95b421153718d5f9ba06b9d4349f63279ab946456406aa5e7bccaf195504fd12

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 34.6MB
Sample261022-wcb3jsd17z
SHA256 95b421153718d5f9ba06b9d4349f63279ab946456406aa5e7bccaf195504fd12
MD5 1a9abb4550731d81fe78179ed43abd37
SHA1 e0f49b620e5071f5d9f97cf2d29c9e12df3eec98
SHA512 2c4d2904a66e4e5b3801d9c72751eae4bc625e2bef216061b63fb0292a4ca25c628998ad9fae02312c349a3670dd24f656360e7765db482403743adf752352c0
SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAw:6ukQmH0HmKxofM3nl6UfMYrLgAw
TLSH
T13E876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\UFZk8T = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1660	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1568	zxWdtX.exe
5568	zxWdtX.exe

Loads dropped DLL 2 IoCs

pid	Process
1568	zxWdtX.exe
5568	zxWdtX.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\UFZk8T\\zxWdtX.exe\""	zxWdtX.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3128	cmd.exe
5604	cmd.exe
2456	cmd.exe
992	cmd.exe
4720	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	zxWdtX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4844	cmd.exe
200	cmd.exe
3696	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	zxWdtX.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	zxWdtX.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4840	schtasks.exe
4848	schtasks.exe
2812	schtasks.exe
2368	schtasks.exe
5932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
5348	install.2.0.02.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe
1568	zxWdtX.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeIncreaseQuotaPrivilege	1660	powershell.exe
Token: SeSecurityPrivilege	1660	powershell.exe
Token: SeTakeOwnershipPrivilege	1660	powershell.exe
Token: SeLoadDriverPrivilege	1660	powershell.exe
Token: SeSystemProfilePrivilege	1660	powershell.exe
Token: SeSystemtimePrivilege	1660	powershell.exe
Token: SeProfSingleProcessPrivilege	1660	powershell.exe
Token: SeIncBasePriorityPrivilege	1660	powershell.exe
Token: SeCreatePagefilePrivilege	1660	powershell.exe
Token: SeBackupPrivilege	1660	powershell.exe
Token: SeRestorePrivilege	1660	powershell.exe
Token: SeShutdownPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeSystemEnvironmentPrivilege	1660	powershell.exe
Token: SeRemoteShutdownPrivilege	1660	powershell.exe
Token: SeUndockPrivilege	1660	powershell.exe
Token: SeManageVolumePrivilege	1660	powershell.exe
Token: 33	1660	powershell.exe
Token: 34	1660	powershell.exe
Token: 35	1660	powershell.exe
Token: 36	1660	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1660	1568	zxWdtX.exe	91
PID 1568 wrote to memory of 992	1568	zxWdtX.exe	93
PID 992 wrote to memory of 5932	992	cmd.exe	96
PID 992 wrote to memory of 3672	992	cmd.exe	97
PID 1568 wrote to memory of 4720	1568	zxWdtX.exe	100
PID 992 wrote to memory of 2704	992	cmd.exe	102
PID 1568 wrote to memory of 3128	1568	zxWdtX.exe	104
PID 4720 wrote to memory of 4840	4720	cmd.exe	105
PID 3128 wrote to memory of 4848	3128	cmd.exe	107
PID 4720 wrote to memory of 1516	4720	cmd.exe	108
PID 3128 wrote to memory of 956	3128	cmd.exe	109
PID 4720 wrote to memory of 5992	4720	cmd.exe	111
PID 1568 wrote to memory of 5604	1568	zxWdtX.exe	112
PID 3128 wrote to memory of 4816	3128	cmd.exe	114
PID 5604 wrote to memory of 2812	5604	cmd.exe	115
PID 1568 wrote to memory of 2456	1568	zxWdtX.exe	118
PID 5604 wrote to memory of 4284	5604	cmd.exe	120
PID 2456 wrote to memory of 2368	2456	cmd.exe	122
PID 5604 wrote to memory of 1632	5604	cmd.exe	123
PID 2456 wrote to memory of 4160	2456	cmd.exe	124
PID 2456 wrote to memory of 5404	2456	cmd.exe	125
PID 3696 wrote to memory of 1152	3696	cmd.exe	127
PID 4844 wrote to memory of 3180	4844	cmd.exe	128
PID 200 wrote to memory of 2860	200	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5348

C:\Users\Public\UFZk8T\zxWdtX.exe
"C:\Users\Public\UFZk8T\zxWdtX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\UFZk8T\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\UFZk8T\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5932
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3672
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5404

C:\Users\Public\UFZk8T\zxWdtX.exe
"C:\Users\Public\UFZk8T\zxWdtX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5568

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\UFZk8T" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\UFZk8T" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3180

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5140

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:200
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2860

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 48cedd4e59ccff60789c15f0339ab478677887e5b2706051b4c37e62e34875b5
MD5 118906444834d71dea95baff55f5c6dc
SHA1 73238b9f518590134c3d0f29ca5c8dde3f468e6c
SHA512 ac951190aadeaae1fde1c38d1efa1a7ebf6ebcb80746dbf5f10f62f42e281d6480f0a9a1d3ea6163ec9a3f095a9b949a213af15a374ed377e0091514f005719f
TLSH
T1E53196FB1FA87D818F2A8E9514C9E23629A4F1805CCB44A67155C4989F093713F4E908
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 eb8098cbc67846de88807599fd82b8e2882516c7486517442a105c76b54f1d77
MD5 e33802a661368ca27e38dd50357595ba
SHA1 6edea547418c34d39644b6e2c7571e24e51120b2
SHA512 266d89cd06f18c0d349ad5f13601184439dfceb38bbaec5556563471af3f03a71f332a939bbf60c3e509fd314b405e713c175cb1a8d4240b7b41fa9f9c727fab
TLSH
T1C531F6668E3D0042FB0C9F7161C8E13FADF2D5340CE94C4A602AE2AB9222B331F86500
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 a0bc93adbed3d7e26efc553bf06afb2ed59a72255b68c395040ffa935164687c
MD5 f0d3a412a184f8910f51c1a65065907e
SHA1 9caf21f3ce97d23944624683def32e41a28ac38c
SHA512 576da2d478f2facb6dac008b4fee975e3538b897c5c1e6ca217786236326122cd4e4955c429f007f838a5b4e6fda172c3525cbf57a9900612641c7459f9d6e6f
TLSH
T1ACF0DC1848FC023DF032CE38CEC8375B196BFE42240549B40BF48B08A64BE526C12578
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 70d85ed452ac84beb69a301b8b618dd90eeec564e86e90069f89bce8fead0ca8
MD5 6d7ea4059b7d0c671c833b2c91f89a00
SHA1 8cd5dc1efc5a6917ff8de14e7f532bbad0fa213d
SHA512 7ee327e3104d4297af3739d64603d36d9168dc80e7d0fd1e2fc3c38c70e950b8f15613b7d771aa1dc3c51ba6f99f579c2f602a2e6c4c533d6d0e235031092716
TLSH
T1B0F0DC2C11EC411FF13AC9F84AD73AB05D25F52340021AFF0EF903051E40C001C4222C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_anzmmdak.xzb.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_anzmmdak.xzb.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\UFZk8T\UxEnhance64.dll
Size 3.1MB
SHA256 3b243be9b01db1b1fe5fb06998238969ee754d55a8a6b414456674512e6d6dc8
MD5 545b59aa89f901ff5345d91e4a9f1b81
SHA1 1f620f0f26ed5d4a46c6a3fed1df3ba61ee5fcf5
SHA512 ee2792be998aad6987785ead97b08c2b01333eea85d949c4d63267eaf6186594b1fe9cbf8a4e2a6758e983d4ea805f70b72910d63978b410d24d6a5b66407d23
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+t:P9m29xx3Tiqt06ox6+z2rNNrKot
TLSH
T147E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\UFZk8T\adoresd.dat
Size 4.8MB
SHA256 6d4c08149a1cd5973661f9f570fff75227a7fe6672f841da97ab94796d536e28
MD5 ca3a9fd4e40ebfe3459191cbea112f1a
SHA1 bd243fe84c459299632018a450c571f323871367
SHA512 7cefdf6fa9824edec274814c53d7331f99bc286f5fb276af5a21207da774e477f878049fcbc4a92516bf677d99713a9f8d579c437f6a66fff744d01c6f6a0f68
SSDEEP 98304:wWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:wWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1C03633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\UFZk8T\msadox.tb
Size 8KB
SHA256 dd141a7dbbd5544ee62601fad7158ab50974102475853ebc2d37f2c95f9a7b7b
MD5 26aeae114f097804cde103fd73867164
SHA1 f3ca4af1aee1caf03b051788e39da8bc67d0935a
SHA512 3920f773382ecd7550b15f9cb41be8515d83c05f9b8e1d8b6735955441f9e41752e9a8b16a2f43ee6011302a56ad48998fe84196f679fe728dbaf847ba40698f
SSDEEP 192:tqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:tsZqZOXQ3uqvR2Kfzp
TLSH
T1B5029E05D7A20DC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxWdtX.exe

Path C:\Users\Public\UFZk8T\zxWdtX.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1568-559-0x0000016E34F00000-0x0000016E34F8A000-memory.dmp

Download

memory/1568-567-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-530-0x00007FF816CD0000-0x00007FF816CD2000-memory.dmp

Download

memory/1568-536-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-539-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-544-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-545-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-543-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-538-0x00007FF816CE0000-0x00007FF816CE2000-memory.dmp

Download

memory/1568-546-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-550-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-556-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-560-0x0000016E34F00000-0x0000016E34F8A000-memory.dmp

Download

memory/1568-562-0x0000016E34F00000-0x0000016E34F8A000-memory.dmp

Download

memory/1568-561-0x0000016E34F00000-0x0000016E34F8A000-memory.dmp

Download

memory/1568-606-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-558-0x0000016E33800000-0x0000016E3384E000-memory.dmp

Download

memory/1568-564-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-566-0x0000016E34250000-0x0000016E34B27000-memory.dmp

Download

memory/1568-531-0x00007FFFF4050000-0x00007FFFF456E000-memory.dmp

Download

memory/1660-597-0x000001ED24450000-0x000001ED24472000-memory.dmp

Download

memory/1660-607-0x000001ED24480000-0x000001ED2448A000-memory.dmp

Download

memory/1660-603-0x000001ED246D0000-0x000001ED24782000-memory.dmp

Download

memory/1660-602-0x000001ED246B0000-0x000001ED246CE000-memory.dmp

Download

memory/5348-0-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/5348-525-0x00007FF80C3F0000-0x00007FF80C402000-memory.dmp

Download

memory/5348-524-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/5348-504-0x00007FF80C3F0000-0x00007FF80C402000-memory.dmp

Download

memory/5348-2-0x0000000001F20000-0x0000000001F2C000-memory.dmp

Download

memory/5348-1-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/5568-585-0x0000029995060000-0x0000029995937000-memory.dmp

Download

memory/5568-590-0x0000029995060000-0x0000029995937000-memory.dmp

Download

memory/5568-591-0x00007FF816CD0000-0x00007FF816CD2000-memory.dmp

Download

memory/5568-589-0x0000029995060000-0x0000029995937000-memory.dmp

Download

memory/5568-588-0x0000029995060000-0x0000029995937000-memory.dmp

Download

memory/5568-573-0x00007FFFF4050000-0x00007FFFF456E000-memory.dmp

Download

memory/5568-581-0x0000029995060000-0x0000029995937000-memory.dmp

Download

memory/5568-580-0x00007FF816CE0000-0x00007FF816CE2000-memory.dmp

Download

memory/5568-576-0x0000029995060000-0x0000029995937000-memory.dmp

Download