fac1cceafaadf076674274b4d7ca951990770c00f572f227cb9cb6235653285f

Analysis

max time kernel
151s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
instapp.a.1.11.exe
Size 36.4MB
Sample260925-tsm4ms1bjc
SHA256 fac1cceafaadf076674274b4d7ca951990770c00f572f227cb9cb6235653285f
MD5 482b33402196894a4c14d95796d22196
SHA1 a4d66f465ea8d83a376c16f9c749bb494b58a058
SHA512 17fc07b7bbada038f59477bef89dc265ecee17c9daf569e861dfd8c78382d87349df56a45aba1839f37099f5d44a89bb4eb35a0fe8f3ff0601b14d503d382dd1
SSDEEP 98304:U8KAut6aEbMVTuQ2dCka+4Z7eSv5ogcPESa5OY/Y8onq:dKACqATn2s6SWg5cnq
TLSH
T1D5870946BB00DD83F5829134A8E6DF806B32FC728BB09B5336D96F1A2F5F1588DE1495
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\nfJvWm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3136	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2404	FvvtDF.exe
6020	FvvtDF.exe

Loads dropped DLL 2 IoCs

pid	Process
2404	FvvtDF.exe
6020	FvvtDF.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\nfJvWm\\FvvtDF.exe\""	FvvtDF.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5924	cmd.exe
2940	cmd.exe
6008	cmd.exe
5856	cmd.exe
4592	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	FvvtDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5596	cmd.exe
2852	cmd.exe
3476	cmd.exe
5684	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	instapp.a.1.11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	instapp.a.1.11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FvvtDF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FvvtDF.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2480	schtasks.exe
4608	schtasks.exe
2288	schtasks.exe
1676	schtasks.exe
5872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2056	instapp.a.1.11.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe
2404	FvvtDF.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeIncreaseQuotaPrivilege	3136	powershell.exe
Token: SeSecurityPrivilege	3136	powershell.exe
Token: SeTakeOwnershipPrivilege	3136	powershell.exe
Token: SeLoadDriverPrivilege	3136	powershell.exe
Token: SeSystemProfilePrivilege	3136	powershell.exe
Token: SeSystemtimePrivilege	3136	powershell.exe
Token: SeProfSingleProcessPrivilege	3136	powershell.exe
Token: SeIncBasePriorityPrivilege	3136	powershell.exe
Token: SeCreatePagefilePrivilege	3136	powershell.exe
Token: SeBackupPrivilege	3136	powershell.exe
Token: SeRestorePrivilege	3136	powershell.exe
Token: SeShutdownPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeSystemEnvironmentPrivilege	3136	powershell.exe
Token: SeRemoteShutdownPrivilege	3136	powershell.exe
Token: SeUndockPrivilege	3136	powershell.exe
Token: SeManageVolumePrivilege	3136	powershell.exe
Token: 33	3136	powershell.exe
Token: 34	3136	powershell.exe
Token: 35	3136	powershell.exe
Token: 36	3136	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3136	2404	FvvtDF.exe	91
PID 2404 wrote to memory of 5924	2404	FvvtDF.exe	93
PID 5924 wrote to memory of 2288	5924	cmd.exe	95
PID 5924 wrote to memory of 5572	5924	cmd.exe	96
PID 5924 wrote to memory of 1464	5924	cmd.exe	98
PID 2404 wrote to memory of 2940	2404	FvvtDF.exe	102
PID 2940 wrote to memory of 1676	2940	cmd.exe	105
PID 2404 wrote to memory of 6008	2404	FvvtDF.exe	106
PID 2940 wrote to memory of 4420	2940	cmd.exe	107
PID 6008 wrote to memory of 5872	6008	cmd.exe	110
PID 2940 wrote to memory of 1188	2940	cmd.exe	111
PID 2404 wrote to memory of 5856	2404	FvvtDF.exe	112
PID 6008 wrote to memory of 2292	6008	cmd.exe	114
PID 5856 wrote to memory of 2480	5856	cmd.exe	115
PID 6008 wrote to memory of 1244	6008	cmd.exe	117
PID 5856 wrote to memory of 5744	5856	cmd.exe	118
PID 2404 wrote to memory of 4592	2404	FvvtDF.exe	122
PID 5856 wrote to memory of 2780	5856	cmd.exe	124
PID 4592 wrote to memory of 4608	4592	cmd.exe	125
PID 4592 wrote to memory of 5772	4592	cmd.exe	126
PID 4592 wrote to memory of 5816	4592	cmd.exe	128
PID 3476 wrote to memory of 3360	3476	cmd.exe	131
PID 5596 wrote to memory of 3928	5596	cmd.exe	132
PID 2852 wrote to memory of 5132	2852	cmd.exe	133
PID 5684 wrote to memory of 4600	5684	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\instapp.a.1.11.exe
"C:\Users\Admin\AppData\Local\Temp\instapp.a.1.11.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2056

C:\Users\Public\nfJvWm\FvvtDF.exe
"C:\Users\Public\nfJvWm\FvvtDF.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nfJvWm\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nfJvWm\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2288
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1676
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2292
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4608
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5816

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\nfJvWm" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\nfJvWm" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4600

C:\Users\Public\nfJvWm\FvvtDF.exe
"C:\Users\Public\nfJvWm\FvvtDF.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6020

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2320

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3928

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5132

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 c47d9c5133ca3ee09ff366f42947736d812bfde939df6dcff1ee5ffa1c80b37f
MD5 dd0b3976e932137dcf6e109977dc663c
SHA1 59132b03b0587c1aca252eead795a9d8eda2a712
SHA512 196347fa740cfb34a1041589edccfaa7ae7637c99de6f5c5f3e2a6fef5253a9682cf5494788067007e66329af8b33db82e3230c781db60e9c40e15a89381dd10
TLSH
T19231C69A4FB136D0BF401D033ACAE536BDB1A6D508BD104F5275D4DA5B103653F9650A
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 6f6478905d508ca199b86b67c2ab1322fcd1d94d9ed67d1a7f68a43f31a56491
MD5 540389ccdd3ca8c27e66b4e97cc8950d
SHA1 5f7f9837a406dd9c2328b4167a89a9049a07396a
SHA512 22cffd9ce3f41caf6a18364ba9eacab66eb81c8337a2939ce2f2eedc8f549a5d5a7cf010181f62f8d417b5e9ee5c0ce00507aec40cbdfba79b2517c35b948ff9
TLSH
T18D31F6C69E3D44679B089F7406E5C43F7DF4A1695CE80802BA3ED1AA8705BBF2FC5081
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 24b15fc7084131d5c460dbd7dffccfeb7517b6379579110e795e24dbe9875a97
MD5 aaa47985ff7532d94b1302dd5ac7620c
SHA1 7c0e1b36e4174c4ad011b6484b6cae297bd0b5f9
SHA512 a0ff8c7122160a24c88b6120bc89b6fb42557a84d7960a44cb05793a1f31ead537ab3a3c80c71d5efd92f74d541a145b7fdbc54cd0f99cf8c2cbda95fdb179bc
TLSH
T14DF0DC2C09BC413DF133DA3C8BCA3A921A6EF282240244E81AE1070C6011D823D615FC
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 08c3cf6ae10a2d494ed5f743b8ac9b249522fce16dd5d0bb28c4186e6574447b
MD5 afde861a135f81a4d6d4a00a04769512
SHA1 8759bbe1f9952a6f9acdd9abbe8f94cd9c349959
SHA512 5b91ce38f436b08a98a2fc3ca1c7eab9ddf2310df0d924a8112f7cc39fe3c438c69ef3e4038ec17f18dce8a4da4fbe5c67e0bc12f7bcb5f94adbfcee12bf5dc3
TLSH
T106F0553869EA026FF27F92F8C7C777736926E223100626EB0FE903442A718006C8122C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ip1vzkts.tg0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ip1vzkts.tg0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

FvvtDF.exe

Path C:\Users\Public\nfJvWm\FvvtDF.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\nfJvWm\UxEnhance64.dll
Size 3.1MB
SHA256 e3c93ed6fd37ded76e66a5445c4ebe37cbd8110922b6c4ae8d0c68a0558e9a46
MD5 8071b6eeda98932ffaf8be87795e8603
SHA1 1f57216551bdfe1889001d1dae6d8457bf67e09b
SHA512 e5fca3ec5bd1b04150b1e8eb1f9a3086da402e15ef85ed80691eb240b735d992e039736483c3ce5afa032433c052c62d81d2eec56294794104bc3c4a9cba6d2c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+g:P9m29xx3Tiqt06ox6+z2rNNrKog
TLSH
T1A7E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\nfJvWm\adoresd.dat
Size 4.7MB
SHA256 a241cdc330a9befe9a0488962c2d587bcbef2edb18f37ba3339b663cebb8439c
MD5 a3fd18da5536a07d3202845c5f09e480
SHA1 c1da3c568d8bc00d4b16cbc3c3c6f6d37f3cf0b3
SHA512 f9d46c2f930d61bb0cb153a19f6ce4e9e9a598e470c3284cbfc0214530a007620137e3543b2809f14546e0ca4b7218759ffd3bac2f68758a6560af4c919c0ded
SSDEEP 98304:ZKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:ZKClqhi0Cv54K2IVS0VQg
TLSH
T11A3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\nfJvWm\msadox.tb
Size 8KB
SHA256 ee5f767956f2065923fb6114e4a2f641337df473fd30b28f49a015ebd1c17959
MD5 0f123b0c5f288d7d8c27e79e9daad251
SHA1 a8dbfc6203cd8a6c7ae9b5b406fd4cc0068190b2
SHA512 de0052b8c830f969c6efaa9afaa4c4c21e8858856d3d17e0b7538d8456c2845b93bb0866a96d130fdeca03152a5f6e3a9203e52dc606b8ecab055362fb9d07f6
SSDEEP 192:7qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:7sZqZOXQ3uqvR2Kfzp
TLSH
T15F029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2056-525-0x00007FFF37950000-0x00007FFF37962000-memory.dmp

Download

memory/2056-1-0x0000000002A20000-0x0000000002A2E000-memory.dmp

Download

memory/2056-0-0x0000000002A20000-0x0000000002A2E000-memory.dmp

Download

memory/2056-2-0x00000000044E0000-0x00000000044EC000-memory.dmp

Download

memory/2056-504-0x00007FFF37950000-0x00007FFF37962000-memory.dmp

Download

memory/2056-524-0x0000000002A20000-0x0000000002A2E000-memory.dmp

Download

memory/2404-545-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-536-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-546-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-531-0x00007FFF1F280000-0x00007FFF1F79E000-memory.dmp

Download

memory/2404-550-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-557-0x0000027697A00000-0x0000027697A4E000-memory.dmp

Download

memory/2404-561-0x0000027697AE0000-0x0000027697B6A000-memory.dmp

Download

memory/2404-558-0x0000027697AE0000-0x0000027697B6A000-memory.dmp

Download

memory/2404-560-0x0000027697AE0000-0x0000027697B6A000-memory.dmp

Download

memory/2404-559-0x0000027697AE0000-0x0000027697B6A000-memory.dmp

Download

memory/2404-564-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-565-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-544-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-538-0x00007FFF41F80000-0x00007FFF41F82000-memory.dmp

Download

memory/2404-539-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-543-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-613-0x0000027697170000-0x00000276979F7000-memory.dmp

Download

memory/2404-530-0x00007FFF41F70000-0x00007FFF41F72000-memory.dmp

Download

memory/3136-603-0x0000017269AA0000-0x0000017269AC2000-memory.dmp

Download

memory/3136-614-0x0000017269B10000-0x0000017269B1A000-memory.dmp

Download

memory/3136-611-0x0000017269E40000-0x0000017269EF2000-memory.dmp

Download

memory/3136-610-0x0000017269AF0000-0x0000017269B0E000-memory.dmp

Download

memory/6020-595-0x000001E514E10000-0x000001E515697000-memory.dmp

Download

memory/6020-592-0x000001E514E10000-0x000001E515697000-memory.dmp

Download

memory/6020-594-0x000001E514E10000-0x000001E515697000-memory.dmp

Download

memory/6020-589-0x000001E514E10000-0x000001E515697000-memory.dmp

Download

memory/6020-596-0x00007FFF41F70000-0x00007FFF41F72000-memory.dmp

Download

memory/6020-580-0x000001E514E10000-0x000001E515697000-memory.dmp

Download

memory/6020-593-0x000001E514E10000-0x000001E515697000-memory.dmp

Download

memory/6020-577-0x00007FFF1F280000-0x00007FFF1F79E000-memory.dmp

Download

memory/6020-587-0x00007FFF41F80000-0x00007FFF41F82000-memory.dmp

Download