ff6ec075348b964d5910f80aa088508d906900b5a316a967eb5e5e4043e655f8

Analysis

max time kernel
151s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 30.0MB
Sample261018-w2yylstset
SHA256 ff6ec075348b964d5910f80aa088508d906900b5a316a967eb5e5e4043e655f8
MD5 8d4a4182b818f5a2c944469670c638e8
SHA1 82070f85472007f2c0503c7fa6501e34fdb68298
SHA512 2e3a2186bc529de1bcb159f94790997ce5b09da0416c39e7a9e1b43d6a1ef5a6d2b5ff4281171a7e220ef90d6e108f81941752c73ed2403417ca4e0e77ad408f
SSDEEP 49152:r85t1a8IFXTDqgBEA9xzJkW40bkSnY53wfC8oWz2rf8oW7O6CcxuLxxuLexuLUB6:wlaNCgBxzWWFA3w7Nz2rf8ogCVbojaEP
TLSH
T11967D68ABB01DDC3F44A9270D45A97E16372ED71CFA1871721A57F157FBE2888ED2088
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\raGydJ = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
632	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5868	0a7FDv.exe
5024	0a7FDv.exe

Loads dropped DLL 2 IoCs

pid	Process
5868	0a7FDv.exe
5024	0a7FDv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\raGydJ\\0a7FDv.exe\""	0a7FDv.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4576	cmd.exe
1432	cmd.exe
5368	cmd.exe
1764	cmd.exe
5112	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	0a7FDv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2476	cmd.exe
3180	cmd.exe
4100	cmd.exe
2984	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0a7FDv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0a7FDv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3468	schtasks.exe
5008	schtasks.exe
2868	schtasks.exe
2784	schtasks.exe
1172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
4344	install.2.0.02.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe
5868	0a7FDv.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	powershell.exe
Token: SeIncreaseQuotaPrivilege	632	powershell.exe
Token: SeSecurityPrivilege	632	powershell.exe
Token: SeTakeOwnershipPrivilege	632	powershell.exe
Token: SeLoadDriverPrivilege	632	powershell.exe
Token: SeSystemProfilePrivilege	632	powershell.exe
Token: SeSystemtimePrivilege	632	powershell.exe
Token: SeProfSingleProcessPrivilege	632	powershell.exe
Token: SeIncBasePriorityPrivilege	632	powershell.exe
Token: SeCreatePagefilePrivilege	632	powershell.exe
Token: SeBackupPrivilege	632	powershell.exe
Token: SeRestorePrivilege	632	powershell.exe
Token: SeShutdownPrivilege	632	powershell.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeSystemEnvironmentPrivilege	632	powershell.exe
Token: SeRemoteShutdownPrivilege	632	powershell.exe
Token: SeUndockPrivilege	632	powershell.exe
Token: SeManageVolumePrivilege	632	powershell.exe
Token: 33	632	powershell.exe
Token: 34	632	powershell.exe
Token: 35	632	powershell.exe
Token: 36	632	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 632	5868	0a7FDv.exe	93
PID 5868 wrote to memory of 4576	5868	0a7FDv.exe	95
PID 4576 wrote to memory of 2868	4576	cmd.exe	98
PID 4576 wrote to memory of 1948	4576	cmd.exe	100
PID 5868 wrote to memory of 1432	5868	0a7FDv.exe	101
PID 4576 wrote to memory of 1064	4576	cmd.exe	105
PID 5868 wrote to memory of 5368	5868	0a7FDv.exe	106
PID 1432 wrote to memory of 2784	1432	cmd.exe	108
PID 5368 wrote to memory of 1172	5368	cmd.exe	109
PID 1432 wrote to memory of 3412	1432	cmd.exe	110
PID 5368 wrote to memory of 1036	5368	cmd.exe	111
PID 1432 wrote to memory of 5660	1432	cmd.exe	113
PID 5868 wrote to memory of 1764	5868	0a7FDv.exe	114
PID 5368 wrote to memory of 2808	5368	cmd.exe	115
PID 1764 wrote to memory of 3468	1764	cmd.exe	117
PID 1764 wrote to memory of 5936	1764	cmd.exe	120
PID 5868 wrote to memory of 5112	5868	0a7FDv.exe	122
PID 1764 wrote to memory of 1768	1764	cmd.exe	124
PID 5112 wrote to memory of 5008	5112	cmd.exe	126
PID 5112 wrote to memory of 5496	5112	cmd.exe	127
PID 5112 wrote to memory of 3772	5112	cmd.exe	129
PID 3180 wrote to memory of 2424	3180	cmd.exe	131
PID 2476 wrote to memory of 2228	2476	cmd.exe	132
PID 4100 wrote to memory of 5800	4100	cmd.exe	133
PID 2984 wrote to memory of 1744	2984	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4996

C:\Users\Public\raGydJ\0a7FDv.exe
"C:\Users\Public\raGydJ\0a7FDv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\raGydJ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\raGydJ\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3412
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5936
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5008
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3772

C:\Users\Public\raGydJ\0a7FDv.exe
"C:\Users\Public\raGydJ\0a7FDv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5024

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4440

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\raGydJ" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\raGydJ" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2228

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2424

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5800

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 f146cb5922744e00a34f1404ed4f702f71f3c531d6aef1e5ee22b1b3bff2d74c
MD5 e35817953edbb2bce829cedc62151137
SHA1 c89427bf8c0795a5fc7ce6b3a00e3d43561e1029
SHA512 ca8cd03938b1737a469b036f55e22580d05feea197496dbc3f5b6070e13e48d083a71cd1c7748807475be76849874febb3b979d7a2203231594a134dd363ac37
TLSH
T18031A4BF2BBD39428F3E4E8415DBF23219E4E2902CC5004AA004C0954F043A22E4E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 1f2e3e7aa153baf599a87b3542bb1194b730c9ecb71b5575cca35d14299e8497
MD5 417180c032083698729b972df7f97609
SHA1 bc4897459e177bdbd080c525b2f6c6acd9518aa9
SHA512 06dc6e40a3d894a0e2ebdd8b1a638943c2e34d5d815e8b7fd5021853ca9036d4ff9aba56bc768bcc058e9c4abeeb66f63385db44bb692a381dd968b6d9936646
TLSH
T1C231B4C7CA7810029B1D6F7822D0D23B7CF0A9608CF45801722DC2AA8625BB76F8A448
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 1c9fc99fa3198df2ca1895805936795b297418a48bccccd7354eb2396557eac0
MD5 b74f5713c8103e0cc2b4691b81dc8f49
SHA1 0ef11dd086ea4f3428429cc159fa07fb34c2b800
SHA512 67f3be653819f03ee3469b10e4fd4a8d846ec019d1c24faa05a74649387092e4d67fe2cea464b240d0c02573d1e2fc1f438a6546046742aad95231c73be394b8
TLSH
T189F05C1C4ABD413DF173DA3987C97AD71EBBF60A140A89A40BF9470CA587D013D91ABA
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 ff4b7a17529a11f52af88b39a81f4e491e16398bb9f4b3dfe6b69bfbb336def3
MD5 790632d065b0042e1a142f9480f2bf81
SHA1 ff9df620c9bfe12edf7b84680bfc010c965a18e6
SHA512 60be5a4fd7371e60d36d72032682609ea087a4e046a2ae4578b2d69001889ecd3a691e0c3405b93b541e6ff9bc94692f378a28c62d3f38108ba778c56c648a89
TLSH
T15DF05C3959FA512BF07B95FC47C676B3DD69E326104A226A0AF543842E95C001C4166D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i5cqfoac.rvz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i5cqfoac.rvz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0a7FDv.exe

Path C:\Users\Public\raGydJ\0a7FDv.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\raGydJ\UxEnhance64.dll
Size 3.1MB
SHA256 33fffbace901f1f1e71471d92cd9f96e6dfd730ad04eec477754fc8fa36cf591
MD5 09f7713f61a0ac96253cc2701cfa6683
SHA1 3c2027ca82e1301558858d4b51af844d4ef0f285
SHA512 013c902cf215c0e9fa2a0c5f38d26450e5dea605d0a5cb1fc2d11b60df1c79d8b7d71d025e34976c55eaad9379f93091790544483753b055df7a337532bb6e87
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+O:P9m29xx3Tiqt06ox6+z2rNNrKoO
TLSH
T176E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\raGydJ\adoresd.dat
Size 4.7MB
SHA256 1404d17a70764fb80dadd65c1b9c27fcb406a1564ffee11b483f62a585f03ddd
MD5 6269ea0ebb415d027ab5b53d524029b7
SHA1 5dcf613a57b3c704ee1b894b0ecebe1f5424f39a
SHA512 eb2c74d485c79817d0d4216f53470024d8815a60aafd6b341b7d288ee1338150739af8189468e792f8673d8181e3f230a436d262f167c416d29157c6e9274115
SSDEEP 98304:MKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:MKClqhi0Cv54K2IVS0VQg
TLSH
T1193633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\raGydJ\msadox.tb
Size 8KB
SHA256 94769727683291722c0e9d1c2b50148a807d66c543e4dd2e7aadf4e7d4940dc3
MD5 f078be737ee8d23231ff91b07bd4a482
SHA1 c21710e5cb874e01542e50e95a73d83d8539daa9
SHA512 e06883f764584675786526a74f84fbc938b19603ea9eb57a0af1576880b0cae4c4034080568c41583ad528465e536204c0a9fdbee2d1c0bd2ea40bbddbce7070
SSDEEP 192:oqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:osZqZOXQ3uqvR2Kfzp
TLSH
T15B029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/632-615-0x00000287D26A0000-0x00000287D26BE000-memory.dmp

Download

memory/632-616-0x00000287D2700000-0x00000287D27B2000-memory.dmp

Download

memory/632-617-0x00000287D26C0000-0x00000287D26CA000-memory.dmp

Download

memory/632-606-0x00000287D2400000-0x00000287D2422000-memory.dmp

Download

memory/4344-527-0x00007FF91E3C0000-0x00007FF91E3D2000-memory.dmp

Download

memory/4344-526-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/4344-0-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/4344-504-0x00007FF91E3C0000-0x00007FF91E3D2000-memory.dmp

Download

memory/4344-2-0x0000000000490000-0x000000000049C000-memory.dmp

Download

memory/4344-1-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/5024-585-0x00007FF92A4E0000-0x00007FF92A4E2000-memory.dmp

Download

memory/5024-593-0x00000140D7FA0000-0x00000140D8827000-memory.dmp

Download

memory/5024-594-0x00007FF92A4D0000-0x00007FF92A4D2000-memory.dmp

Download

memory/5024-591-0x00000140D7FA0000-0x00000140D8827000-memory.dmp

Download

memory/5024-592-0x00000140D7FA0000-0x00000140D8827000-memory.dmp

Download

memory/5024-590-0x00000140D7FA0000-0x00000140D8827000-memory.dmp

Download

memory/5024-586-0x00000140D7FA0000-0x00000140D8827000-memory.dmp

Download

memory/5024-582-0x00000140D7FA0000-0x00000140D8827000-memory.dmp

Download

memory/5024-577-0x00007FF907800000-0x00007FF907D1E000-memory.dmp

Download

memory/5868-564-0x000001EFC6B20000-0x000001EFC6BAA000-memory.dmp

Download

memory/5868-559-0x000001EFC5770000-0x000001EFC57BE000-memory.dmp

Download

memory/5868-547-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-553-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-567-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-546-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-568-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-561-0x000001EFC6B20000-0x000001EFC6BAA000-memory.dmp

Download

memory/5868-548-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-549-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-563-0x000001EFC6B20000-0x000001EFC6BAA000-memory.dmp

Download

memory/5868-560-0x000001EFC6B20000-0x000001EFC6BAA000-memory.dmp

Download

memory/5868-541-0x00007FF92A4E0000-0x00007FF92A4E2000-memory.dmp

Download

memory/5868-542-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-608-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-539-0x000001EFC6200000-0x000001EFC6A87000-memory.dmp

Download

memory/5868-534-0x00007FF907800000-0x00007FF907D1E000-memory.dmp

Download

memory/5868-533-0x00007FF92A4D0000-0x00007FF92A4D2000-memory.dmp

Download