95f8a3015d645553ff25e34528fcd9674734e04e4bda7a839130b0548ac5a2b6

Analysis

max time kernel
151s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 34.6MB
Sample261022-vs627agv7j
SHA256 95f8a3015d645553ff25e34528fcd9674734e04e4bda7a839130b0548ac5a2b6
MD5 de1e6532bd00d0c42c2851e1f49f0ae4
SHA1 9c1740a2e651b73ce00499ed1864e1aa122c7d63
SHA512 c2182b10276133262ad751d85bd7b5561b8c9dbf62047993cb047f04fca9649fdf741811ab430e6d83ea1a24c0d20d143b37ab86c03aadfb1ba6cc656c75c72b
SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgA4:6ukQmH0HmKxofM3nl6UfMYrLgA4
TLSH
T1D8876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\v63Kyu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5520	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4300	IGqSyk.exe
4268	IGqSyk.exe

Loads dropped DLL 2 IoCs

pid	Process
4300	IGqSyk.exe
4268	IGqSyk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\v63Kyu\\IGqSyk.exe\""	IGqSyk.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2688	cmd.exe
1816	cmd.exe
5068	cmd.exe
4304	cmd.exe
4492	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	IGqSyk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe
3440	cmd.exe
3924	cmd.exe
5600	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	IGqSyk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	IGqSyk.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2752	schtasks.exe
4728	schtasks.exe
4756	schtasks.exe
1508	schtasks.exe
3468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe
4300	IGqSyk.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeIncreaseQuotaPrivilege	5520	powershell.exe
Token: SeSecurityPrivilege	5520	powershell.exe
Token: SeTakeOwnershipPrivilege	5520	powershell.exe
Token: SeLoadDriverPrivilege	5520	powershell.exe
Token: SeSystemProfilePrivilege	5520	powershell.exe
Token: SeSystemtimePrivilege	5520	powershell.exe
Token: SeProfSingleProcessPrivilege	5520	powershell.exe
Token: SeIncBasePriorityPrivilege	5520	powershell.exe
Token: SeCreatePagefilePrivilege	5520	powershell.exe
Token: SeBackupPrivilege	5520	powershell.exe
Token: SeRestorePrivilege	5520	powershell.exe
Token: SeShutdownPrivilege	5520	powershell.exe
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeSystemEnvironmentPrivilege	5520	powershell.exe
Token: SeRemoteShutdownPrivilege	5520	powershell.exe
Token: SeUndockPrivilege	5520	powershell.exe
Token: SeManageVolumePrivilege	5520	powershell.exe
Token: 33	5520	powershell.exe
Token: 34	5520	powershell.exe
Token: 35	5520	powershell.exe
Token: 36	5520	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5520	4300	IGqSyk.exe	93
PID 4300 wrote to memory of 4304	4300	IGqSyk.exe	95
PID 4304 wrote to memory of 3468	4304	cmd.exe	97
PID 4304 wrote to memory of 1136	4304	cmd.exe	100
PID 4304 wrote to memory of 1336	4304	cmd.exe	103
PID 4300 wrote to memory of 4492	4300	IGqSyk.exe	105
PID 4300 wrote to memory of 2688	4300	IGqSyk.exe	107
PID 4492 wrote to memory of 2752	4492	cmd.exe	109
PID 2688 wrote to memory of 4728	2688	cmd.exe	110
PID 4492 wrote to memory of 2920	4492	cmd.exe	111
PID 2688 wrote to memory of 4656	2688	cmd.exe	112
PID 4300 wrote to memory of 1816	4300	IGqSyk.exe	114
PID 4492 wrote to memory of 1700	4492	cmd.exe	116
PID 2688 wrote to memory of 3244	2688	cmd.exe	117
PID 1816 wrote to memory of 4756	1816	cmd.exe	118
PID 1816 wrote to memory of 3664	1816	cmd.exe	119
PID 1816 wrote to memory of 3420	1816	cmd.exe	121
PID 4300 wrote to memory of 5068	4300	IGqSyk.exe	122
PID 5068 wrote to memory of 1508	5068	cmd.exe	124
PID 5068 wrote to memory of 3088	5068	cmd.exe	125
PID 5068 wrote to memory of 1064	5068	cmd.exe	130
PID 4316 wrote to memory of 592	4316	cmd.exe	132
PID 5600 wrote to memory of 4636	5600	cmd.exe	133
PID 3924 wrote to memory of 4576	3924	cmd.exe	135
PID 3440 wrote to memory of 4892	3440	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4464

C:\Users\Public\v63Kyu\IGqSyk.exe
"C:\Users\Public\v63Kyu\IGqSyk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\v63Kyu\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\v63Kyu\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2920
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4656
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3664
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1064

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\v63Kyu" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\v63Kyu" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:592

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4800

C:\Users\Public\v63Kyu\IGqSyk.exe
"C:\Users\Public\v63Kyu\IGqSyk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4268

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4892

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4576

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 bf86b700115bc62d0912c1720cbfaddfc2faacb1450f796cac794df52d8ec8b7
MD5 85a6fd6fdf3dcf23810d0ff4519e77d9
SHA1 1dacee93120908eccaaad2a4e8508e9e09a584b1
SHA512 4b28446606d40d36cd9c6c93ac36670797df36b8b9cd06dbba547b261319d412c2f9e884326ca709d60332f771be2e74af8918dbfb732b4a2c343f075039be16
TLSH
T1F33194BB1F683982CF398ED414C9E6221CF9E2409DCF159F6195D498AB443B26F0E91D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 eb8098cbc67846de88807599fd82b8e2882516c7486517442a105c76b54f1d77
MD5 e33802a661368ca27e38dd50357595ba
SHA1 6edea547418c34d39644b6e2c7571e24e51120b2
SHA512 266d89cd06f18c0d349ad5f13601184439dfceb38bbaec5556563471af3f03a71f332a939bbf60c3e509fd314b405e713c175cb1a8d4240b7b41fa9f9c727fab
TLSH
T1C531F6668E3D0042FB0C9F7161C8E13FADF2D5340CE94C4A602AE2AB9222B331F86500
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 6801ddd100cb393d6649956c02baa748c01a532b1532e2740d536144f75ae5b0
MD5 bcca0f39f00bb2c7a4ad7ddc302c1afb
SHA1 e29f42dfc4bf3cc37fdac1e34aba734d48e5bc31
SHA512 318ffa7192a41430c75995df19baa02e1cfbe4aaf5ce2621ce9ca7a30dafc3a917261be60713e85fb9e28c8aacb571ee08ceda83ee5d1b49abd49a2ae68e6bb5
TLSH
T1F4F0970C19B8423DF033DA3CC6D6365A1E6BFA01140A80A80AA64749A11BA063C12139
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 0025543fa7eecd9f884630650c95ef5962d582116e159d5ff20bb347a42fe5a7
MD5 29a18f46a229b026e8bb4cf0c66a1dee
SHA1 18396dbf7b087fc86541f4b8dfbfb46cb97ab321
SHA512 e67f1b15be8c2ba5f10199e52bd2361f714fd6b4420d18215473ee95ddc64c02b2c0b7e98954ec3b5e2e196459b84b4dfbe9fcd0d2611d28b611c09c4970bba9
TLSH
T1BCF0233C15EC401FF13EC9F84AE73AB06E26F523404259BF0DFA03041E44C002C4222C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tcygc3dx.hh2.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tcygc3dx.hh2.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

IGqSyk.exe

Path C:\Users\Public\v63Kyu\IGqSyk.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\v63Kyu\UxEnhance64.dll
Size 3.1MB
SHA256 2664800b84e330241dcee8082206068a2c13f5995cf1fd1f283bc8d2094308cc
MD5 60d271814e7d50c203d6d9c0bd114c41
SHA1 a018cdf625238fd6d675376b5616ecbf49992364
SHA512 5c3fe086aecb1a8ae101718ee9ad87996f49b34adf8feee05bd9d9a59e092b7903f81afa354da351653f25e729ee8a92b0a6ae2ff55d9d4c5b7f2fda7c6434bf
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+j:P9m29xx3Tiqt06ox6+z2rNNrKoj
TLSH
T144E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\v63Kyu\adoresd.dat
Size 4.8MB
SHA256 5dbb0d1bd6f0b26eb7d63926a23943048aaed6fcbc6372a498110f7e536f9ba6
MD5 097b1b84603f1d9993aefef26ed5be41
SHA1 733607347e4e1338afbca687576849be88580dd0
SHA512 665fdf68cc1b5d043a9f7993f9ad4e510f65caf8c7fe48092ef85ea6b5363814e92d2fd9e98e2fdf0366fb0586e79dbf4bb7a0f638542553fc1c12a8b57adbde
SSDEEP 98304:1Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:1Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T10B3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\v63Kyu\msadox.tb
Size 8KB
SHA256 23f2c053f342d2430afd774ba781420b0413cbb811004af20bd23fd4af8427eb
MD5 4b4f3f79ba603d42c45a06286dba8f7d
SHA1 91c61942866f67e6914e7a76966567edf779d60a
SHA512 25be7f9f110d3d023a4b08f55600dcba3838ee44f2ee85f2fa7841d14348dcaa7c07008211b55378bdd121946a884d18e5a7eb9efe0b7d1c45be0729e2e7a311
SSDEEP 192:DqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:DsZqZOXQ3uqvR2Kfzp
TLSH
T133029E05D7A20CC3D3016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4268-580-0x00007FFE41D70000-0x00007FFE4228E000-memory.dmp

Download

memory/4268-590-0x000001CF9A7D0000-0x000001CF9B0A7000-memory.dmp

Download

memory/4268-584-0x000001CF9A7D0000-0x000001CF9B0A7000-memory.dmp

Download

memory/4268-594-0x00007FFE643B0000-0x00007FFE643B2000-memory.dmp

Download

memory/4268-592-0x000001CF9A7D0000-0x000001CF9B0A7000-memory.dmp

Download

memory/4268-593-0x000001CF9A7D0000-0x000001CF9B0A7000-memory.dmp

Download

memory/4268-591-0x000001CF9A7D0000-0x000001CF9B0A7000-memory.dmp

Download

memory/4268-585-0x00007FFE643C0000-0x00007FFE643C2000-memory.dmp

Download

memory/4268-586-0x000001CF9A7D0000-0x000001CF9B0A7000-memory.dmp

Download

memory/4276-526-0x0000000002000000-0x000000000200E000-memory.dmp

Download

memory/4276-1-0x0000000002000000-0x000000000200E000-memory.dmp

Download

memory/4276-0-0x0000000002000000-0x000000000200E000-memory.dmp

Download

memory/4276-2-0x0000000002010000-0x000000000201C000-memory.dmp

Download

memory/4276-504-0x00007FFE59C70000-0x00007FFE59C82000-memory.dmp

Download

memory/4276-527-0x00007FFE59C70000-0x00007FFE59C82000-memory.dmp

Download

memory/4300-553-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-546-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-564-0x000001A0CCDA0000-0x000001A0CCE2A000-memory.dmp

Download

memory/4300-569-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-570-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-559-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-561-0x000001A0CB6E0000-0x000001A0CB72E000-memory.dmp

Download

memory/4300-562-0x000001A0CCDA0000-0x000001A0CCE2A000-memory.dmp

Download

memory/4300-565-0x000001A0CCDA0000-0x000001A0CCE2A000-memory.dmp

Download

memory/4300-563-0x000001A0CCDA0000-0x000001A0CCE2A000-memory.dmp

Download

memory/4300-533-0x00007FFE41D70000-0x00007FFE4228E000-memory.dmp

Download

memory/4300-567-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-548-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-547-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-541-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-545-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-540-0x00007FFE643C0000-0x00007FFE643C2000-memory.dmp

Download

memory/4300-538-0x000001A0CC0F0000-0x000001A0CC9C7000-memory.dmp

Download

memory/4300-532-0x00007FFE643B0000-0x00007FFE643B2000-memory.dmp

Download

memory/5520-606-0x00000166C2C70000-0x00000166C2C8E000-memory.dmp

Download

memory/5520-607-0x00000166C2EE0000-0x00000166C2F92000-memory.dmp

Download

memory/5520-603-0x00000166C2C40000-0x00000166C2C62000-memory.dmp

Download

memory/5520-610-0x00000166AA7A0000-0x00000166AA7AA000-memory.dmp

Download