494bfc9db6983c6f95ef6f6929a26836f183bbda914699bdeaaea769e1cc219d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.03.exe
Size 34.9MB
Sample261017-bdsrgacd95
SHA256 494bfc9db6983c6f95ef6f6929a26836f183bbda914699bdeaaea769e1cc219d
MD5 36a9cbe6afba292058a2244753bfa277
SHA1 04dfc51ce31dac9e8d10292229027f915d48e4d7
SHA512 7158a9e845fc67a4047afee96b77ea86364aba96187e3557fb6e072cc6824e2fc389abf4d84db0acc3107144663bb9f8ada8a06e08033ce1d0a699638bb9af0a
SSDEEP 98304:/9ZSiQfMJP+2yG3P6GCwmIuFbY8pfrfrDMdl:O5fMJP+XG3SGhdspz8l
TLSH
T1C5871A5ABB91CE81F51A82705C6A87D06372FEB84EB1C30B315C772CAF7E2844DE1599
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\ZpjJ8s = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1160	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3932	vpLQxe.exe
1988	vpLQxe.exe

Loads dropped DLL 2 IoCs

pid	Process
3932	vpLQxe.exe
1988	vpLQxe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\ZpjJ8s\\vpLQxe.exe\""	vpLQxe.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4632	cmd.exe
2156	cmd.exe
5400	cmd.exe
4608	cmd.exe
3348	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	vpLQxe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\m2fbUG\XPSPLOG.dll	vpLQxe.exe
File opened for modification	C:\Program Files (x86)\m2fbUG	vpLQxe.exe
File created	C:\Program Files (x86)\m2fbUG\image.png	vpLQxe.exe
File created	C:\Program Files (x86)\m2fbUG\thumbs.db	vpLQxe.exe
File opened for modification	C:\Program Files (x86)\m2fbUG\image.png	vpLQxe.exe
File opened for modification	C:\Program Files (x86)\m2fbUG\thumbs.db	vpLQxe.exe
File created	C:\Program Files (x86)\m2fbUG\m2fbUG.exe	vpLQxe.exe
File created	C:\Program Files (x86)\m2fbUG\XPSPLOG.dll	vpLQxe.exe
File opened for modification	C:\Program Files (x86)\m2fbUG\m2fbUG.exe	vpLQxe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5188	cmd.exe
5812	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vpLQxe.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vpLQxe.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3216	schtasks.exe
3288	schtasks.exe
4352	schtasks.exe
5152	schtasks.exe
2420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
2908	install.2.0.03.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe
3932	vpLQxe.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeIncreaseQuotaPrivilege	1160	powershell.exe
Token: SeSecurityPrivilege	1160	powershell.exe
Token: SeTakeOwnershipPrivilege	1160	powershell.exe
Token: SeLoadDriverPrivilege	1160	powershell.exe
Token: SeSystemProfilePrivilege	1160	powershell.exe
Token: SeSystemtimePrivilege	1160	powershell.exe
Token: SeProfSingleProcessPrivilege	1160	powershell.exe
Token: SeIncBasePriorityPrivilege	1160	powershell.exe
Token: SeCreatePagefilePrivilege	1160	powershell.exe
Token: SeBackupPrivilege	1160	powershell.exe
Token: SeRestorePrivilege	1160	powershell.exe
Token: SeShutdownPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeSystemEnvironmentPrivilege	1160	powershell.exe
Token: SeRemoteShutdownPrivilege	1160	powershell.exe
Token: SeUndockPrivilege	1160	powershell.exe
Token: SeManageVolumePrivilege	1160	powershell.exe
Token: 33	1160	powershell.exe
Token: 34	1160	powershell.exe
Token: 35	1160	powershell.exe
Token: 36	1160	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 1160	3932	vpLQxe.exe	93
PID 3932 wrote to memory of 4632	3932	vpLQxe.exe	95
PID 4632 wrote to memory of 3216	4632	cmd.exe	97
PID 4632 wrote to memory of 4172	4632	cmd.exe	98
PID 3932 wrote to memory of 2156	3932	vpLQxe.exe	100
PID 3932 wrote to memory of 5400	3932	vpLQxe.exe	103
PID 4632 wrote to memory of 5240	4632	cmd.exe	106
PID 2156 wrote to memory of 3288	2156	cmd.exe	107
PID 5400 wrote to memory of 4352	5400	cmd.exe	108
PID 2156 wrote to memory of 5880	2156	cmd.exe	109
PID 2156 wrote to memory of 1360	2156	cmd.exe	111
PID 3932 wrote to memory of 4608	3932	vpLQxe.exe	112
PID 5400 wrote to memory of 5848	5400	cmd.exe	113
PID 4608 wrote to memory of 5152	4608	cmd.exe	115
PID 5400 wrote to memory of 3708	5400	cmd.exe	116
PID 4608 wrote to memory of 5480	4608	cmd.exe	117
PID 3932 wrote to memory of 3348	3932	vpLQxe.exe	118
PID 3348 wrote to memory of 2420	3348	cmd.exe	120
PID 4608 wrote to memory of 2648	4608	cmd.exe	121
PID 3348 wrote to memory of 1088	3348	cmd.exe	122
PID 3348 wrote to memory of 5220	3348	cmd.exe	123
PID 5188 wrote to memory of 2808	5188	cmd.exe	126
PID 5812 wrote to memory of 4200	5812	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2908

C:\Users\Public\ZpjJ8s\vpLQxe.exe
"C:\Users\Public\ZpjJ8s\vpLQxe.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ZpjJ8s\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ZpjJ8s\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3288
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4352
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5152
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5220
- C:\Program Files (x86)\m2fbUG\m2fbUG.exe
  "C:\Program Files (x86)\m2fbUG\m2fbUG.exe"
  2⤵
  PID:5588

C:\Users\Public\ZpjJ8s\vpLQxe.exe
"C:\Users\Public\ZpjJ8s\vpLQxe.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ZpjJ8s" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ZpjJ8s" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4200

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1640

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\m2fbUG\XPSPLOG.dll
Size 4.6MB
SHA256 7ea98aeffd4fd2dfe7c87d5879603ed5ef1371b72afb62fdea07b022036a5768
MD5 2e618e927373672f2a1eae3e5ddb2eea
SHA1 99460ce1fc0e5acdafd5214ccfb6313c1dffbd9e
SHA512 709af7b1458d0ed2c9c6da5e7fef5871cda8966eb55a2488416884b7b607853ef7d8f5a03ee9999085f551719b6e54348cc376c0ed5115fe64b0f4c4e015e98c
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyL:BMWKfU+BcUTHCCCfqCiUffnL
TLSH
T136263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\m2fbUG\image.png
Size 576KB
SHA256 a18b74a35ad78d034d09386e66bd4cbf78eb450daf743516f3e1197dac4b34fa
MD5 058259aa66962166482d97dec7c7a084
SHA1 073da208a241b1e25e015088676369d83d635f05
SHA512 a47975238ad95e949ae902c72f9aad2c90f500ea108d0e97824d549d8f85cef9ea10974ac2970c3557afa5d18d22bc31d9040a9b272ec71ac98b57cb309777f6
SSDEEP 12288:S0Q2dXCOHU3sGLZ5krJHNWPUH2ZrbWCm4hKO0g+X1D3ZLonPmVatb:S2dSOuL/aJtWPUH+HHKt1DJLojtb
TLSH
T149C4234FDAEB7F9951E0B006D0179CD0A72E57B280C225B184A7FB29FA1931FB19B11D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m2fbUG.exe

Path C:\Program Files (x86)\m2fbUG\m2fbUG.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 6c3e9051942c77fd718aaa63f85a383779e4d80fe0a31849c37da4c4b93cb25a
MD5 8ce6aa7a8c943b38c5bca65029e065bf
SHA1 dc38794ead0c3db9a3da10bae2c385fa630b53a0
SHA512 08a583f676d0665cf7ebd41977567c7ee198d681292ee1233019c73c031402d8b00065fb966812364c019375617542d01eda1f019a230a9cd56f975610d75db0
TLSH
T15B3176B75F7E7D865F3A0E9025CAE6325CEDF1505CCA40592225C8589F483A12F4D508
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 40d6293b3a3685c0bf748cf64758e7e3eeaf648648feeb5ba956a28e176cbfaa
MD5 ad36b713a2e1514b72f5e43c44107814
SHA1 47168a2f89e78cfd58d83a663b5ee82bd77c3cf9
SHA512 bbcfcdcbb896cf6b997e6dbab316a7e844ba57e590197a43154c70e0f1686d02d95410a980a48178fea3e0e7191c2cdb6b71f91b9ce79ff2ac7d55e964494aad
TLSH
T18831F6978BBA0012AF0C4F7952E0E13FACF1E1715CD80802322DC16B861ABB72FC1064
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 d8a00267a9622de8e5e81869c0977d7167f7f2e5c1921e835d5d0f30a8769579
MD5 51425ccb95c6d323329e9e281acc5a8e
SHA1 021d463de4f4edbfb53211d9f14f77c97ba20563
SHA512 60963bc00ad584abc5c1635f0573421a051a9e1b86403b9254654646b79e9af471bdb3703d8a0dab503b17c156f9bfec131c37ba23acdae7b8f27b7ddda0d12a
TLSH
T132F0DC145DBC413DF133CE3D9BCBBA970A7BF2032C068CA50AA8070EA541F0AAD41675
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 97e4b451c33fc72b32db5e61c61eb1a336f424895dff89573327ac5097f98a2c
MD5 4b2377229da77196ba6b1706b446e348
SHA1 5956e3882c27ca0d9222ec2b17d36460229194fc
SHA512 3d7dc6f146c321a3fb2ef6614e6fe50019e2c823500834652d3a56b613ddb38872d114b17c30b66c3720a302d5b26fc918d55cee91240acda798289b41d29030
TLSH
T147F05C3982D9012AF07BE2F486D776A16D36E5323806617D0AF5039C1B92D011C83269
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3sf0ecne.kzn.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3sf0ecne.kzn.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ZpjJ8s\UxEnhance64.dll
Size 3.1MB
SHA256 6b06f3bb489cdd27abec4e893ea6960431d43a256ae39193a1c5a419ed3f8450
MD5 e344cb57c6af8e0dbad57285270ab869
SHA1 c01a19ae4466ebf7106deaddcc11473a2c28a40e
SHA512 91e6456def85fd98f070d72ce9b1e5379cb7ba0e15b649e4414177fda2fdc7fd07d3492323d1ce7d7b547ca8e81b5e5e0250b3c90165dc8bf4f982f7123f16ff
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+9:P9m29xx3Tiqt06ox6+z2rNNrKo9
TLSH
T168E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\ZpjJ8s\adoresd.dat
Size 4.7MB
SHA256 0563f8b628dd62b78b012c9180c9b9e9e0e9abd9e5781502859e53bd5fd51cff
MD5 08a70b568b1e28784a3212a04e112964
SHA1 1727b398d0143d66f586919e7458acb7e97a530c
SHA512 43b90745e5ee36ed5aef09cfc29bfd4a74ecad43947b9ad5c9f90261127eb73907e4192ee247740fb373b2c6b10ce499a73ac3473667eebc39621603142e17b6
SSDEEP 98304:DKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:DKClqhi0Cv54K2IVS0VQg
TLSH
T1893633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\ZpjJ8s\msadox.tb
Size 8KB
SHA256 da8eed8d5129513eaa302ffbc0660c9fe3c2dcbea50e6207e0c16e9892c2ca06
MD5 c2a951fcb4ccf86e340b0d2a989b357a
SHA1 1f1656a41a4c6273e3e9594e675514f6b0adfeba
SHA512 662a884114759677fa5a00608be1d2dda65cd99eeb643c9087ab4be5d03717b79c7cef420f37ebb85ab1795160d3365e50e63fbaadb2cf653f39f263d7840ffa
SSDEEP 192:4qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:4sZqZOXQ3uqvR2Kfzp
TLSH
T16B029E06D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpLQxe.exe

Path C:\Users\Public\ZpjJ8s\vpLQxe.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-606-0x0000026AEB280000-0x0000026AEB28A000-memory.dmp

Download

memory/1160-603-0x0000026AEB1A0000-0x0000026AEB1BE000-memory.dmp

Download

memory/1160-600-0x0000026AEB100000-0x0000026AEB122000-memory.dmp

Download

memory/1160-604-0x0000026AEB1C0000-0x0000026AEB272000-memory.dmp

Download

memory/1988-582-0x00007FFB7F4C0000-0x00007FFB7F4C2000-memory.dmp

Download

memory/1988-587-0x0000023E57670000-0x0000023E57EF7000-memory.dmp

Download

memory/1988-574-0x00007FFB5D8B0000-0x00007FFB5DDCE000-memory.dmp

Download

memory/1988-588-0x0000023E57670000-0x0000023E57EF7000-memory.dmp

Download

memory/1988-590-0x0000023E57670000-0x0000023E57EF7000-memory.dmp

Download

memory/1988-589-0x0000023E57670000-0x0000023E57EF7000-memory.dmp

Download

memory/1988-591-0x00007FFB7F4B0000-0x00007FFB7F4B2000-memory.dmp

Download

memory/1988-580-0x0000023E57670000-0x0000023E57EF7000-memory.dmp

Download

memory/1988-583-0x0000023E57670000-0x0000023E57EF7000-memory.dmp

Download

memory/2908-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2908-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2908-504-0x00007FFB77160000-0x00007FFB77172000-memory.dmp

Download

memory/2908-525-0x00007FFB77160000-0x00007FFB77172000-memory.dmp

Download

memory/2908-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/2908-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/3932-536-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-550-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-565-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-563-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-560-0x0000024486F70000-0x0000024486FFA000-memory.dmp

Download

memory/3932-556-0x0000024485BA0000-0x0000024485BEE000-memory.dmp

Download

memory/3932-558-0x0000024486F70000-0x0000024486FFA000-memory.dmp

Download

memory/3932-559-0x0000024486F70000-0x0000024486FFA000-memory.dmp

Download

memory/3932-561-0x0000024486F70000-0x0000024486FFA000-memory.dmp

Download

memory/3932-567-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-546-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-545-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-544-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-539-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-538-0x00007FFB7F4C0000-0x00007FFB7F4C2000-memory.dmp

Download

memory/3932-543-0x00000244865E0000-0x0000024486E67000-memory.dmp

Download

memory/3932-531-0x00007FFB5D8B0000-0x00007FFB5DDCE000-memory.dmp

Download

memory/3932-530-0x00007FFB7F4B0000-0x00007FFB7F4B2000-memory.dmp

Download

memory/5588-674-0x0000000074990000-0x00000000750DA000-memory.dmp

Download

memory/5588-673-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Download