008a6eb91d76e0bd98fd0e085a319d6fa6a8898f0bae98540b0224f0986bd083

Analysis

max time kernel
151s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
instdoload.1.3.11.exe
Size 38.8MB
Sample261001-v97eaaxsew
SHA256 008a6eb91d76e0bd98fd0e085a319d6fa6a8898f0bae98540b0224f0986bd083
MD5 84644648be3080c5c6291e41824f58ff
SHA1 9637704a70c042ff23e80b2a790fa6a56a8d5977
SHA512 ca1b149fb8bd0d20f7f6ada5909870973dded22d55a33c32ae1d7eea2afc139054cf51f59f8d3a101064ca6233471c66cd066a7f7c478ae3601b6dc46af463b7
SSDEEP 49152:PF335nW2J++1hhWugAx8z/TdqRD4a85Ejr9CbHd5nYeWgRO:95L3XLgAm9EHUvO
TLSH
T1CD972C02B6468CC6F54852F45897FAA423FDFCB48AD5C31732E4671EAF9E28C0E83595
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\1iuqfw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3428	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1440	bTTyfm.exe
5824	bTTyfm.exe

Loads dropped DLL 2 IoCs

pid	Process
1440	bTTyfm.exe
5824	bTTyfm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\1iuqfw\\bTTyfm.exe\""	bTTyfm.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4676	cmd.exe
2952	cmd.exe
6016	cmd.exe
4860	cmd.exe
1236	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	bTTyfm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2448	cmd.exe
3424	cmd.exe
4480	cmd.exe
472	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bTTyfm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	instdoload.1.3.11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	instdoload.1.3.11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bTTyfm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6124	schtasks.exe
5144	schtasks.exe
5064	schtasks.exe
3700	schtasks.exe
5992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
5852	instdoload.1.3.11.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe
1440	bTTyfm.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeIncreaseQuotaPrivilege	3428	powershell.exe
Token: SeSecurityPrivilege	3428	powershell.exe
Token: SeTakeOwnershipPrivilege	3428	powershell.exe
Token: SeLoadDriverPrivilege	3428	powershell.exe
Token: SeSystemProfilePrivilege	3428	powershell.exe
Token: SeSystemtimePrivilege	3428	powershell.exe
Token: SeProfSingleProcessPrivilege	3428	powershell.exe
Token: SeIncBasePriorityPrivilege	3428	powershell.exe
Token: SeCreatePagefilePrivilege	3428	powershell.exe
Token: SeBackupPrivilege	3428	powershell.exe
Token: SeRestorePrivilege	3428	powershell.exe
Token: SeShutdownPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeSystemEnvironmentPrivilege	3428	powershell.exe
Token: SeRemoteShutdownPrivilege	3428	powershell.exe
Token: SeUndockPrivilege	3428	powershell.exe
Token: SeManageVolumePrivilege	3428	powershell.exe
Token: 33	3428	powershell.exe
Token: 34	3428	powershell.exe
Token: 35	3428	powershell.exe
Token: 36	3428	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 3428	1440	bTTyfm.exe	92
PID 1440 wrote to memory of 4676	1440	bTTyfm.exe	94
PID 4676 wrote to memory of 6124	4676	cmd.exe	97
PID 1440 wrote to memory of 2952	1440	bTTyfm.exe	98
PID 4676 wrote to memory of 4600	4676	cmd.exe	99
PID 2952 wrote to memory of 5144	2952	cmd.exe	103
PID 1440 wrote to memory of 6016	1440	bTTyfm.exe	105
PID 4676 wrote to memory of 5912	4676	cmd.exe	104
PID 6016 wrote to memory of 5064	6016	cmd.exe	108
PID 2952 wrote to memory of 1552	2952	cmd.exe	109
PID 6016 wrote to memory of 4704	6016	cmd.exe	111
PID 2952 wrote to memory of 5892	2952	cmd.exe	112
PID 1440 wrote to memory of 4860	1440	bTTyfm.exe	113
PID 6016 wrote to memory of 4780	6016	cmd.exe	115
PID 4860 wrote to memory of 3700	4860	cmd.exe	116
PID 4860 wrote to memory of 1828	4860	cmd.exe	117
PID 1440 wrote to memory of 1236	1440	bTTyfm.exe	122
PID 4860 wrote to memory of 2508	4860	cmd.exe	124
PID 1236 wrote to memory of 5992	1236	cmd.exe	125
PID 1236 wrote to memory of 2384	1236	cmd.exe	126
PID 1236 wrote to memory of 4420	1236	cmd.exe	128
PID 4480 wrote to memory of 6012	4480	cmd.exe	130
PID 3424 wrote to memory of 2200	3424	cmd.exe	131
PID 2448 wrote to memory of 5524	2448	cmd.exe	132
PID 472 wrote to memory of 1452	472	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\instdoload.1.3.11.exe
"C:\Users\Admin\AppData\Local\Temp\instdoload.1.3.11.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5852

C:\Users\Public\1iuqfw\bTTyfm.exe
"C:\Users\Public\1iuqfw\bTTyfm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\1iuqfw\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\1iuqfw\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6124
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5144
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4704
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1828
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4420

C:\Users\Public\1iuqfw\bTTyfm.exe
"C:\Users\Public\1iuqfw\bTTyfm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5824

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\1iuqfw" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\1iuqfw" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5524

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1988

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2200

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6012

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 911ee1ef85e406c66a9636b4632abb2f492677fac3026526bea78228ede8f6e7
MD5 efa793ecebb4c1b48afb127e5ea5dde8
SHA1 57160bd2d446f14367b27f36259c2b9e125b9476
SHA512 4b2fdf23cb916c78f51ec0012e5944072236d5d45e6d0f739e7e41b4908548f4a1c757713a153d1ec56107c44c0f0f7ccad5037664a811b03c346fb16665ec9f
TLSH
T1FF31E9DACFF32780BF80BE1626C5D93ABDB667C018BD404A1135D4DB66213563E1680D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 becfc31d2cb72eb3b3dd6e9b6e79f9d3c9adfb20361323986f37822440217853
MD5 91f7ba311e27edea1940f80abc4b277f
SHA1 d30a5d353c0f43084aae85bb60878927c54aeba7
SHA512 aa91c920f3926e51224fef7bbd8fca5dd62aefb05a8a397457aad8a65bc0bcf38b9e8437f4a00dbe4c149ddd91f2a2bd5440f07b62469fe68400f76b29b6b9c6
TLSH
T131311A874A3C1002AF0D5F65A6D4C43B7DF0A165CCD44C81553FC1AA5999FBB5F89040
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 f99da9061a945f6fe0868eac770a5f0e184681902b6922038da62b90aa2c6b3e
MD5 c3151079f0e30f6156201c6377ee784b
SHA1 8c68a526e6abc6ccf4d7469ebfaa0574735d8d53
SHA512 5c5105b9560da8b1648059f8934a0b4b59ec0d393e23a647285283748029434fe71dd7acc2307da287aa29e13e84dc62e19e22c1bc85f6cf7488adb344ac2b56
TLSH
T18FF0DC2C047D423FF132EC3943C838E636BFF20E340680A003F45748E5518843C425B9
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 feff5e424d7824378c9b1b9d6a2e64937aa1eb185f6ebc71ac49c0113956de5e
MD5 ccd4d21276e73c3ae84c41686b88f805
SHA1 eacf38c2bb7f64b35c80a5fbab813117546f8ee2
SHA512 9d184948e7f86a04be4b3c0273eae5bf5d20912c3684f9199b6ded7f65f8a3c35e8302bc9da70397fd3158cb35731401d1c6d71701313c2073bb5458d46b0a57
TLSH
T14FF05C2D13DA842BF03BD2F486CB77F3497FE6270106D5AE09A603545B52D011C8126D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1nwqi0kr.sb4.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1nwqi0kr.sb4.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\1iuqfw\UxEnhance64.dll
Size 3.1MB
SHA256 7162b44a7aaed6e87a73f45b8775c9d5a1490b44172fbcdc27d7789d06e267b6
MD5 53c82026dccc20e9489428fc8baa0c3f
SHA1 5c9d6a73eb6a33fb64c7d26ddac077a1ab7ad164
SHA512 ac719855bf1650f160b76b1e06c98081c54398f733de6398b31ee1722177c7ce9456a692703163ccd59b602dbbc0da1e1fffd210b9be6adc2e409740e2b83f35
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+U:P9m29xx3Tiqt06ox6+z2rNNrKoU
TLSH
T16FE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\1iuqfw\adoresd.dat
Size 4.7MB
SHA256 8171baa609f3c2a25bd6bc6ae262ccdac4cd486d1d34a2998623e0b628b19f08
MD5 af52d57d0b5295d31aa5c8def929d71e
SHA1 9b6c3812e43538c62668b037609e7b93d2ad144b
SHA512 4a01410b011c41b39e38d1b42884afa1e48a8e71d271033457058a4f9de8f2a333bf695ffb358d160e250ceff06dc9a92a33b5a3bc5b7b2453f3f2cb3fe4844e
SSDEEP 98304:mKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:mKClqhi0Cv54K2IVS0VQg
TLSH
T18E3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bTTyfm.exe

Path C:\Users\Public\1iuqfw\bTTyfm.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\1iuqfw\msadox.tb
Size 8KB
SHA256 94769727683291722c0e9d1c2b50148a807d66c543e4dd2e7aadf4e7d4940dc3
MD5 f078be737ee8d23231ff91b07bd4a482
SHA1 c21710e5cb874e01542e50e95a73d83d8539daa9
SHA512 e06883f764584675786526a74f84fbc938b19603ea9eb57a0af1576880b0cae4c4034080568c41583ad528465e536204c0a9fdbee2d1c0bd2ea40bbddbce7070
SSDEEP 192:oqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:osZqZOXQ3uqvR2Kfzp
TLSH
T15B029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1440-530-0x00007FF967090000-0x00007FF967092000-memory.dmp

Download

memory/1440-556-0x000001E431EA0000-0x000001E431EEE000-memory.dmp

Download

memory/1440-567-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/1440-536-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/1440-538-0x00007FF9670A0000-0x00007FF9670A2000-memory.dmp

Download

memory/1440-539-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/1440-543-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/1440-544-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/1440-546-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/1440-545-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/1440-550-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/1440-531-0x00007FF946910000-0x00007FF946E2E000-memory.dmp

Download

memory/1440-559-0x000001E433210000-0x000001E43329A000-memory.dmp

Download

memory/1440-560-0x000001E433210000-0x000001E43329A000-memory.dmp

Download

memory/1440-557-0x000001E433210000-0x000001E43329A000-memory.dmp

Download

memory/1440-558-0x000001E433210000-0x000001E43329A000-memory.dmp

Download

memory/1440-564-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/1440-566-0x000001E432980000-0x000001E433207000-memory.dmp

Download

memory/3428-606-0x00000214CC910000-0x00000214CC91A000-memory.dmp

Download

memory/3428-605-0x00000214CCB40000-0x00000214CCBF2000-memory.dmp

Download

memory/3428-604-0x00000214CCB20000-0x00000214CCB3E000-memory.dmp

Download

memory/3428-601-0x00000214CC890000-0x00000214CC8B2000-memory.dmp

Download

memory/5824-588-0x00000289F0080000-0x00000289F0907000-memory.dmp

Download

memory/5824-589-0x00000289F0080000-0x00000289F0907000-memory.dmp

Download

memory/5824-573-0x00007FF946910000-0x00007FF946E2E000-memory.dmp

Download

memory/5824-576-0x00000289F0080000-0x00000289F0907000-memory.dmp

Download

memory/5824-583-0x00000289F0080000-0x00000289F0907000-memory.dmp

Download

memory/5824-587-0x00000289F0080000-0x00000289F0907000-memory.dmp

Download

memory/5824-591-0x00007FF967090000-0x00007FF967092000-memory.dmp

Download

memory/5824-582-0x00007FF9670A0000-0x00007FF9670A2000-memory.dmp

Download

memory/5824-590-0x00000289F0080000-0x00000289F0907000-memory.dmp

Download

memory/5852-504-0x00007FF95EE60000-0x00007FF95EE72000-memory.dmp

Download

memory/5852-2-0x00000000008C0000-0x00000000008CC000-memory.dmp

Download

memory/5852-525-0x00007FF95EE60000-0x00007FF95EE72000-memory.dmp

Download

memory/5852-1-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/5852-524-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/5852-0-0x0000000000490000-0x000000000049E000-memory.dmp

Download