a767d33bf9d56afaacc2ddfb6267e3db3a8b28c4f3eb1bafaafb2d76b32d437e

Analysis

max time kernel
151s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 34.6MB
Sample261022-w3ddasbb66
SHA256 a767d33bf9d56afaacc2ddfb6267e3db3a8b28c4f3eb1bafaafb2d76b32d437e
MD5 0cb9225f84bd11d6a3061067133b4505
SHA1 0c13818bc34e4871ff3e36ae96702f957e2494cc
SHA512 6a322a4982421c42dc89eb766524158e0ce38807659d1739ac8cb0829ae19b841cd44c07233a07e57faaa8c59dbbf26002e4cfdc155ead844d06eeb3f8e807cf
SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgA/:6ukQmH0HmKxofM3nl6UfMYrLgA/
TLSH
T165876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\CK2bRo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4996	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4888	PkpjRf.exe
3672	PkpjRf.exe

Loads dropped DLL 2 IoCs

pid	Process
4888	PkpjRf.exe
3672	PkpjRf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\CK2bRo\\PkpjRf.exe\""	PkpjRf.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2404	cmd.exe
5500	cmd.exe
4392	cmd.exe
2572	cmd.exe
2092	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	PkpjRf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3728	cmd.exe
3528	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PkpjRf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PkpjRf.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2116	schtasks.exe
4904	schtasks.exe
420	schtasks.exe
3088	schtasks.exe
2488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
5216	install.2.0.02.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe
4888	PkpjRf.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeIncreaseQuotaPrivilege	4996	powershell.exe
Token: SeSecurityPrivilege	4996	powershell.exe
Token: SeTakeOwnershipPrivilege	4996	powershell.exe
Token: SeLoadDriverPrivilege	4996	powershell.exe
Token: SeSystemProfilePrivilege	4996	powershell.exe
Token: SeSystemtimePrivilege	4996	powershell.exe
Token: SeProfSingleProcessPrivilege	4996	powershell.exe
Token: SeIncBasePriorityPrivilege	4996	powershell.exe
Token: SeCreatePagefilePrivilege	4996	powershell.exe
Token: SeBackupPrivilege	4996	powershell.exe
Token: SeRestorePrivilege	4996	powershell.exe
Token: SeShutdownPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeSystemEnvironmentPrivilege	4996	powershell.exe
Token: SeRemoteShutdownPrivilege	4996	powershell.exe
Token: SeUndockPrivilege	4996	powershell.exe
Token: SeManageVolumePrivilege	4996	powershell.exe
Token: 33	4996	powershell.exe
Token: 34	4996	powershell.exe
Token: 35	4996	powershell.exe
Token: 36	4996	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4996	4888	PkpjRf.exe	92
PID 4888 wrote to memory of 2572	4888	PkpjRf.exe	94
PID 2572 wrote to memory of 4904	2572	cmd.exe	97
PID 4888 wrote to memory of 2092	4888	PkpjRf.exe	98
PID 2572 wrote to memory of 3036	2572	cmd.exe	101
PID 4888 wrote to memory of 2404	4888	PkpjRf.exe	102
PID 2404 wrote to memory of 420	2404	cmd.exe	107
PID 4888 wrote to memory of 5500	4888	PkpjRf.exe	106
PID 2092 wrote to memory of 3088	2092	cmd.exe	108
PID 2572 wrote to memory of 3440	2572	cmd.exe	110
PID 3728 wrote to memory of 5860	3728	cmd.exe	112
PID 2404 wrote to memory of 5780	2404	cmd.exe	113
PID 5500 wrote to memory of 2488	5500	cmd.exe	114
PID 4888 wrote to memory of 4392	4888	PkpjRf.exe	115
PID 2092 wrote to memory of 5492	2092	cmd.exe	117
PID 2404 wrote to memory of 2344	2404	cmd.exe	119
PID 4392 wrote to memory of 2116	4392	cmd.exe	120
PID 2092 wrote to memory of 4732	2092	cmd.exe	121
PID 5500 wrote to memory of 2644	5500	cmd.exe	122
PID 4392 wrote to memory of 4896	4392	cmd.exe	123
PID 5500 wrote to memory of 3660	5500	cmd.exe	124
PID 4392 wrote to memory of 3916	4392	cmd.exe	125
PID 3528 wrote to memory of 3060	3528	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5216

C:\Users\Public\CK2bRo\PkpjRf.exe
"C:\Users\Public\CK2bRo\PkpjRf.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\CK2bRo\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\CK2bRo\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5492
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5780
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2644
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3916

C:\Users\Public\CK2bRo\PkpjRf.exe
"C:\Users\Public\CK2bRo\PkpjRf.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3672

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\CK2bRo" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\CK2bRo" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5860

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:6032

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 48cedd4e59ccff60789c15f0339ab478677887e5b2706051b4c37e62e34875b5
MD5 118906444834d71dea95baff55f5c6dc
SHA1 73238b9f518590134c3d0f29ca5c8dde3f468e6c
SHA512 ac951190aadeaae1fde1c38d1efa1a7ebf6ebcb80746dbf5f10f62f42e281d6480f0a9a1d3ea6163ec9a3f095a9b949a213af15a374ed377e0091514f005719f
TLSH
T1E53196FB1FA87D818F2A8E9514C9E23629A4F1805CCB44A67155C4989F093713F4E908
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 ad872a3500f8420dce30a40bf17a9fc0647d7c5d771d4a18c42b3e12479128c2
MD5 6ba6d24f8e7e2430534a1b533b09565e
SHA1 4b748a5c35834e194811b4f9b189374a747ebde5
SHA512 cc7a7c36f93d9c90793c5ac587b2cb66457e1d39ad371ee6c3e0a691abe4e0ecd1bed8566dd94497c2cbc660ace8b56aa95b995a233f3e05ead2fa028a320509
TLSH
T12031D6929B390012EF1C0F7412D4C12F7CF0A6254CF46826757ED32F664A7779F86045
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 6003d6c52909f0dfe6f1a7ebb6e9dcd3fb8e4f87e88f9486624959eb3d41eb3b
MD5 a6e7266a5ae5a0d23c9965782bce0ef7
SHA1 1a12c4ee1b5084722f1c22ea00a76e51efa32676
SHA512 3b7c37a4c2f648f1dfa1b221ec9dd9332ad95ae37268f2eaae110689924640cf259e5cdb91fb33dae092473ec72620effa1eceb025663b62ff36e78c79d0ce25
TLSH
T127F0DC2848FC023DF032DE388FC8375B19ABFA42240549A40BE48F08AA4BE522C12578
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 0cef64c647d5d58c1fdf70c307b7801e9fc66531fe53bf377cac2881e96cc5e4
MD5 091a7aeea6c98453d68bf7c97e758232
SHA1 b42e15592e76f4b542fc02fdea6540f1021cfad8
SHA512 f993cdb1f93ec1d9232784846f5d607d13975bffb608a899f1cf93c8a518880d6b61ca3d81db29a218ba11b57f3ee149c5e035ddee424d220d0c3dfdd4eb3a36
TLSH
T1D7F0233A96ED023FF07B92F446D637F14D66F123400623FE096542485E568019C8222D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jp3v0s5k.jp2.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jp3v0s5k.jp2.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PkpjRf.exe

Path C:\Users\Public\CK2bRo\PkpjRf.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\CK2bRo\UxEnhance64.dll
Size 3.1MB
SHA256 9318e083fa6baa17776ef06ec127a73e1ac58d684b149c9e1802b91f49a67a28
MD5 d1dc851af5f4e1100e1b32a68f486659
SHA1 debc4d3bb750e20c6402922f9f5ad392316a881b
SHA512 346d2e1c5ab0f273f700857bba440096c93ca6efbd13fdfd492c2aecfb395a9a979c3624e1e703e3c1a3536dff52866cc6c44d7e98e6dc662a4a7f5e7f79006c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+X:P9m29xx3Tiqt06ox6+z2rNNrKoX
TLSH
T1F0E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\CK2bRo\adoresd.dat
Size 4.8MB
SHA256 609d8bd6caa50dcd58f553122720d631fc0ad54c72f258b0502fbddb129968d1
MD5 9a1af44342355833695cae44d1252dfa
SHA1 47a56322da44853e3d90eb52ef59dc66fa487a87
SHA512 0195472facd22b3442c137d0a6f20e1bdbb1b87941b52427247bd370a3ba7cab54e6dac7cfa663a3b850c9192678ae5cc03e420f7839677fc9a3b6c286962834
SSDEEP 98304:WWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:WWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1B43633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\CK2bRo\msadox.tb
Size 8KB
SHA256 538e72b3b631a30a7b7b667e9ae41a79d26618b15d4028b067c13d33ca6c1f02
MD5 2aa728c9ff13c2a4a553a5da6e329300
SHA1 711cfad1d921c2e0909ce9e699d001e53c3e1952
SHA512 a0bfd1a78548a9c05a3fe66973230a88e63d269d4d8b1435505b36e402966a374c624d2530331576128ca2517794144880e961d7bf5b44e23e29089931f22ece
SSDEEP 192:CqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:CsZqZOXQ3uqvR2Kfzp
TLSH
T15B029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3672-582-0x000002C956770000-0x000002C957047000-memory.dmp

Download

memory/3672-587-0x000002C956770000-0x000002C957047000-memory.dmp

Download

memory/3672-586-0x000002C956770000-0x000002C957047000-memory.dmp

Download

memory/3672-581-0x00007FFDBA340000-0x00007FFDBA342000-memory.dmp

Download

memory/3672-579-0x000002C956770000-0x000002C957047000-memory.dmp

Download

memory/3672-576-0x00007FFD9F770000-0x00007FFD9FC8E000-memory.dmp

Download

memory/3672-593-0x00007FFDBA330000-0x00007FFDBA332000-memory.dmp

Download

memory/3672-592-0x000002C956770000-0x000002C957047000-memory.dmp

Download

memory/3672-591-0x000002C956770000-0x000002C957047000-memory.dmp

Download

memory/4888-535-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-542-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-557-0x000001B5D0590000-0x000001B5D05DE000-memory.dmp

Download

memory/4888-561-0x000001B5D0670000-0x000001B5D06FA000-memory.dmp

Download

memory/4888-559-0x000001B5D0670000-0x000001B5D06FA000-memory.dmp

Download

memory/4888-558-0x000001B5D0670000-0x000001B5D06FA000-memory.dmp

Download

memory/4888-560-0x000001B5D0670000-0x000001B5D06FA000-memory.dmp

Download

memory/4888-565-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-566-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-549-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-545-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-544-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-543-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-555-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-538-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-537-0x00007FFDBA340000-0x00007FFDBA342000-memory.dmp

Download

memory/4888-598-0x000001B5CF970000-0x000001B5D0247000-memory.dmp

Download

memory/4888-530-0x00007FFD9F770000-0x00007FFD9FC8E000-memory.dmp

Download

memory/4888-529-0x00007FFDBA330000-0x00007FFDBA332000-memory.dmp

Download

memory/4996-601-0x00000194B4660000-0x00000194B4682000-memory.dmp

Download

memory/4996-604-0x00000194B46E0000-0x00000194B46FE000-memory.dmp

Download

memory/4996-605-0x00000194CCC80000-0x00000194CCD32000-memory.dmp

Download

memory/4996-606-0x00000194B46C0000-0x00000194B46CA000-memory.dmp

Download

memory/5216-524-0x00007FFDB1970000-0x00007FFDB1982000-memory.dmp

Download

memory/5216-523-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/5216-503-0x00007FFDB1970000-0x00007FFDB1982000-memory.dmp

Download

memory/5216-0-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/5216-1-0x0000000002060000-0x000000000206C000-memory.dmp

Download