c4f77dcbeeff57a28298522596f81f23b118015cbc1b87fa2056c970078857e7

Analysis

max time kernel
151s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 34.6MB
Sample261022-1tjaeabf52
SHA256 c4f77dcbeeff57a28298522596f81f23b118015cbc1b87fa2056c970078857e7
MD5 4c302de7dfff18d1151ed13f48a26fd0
SHA1 2ea0e3f1f1daceb1312259897c8d77849ebdf636
SHA512 5b579b8de873c305e0d002149147af105a561a7c53eb85591a155311302d1cca10f2d889dbdd798ef62f29084fe0509cd51c9e172297b9fef84d07334d089c6f
SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAv:6ukQmH0HmKxofM3nl6UfMYrLgAv
TLSH
T113876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\9W3cCa = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4396	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4660	GWsk2Y.exe
2252	GWsk2Y.exe

Loads dropped DLL 2 IoCs

pid	Process
4660	GWsk2Y.exe
2252	GWsk2Y.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\9W3cCa\\GWsk2Y.exe\""	GWsk2Y.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5916	cmd.exe
6108	cmd.exe
1548	cmd.exe
3704	cmd.exe
3736	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	GWsk2Y.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5824	cmd.exe
4772	cmd.exe
628	cmd.exe
4108	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GWsk2Y.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GWsk2Y.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2944	schtasks.exe
3856	schtasks.exe
3152	schtasks.exe
4304	schtasks.exe
3436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
5072	install.2.0.02.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe
4660	GWsk2Y.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeIncreaseQuotaPrivilege	4396	powershell.exe
Token: SeSecurityPrivilege	4396	powershell.exe
Token: SeTakeOwnershipPrivilege	4396	powershell.exe
Token: SeLoadDriverPrivilege	4396	powershell.exe
Token: SeSystemProfilePrivilege	4396	powershell.exe
Token: SeSystemtimePrivilege	4396	powershell.exe
Token: SeProfSingleProcessPrivilege	4396	powershell.exe
Token: SeIncBasePriorityPrivilege	4396	powershell.exe
Token: SeCreatePagefilePrivilege	4396	powershell.exe
Token: SeBackupPrivilege	4396	powershell.exe
Token: SeRestorePrivilege	4396	powershell.exe
Token: SeShutdownPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeSystemEnvironmentPrivilege	4396	powershell.exe
Token: SeRemoteShutdownPrivilege	4396	powershell.exe
Token: SeUndockPrivilege	4396	powershell.exe
Token: SeManageVolumePrivilege	4396	powershell.exe
Token: 33	4396	powershell.exe
Token: 34	4396	powershell.exe
Token: 35	4396	powershell.exe
Token: 36	4396	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4396	4660	GWsk2Y.exe	91
PID 4660 wrote to memory of 5916	4660	GWsk2Y.exe	93
PID 5916 wrote to memory of 3152	5916	cmd.exe	95
PID 5916 wrote to memory of 3648	5916	cmd.exe	96
PID 5916 wrote to memory of 1836	5916	cmd.exe	98
PID 4660 wrote to memory of 6108	4660	GWsk2Y.exe	101
PID 6108 wrote to memory of 4304	6108	cmd.exe	105
PID 6108 wrote to memory of 776	6108	cmd.exe	106
PID 6108 wrote to memory of 2744	6108	cmd.exe	108
PID 4660 wrote to memory of 1548	4660	GWsk2Y.exe	109
PID 1548 wrote to memory of 3436	1548	cmd.exe	111
PID 4660 wrote to memory of 3704	4660	GWsk2Y.exe	112
PID 1548 wrote to memory of 3488	1548	cmd.exe	114
PID 3704 wrote to memory of 2944	3704	cmd.exe	116
PID 1548 wrote to memory of 5976	1548	cmd.exe	117
PID 3704 wrote to memory of 4684	3704	cmd.exe	118
PID 3704 wrote to memory of 4852	3704	cmd.exe	119
PID 4660 wrote to memory of 3736	4660	GWsk2Y.exe	123
PID 3736 wrote to memory of 3856	3736	cmd.exe	125
PID 3736 wrote to memory of 3884	3736	cmd.exe	126
PID 3736 wrote to memory of 916	3736	cmd.exe	129
PID 628 wrote to memory of 5164	628	cmd.exe	131
PID 5824 wrote to memory of 4676	5824	cmd.exe	133
PID 4772 wrote to memory of 2996	4772	cmd.exe	132
PID 4108 wrote to memory of 5360	4108	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5072

C:\Users\Public\9W3cCa\GWsk2Y.exe
"C:\Users\Public\9W3cCa\GWsk2Y.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9W3cCa\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9W3cCa\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3152
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4304
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:916

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9W3cCa" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9W3cCa" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4676

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:680

C:\Users\Public\9W3cCa\GWsk2Y.exe
"C:\Users\Public\9W3cCa\GWsk2Y.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2996

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5164

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 a2616b88c59ad4edbc476af5ef9816b776592de8d1243eab1bdcff45eedda456
MD5 b4fe1783cd53447e66ba9179df73423f
SHA1 e7fb1de0603321e3b8db07ccc50117e66e1153e1
SHA512 ee25eba53de17711265059216d9412d38114f32df3a589ddec83fe5bc97eb356d220cfa21004a3b61be61dc9095c4b8360ee0c38fb94acb99ccca59163880020
TLSH
T1F73154771FAD7A86DF6A4EA025CAE1361CE5A3D05DD9009A2112C4D5AB483B22F5A90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 66020f47e06d1790d54462eb9aa21cf3c4a7108731c902e1dfdbf7b19f93fda8
MD5 ed2ad0993d4fa50d7ac501c90277d1fd
SHA1 70e9462ec77e9cf1d920fed90256b69b2145ed5c
SHA512 b30ddb97b68696be56edf115c0a2624c4ab716c7a725c94d40ded440b161360705b7b55419c613299f85ccee3ddc28a64fc49d6100d664cdec79a13894f8eece
TLSH
T16231D6AA5E390007EF0C9F7552C0C23BACFAB564CDE814426A2DC15BEA24BB71FC6845
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 1fdb1ac78814a03855a8e72776883674dc926ef498779b46d191bb5f182b8611
MD5 8d1ed8a9ff8a8b2e9aa3b369336b0d97
SHA1 c4952f9e1b51a9de376c740a29e2c714e73ad892
SHA512 437b781632f7dc2ae8da55aa8b697e916f2089409aae66a275703fe77a9a0dec1c80c6d782361677f35a779c1b04cd87111372c42707e14c43cb065c72977151
TLSH
T1ACF0DC1C54FD012CF032DE3C4ADE39931A7FF602380185A807A54708B506A026C91B7D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 7c8947883268053f2c7adc519a5b5d6148820eeed32daed3898ee694b50d111e
MD5 24f42d94ce3b9352769b7aaa8261a2d6
SHA1 a5ed274dca20ab9debf2a4a3ced88693891076aa
SHA512 f130aebdf077ab16fcd6a29c9d4cc20cad755b6002fd84aafe8f60389bbe0b17ec88e409c135dbe98bc6db48048c3bd95eead395498bfcbc63b7392bbe9b7b7f
TLSH
T1C5F05C3E49ED002FF1BAD6B44EF77A716D25F532101772AD0EE543886EADD842C41369
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mmrzjrgb.ats.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mmrzjrgb.ats.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

GWsk2Y.exe

Path C:\Users\Public\9W3cCa\GWsk2Y.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\9W3cCa\UxEnhance64.dll
Size 3.1MB
SHA256 6ce3af3aa3df2c39aa3ce6e536e27353a4e3317065d99b7e28a2e48b550dca4e
MD5 0e4714fdcea3a943a88af1925b1d692b
SHA1 3b096265440527003a83157090a6ba212fdc47aa
SHA512 8b457d63a49999aedaee7de88e37a5175971b61fdbde8a8f7cabf001b9786cebbb5e525e70a578592741aa83662c867bd36f5bf8c334d3adac8af0b6d740be09
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+c:P9m29xx3Tiqt06ox6+z2rNNrKoc
TLSH
T117E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\9W3cCa\adoresd.dat
Size 4.8MB
SHA256 0076efeb0ccafb357dc9653653c728ac02c3be37a07e8ec8189bfecc80a9cb37
MD5 9cb9e392bced041aa341314ed3a1dd1b
SHA1 5d3bef8114a9a499a182f2481823ee78be2b03d3
SHA512 bb64fa2fcc0563678fd99bb19536c2b21a2e043c55cd808d421ef87aba14efe9bf869dffede53d98b2d4ee64d7c26e1145c13f5ec579aec444c966ca31c17eda
SSDEEP 98304:AWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:AWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1933633AB2FC2F55F5583315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\9W3cCa\msadox.tb
Size 8KB
SHA256 6e80cf0fa8272b3cce33f1cf578dce4ae9dd411b023e6592295a018b2f8e5d51
MD5 d38ef15dfe3386ff3719d3d7893b120d
SHA1 099b48ed765ce417bcc3d6ffc2f7324e1dd2320b
SHA512 0d44135232eae1842249ec1a6e464b759120d357c9bdf3ccdd334e55e2af93d13b31da254688f48922b838a8ff7d7340799d9646c76479416be12379a5e5199c
SSDEEP 192:/qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:/sZqZOXQ3uqvR2Kfzp
TLSH
T195029E05D7A20CC7D3016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2252-577-0x00007FF999E40000-0x00007FF99A35E000-memory.dmp

Download

memory/2252-580-0x0000025DC71F0000-0x0000025DC7AC7000-memory.dmp

Download

memory/2252-591-0x0000025DC71F0000-0x0000025DC7AC7000-memory.dmp

Download

memory/2252-590-0x0000025DC71F0000-0x0000025DC7AC7000-memory.dmp

Download

memory/2252-592-0x0000025DC71F0000-0x0000025DC7AC7000-memory.dmp

Download

memory/2252-593-0x00007FF9BC610000-0x00007FF9BC612000-memory.dmp

Download

memory/2252-589-0x0000025DC71F0000-0x0000025DC7AC7000-memory.dmp

Download

memory/2252-587-0x0000025DC71F0000-0x0000025DC7AC7000-memory.dmp

Download

memory/2252-584-0x00007FF9BC620000-0x00007FF9BC622000-memory.dmp

Download

memory/4396-607-0x0000027265310000-0x000002726531A000-memory.dmp

Download

memory/4396-602-0x000002727D720000-0x000002727D73E000-memory.dmp

Download

memory/4396-603-0x000002727D740000-0x000002727D7F2000-memory.dmp

Download

memory/4396-597-0x000002727D6D0000-0x000002727D6F2000-memory.dmp

Download

memory/4660-550-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-543-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-558-0x0000022DC64F0000-0x0000022DC653E000-memory.dmp

Download

memory/4660-564-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-556-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-566-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-567-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-530-0x00007FF9BC610000-0x00007FF9BC612000-memory.dmp

Download

memory/4660-536-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-539-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-538-0x00007FF9BC620000-0x00007FF9BC622000-memory.dmp

Download

memory/4660-559-0x0000022DC6960000-0x0000022DC69EA000-memory.dmp

Download

memory/4660-560-0x0000022DC6960000-0x0000022DC69EA000-memory.dmp

Download

memory/4660-562-0x0000022DC6960000-0x0000022DC69EA000-memory.dmp

Download

memory/4660-561-0x0000022DC6960000-0x0000022DC69EA000-memory.dmp

Download

memory/4660-531-0x00007FF999E40000-0x00007FF99A35E000-memory.dmp

Download

memory/4660-546-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-544-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/4660-545-0x0000022DC5BE0000-0x0000022DC64B7000-memory.dmp

Download

memory/5072-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5072-2-0x0000000002050000-0x000000000205C000-memory.dmp

Download

memory/5072-504-0x00007FF9B08B0000-0x00007FF9B08C2000-memory.dmp

Download

memory/5072-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5072-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5072-525-0x00007FF9B08B0000-0x00007FF9B08C2000-memory.dmp

Download