install_q2.0.18.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe
2444	9aYmiU.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeIncreaseQuotaPrivilege	2636	powershell.exe
Token: SeSecurityPrivilege	2636	powershell.exe
Token: SeTakeOwnershipPrivilege	2636	powershell.exe
Token: SeLoadDriverPrivilege	2636	powershell.exe
Token: SeSystemProfilePrivilege	2636	powershell.exe
Token: SeSystemtimePrivilege	2636	powershell.exe
Token: SeProfSingleProcessPrivilege	2636	powershell.exe
Token: SeIncBasePriorityPrivilege	2636	powershell.exe
Token: SeCreatePagefilePrivilege	2636	powershell.exe
Token: SeBackupPrivilege	2636	powershell.exe
Token: SeRestorePrivilege	2636	powershell.exe
Token: SeShutdownPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeSystemEnvironmentPrivilege	2636	powershell.exe
Token: SeRemoteShutdownPrivilege	2636	powershell.exe
Token: SeUndockPrivilege	2636	powershell.exe
Token: SeManageVolumePrivilege	2636	powershell.exe
Token: 33	2636	powershell.exe
Token: 34	2636	powershell.exe
Token: 35	2636	powershell.exe
Token: 36	2636	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2636	2444	9aYmiU.exe	91
PID 2444 wrote to memory of 1368	2444	9aYmiU.exe	93
PID 1368 wrote to memory of 5624	1368	cmd.exe	95
PID 1368 wrote to memory of 5628	1368	cmd.exe	96
PID 1368 wrote to memory of 5376	1368	cmd.exe	100
PID 2444 wrote to memory of 3112	2444	9aYmiU.exe	101
PID 3112 wrote to memory of 4868	3112	cmd.exe	105
PID 3112 wrote to memory of 2332	3112	cmd.exe	106
PID 2444 wrote to memory of 4752	2444	9aYmiU.exe	108
PID 3112 wrote to memory of 4240	3112	cmd.exe	110
PID 4752 wrote to memory of 3420	4752	cmd.exe	111
PID 2444 wrote to memory of 1244	2444	9aYmiU.exe	112
PID 1244 wrote to memory of 5668	1244	cmd.exe	114
PID 4752 wrote to memory of 2928	4752	cmd.exe	115
PID 1244 wrote to memory of 5692	1244	cmd.exe	117
PID 4752 wrote to memory of 2436	4752	cmd.exe	118
PID 2444 wrote to memory of 5660	2444	9aYmiU.exe	119
PID 1244 wrote to memory of 5560	1244	cmd.exe	121
PID 5660 wrote to memory of 4992	5660	cmd.exe	122
PID 5660 wrote to memory of 4876	5660	cmd.exe	123
PID 5660 wrote to memory of 4420	5660	cmd.exe	129
PID 5060 wrote to memory of 5656	5060	cmd.exe	131
PID 1204 wrote to memory of 3864	1204	cmd.exe	132
PID 3228 wrote to memory of 4524	3228	cmd.exe	134
PID 964 wrote to memory of 3196	964	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_q2.0.18.exe
"C:\Users\Admin\AppData\Local\Temp\install_q2.0.18.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5752

C:\Users\Public\XBzeh4\9aYmiU.exe
"C:\Users\Public\XBzeh4\9aYmiU.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\XBzeh4\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\XBzeh4\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2332
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2928
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4420

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\XBzeh4" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\XBzeh4" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5656

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1352

C:\Users\Public\XBzeh4\9aYmiU.exe
"C:\Users\Public\XBzeh4\9aYmiU.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4524

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3196

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 284b3d2bff4a83eb4f564fd90626121b7cfc59de4edc58974dd5f622a88f8c75
MD5 1d1c14c9cb387b6f8f0dda55d9581379
SHA1 ad16902c2e2cc63ce216c124b53727e1481c5be3
SHA512 d1f4b6acb1caa2fc0f605f51aab4ba79110088dd08b0327a9fe2959b971d0572cf26fa7d65830e0ae61b31a09fccdeb46eddcae708aecaf9c7a996b97bd8cac1
TLSH
T1FEC04C94537C4754F071697E2D814AE19F7A5E15A562C3652F74414C846CA100C32E66
MD5 SHA1 SHA512 TLSH

Submit Download

9aYmiU.exe

Path C:\Users\Public\XBzeh4\9aYmiU.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\XBzeh4\UxEnhance64.dll
Size 3.1MB
SHA256 de76479677dab3fa917e568a0a1c85260b2132edf52d20354fb5ee1cc698afaa
MD5 4458780f9dd2502f384bc6756bb8aaf2
SHA1 f3e80b649b65887901b2df1f8ec9f4ebde72fdcc
SHA512 1325b66cb14a78137108cb0144078095f1381fd3e10c89f74ab76959a7abcf987e08b57452ed986e387e11257eb52cd55f62390e3dcab7b63b6142ac02ac915b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+0:P9m29xx3Tiqt06ox6+z2rNNrKo0
TLSH
T1F6E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\XBzeh4\adoresd.dat
Size 4.7MB
SHA256 12af911c86f193df0aa0cb593807ad50844269d0f0fdde3f185709a9eac24f4a
MD5 de0f9c28938b128ed7091ca160d05c59
SHA1 385210caca87e107663b85ade9dec1f39626c2a1
SHA512 05090c42ab38bb9e1a1ac1634983b9612496dc827ed1f318428b08741200fa5898502c11aa14f5beed702c8cca9864a27ae7d91c9d5c4444d52b0bce9ded6240
SSDEEP 98304:9KC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:9KClqhi0Cv54K2IVS0VQg
TLSH
T1993633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\XBzeh4\msadox.tb
Size 8KB
SHA256 7c78b90f670ad8816daedfcf268498aa5a75f88f84e8dca5c8a99b96fb56b888
MD5 94d0775b83ae30b2f2ba8b0d2b217751
SHA1 4e363a2039dfccc95ea3925d207b642a398cf6fe
SHA512 3a78b26659133fbedff1863a98f6a54eb4da3325d07e2ed1694ad743cfa0a20c6c03f2c1258f829107c4d90520b22ba5a0d4819cee974883a0e4dfb405af0a80
SSDEEP 192:AqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:AsZqZOXQ3uqvR2Kfzp
TLSH
T128029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-579-0x00007FFC6D9B0000-0x00007FFC6DECE000-memory.dmp

Download

memory/1536-582-0x000001AAA5CC0000-0x000001AAA6547000-memory.dmp

Download

memory/1536-585-0x000001AAA5CC0000-0x000001AAA6547000-memory.dmp

Download

memory/1536-589-0x000001AAA5CC0000-0x000001AAA6547000-memory.dmp

Download

memory/1536-593-0x00007FFC905B0000-0x00007FFC905B2000-memory.dmp

Download

memory/1536-592-0x000001AAA5CC0000-0x000001AAA6547000-memory.dmp

Download

memory/1536-591-0x000001AAA5CC0000-0x000001AAA6547000-memory.dmp

Download

memory/1536-590-0x000001AAA5CC0000-0x000001AAA6547000-memory.dmp

Download

memory/1536-584-0x00007FFC905C0000-0x00007FFC905C2000-memory.dmp

Download

memory/2444-547-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2444-539-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2444-548-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2444-549-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2444-553-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2444-562-0x00000172B0380000-0x00000172B040A000-memory.dmp

Download

memory/2444-564-0x00000172B0380000-0x00000172B040A000-memory.dmp

Download

memory/2444-563-0x00000172B0380000-0x00000172B040A000-memory.dmp

Download

memory/2444-561-0x00000172B0380000-0x00000172B040A000-memory.dmp

Download

memory/2444-559-0x00000172AD890000-0x00000172AD8DE000-memory.dmp

Download

memory/2444-566-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2444-568-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2444-569-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2444-534-0x00007FFC6D9B0000-0x00007FFC6DECE000-memory.dmp

Download

memory/2444-533-0x00007FFC905B0000-0x00007FFC905B2000-memory.dmp

Download

memory/2444-541-0x00007FFC905C0000-0x00007FFC905C2000-memory.dmp

Download

memory/2444-546-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2444-542-0x00000172AFA60000-0x00000172B02E7000-memory.dmp

Download

memory/2636-597-0x000001DDF8B40000-0x000001DDF8B62000-memory.dmp

Download

memory/2636-600-0x000001DDF8D70000-0x000001DDF8D8E000-memory.dmp

Download

memory/2636-601-0x000001DDF8D90000-0x000001DDF8E42000-memory.dmp

Download

memory/2636-602-0x000001DDF8F50000-0x000001DDF8F5A000-memory.dmp

Download

memory/5752-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5752-528-0x00007FFC87BA0000-0x00007FFC87BB2000-memory.dmp

Download

memory/5752-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5752-504-0x00007FFC87BA0000-0x00007FFC87BB2000-memory.dmp

Download

memory/5752-527-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5752-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download