ce0e1d83284150ccbbf3f90db0c55454dfc818dbf7f7fd281c0ef86e7aaf07b2

Analysis

max time kernel
151s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261023-3q6mmsgx4l
SHA256 ce0e1d83284150ccbbf3f90db0c55454dfc818dbf7f7fd281c0ef86e7aaf07b2
MD5 017a3e38ed14e3c18468cda5ad7072ae
SHA1 1f395d0842a14e8e969c723b8426ec62fc263a41
SHA512 262d03b74988034f7cbfb1e408ac85349feb7a5b9770b47da17b11539d1bf6afd4b39a650f93bd82517776f609856b5515bbd77ecde47e5c0b55f61672e37050
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXG:q6chqTShW/hNbSiQfMJPLmrUlsG
TLSH
T17597D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\hXbfab = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4588	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2836	yZPgFG.exe
2368	yZPgFG.exe

Loads dropped DLL 2 IoCs

pid	Process
2836	yZPgFG.exe
2368	yZPgFG.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\hXbfab\\yZPgFG.exe\""	yZPgFG.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6036	cmd.exe
5724	cmd.exe
972	cmd.exe
2916	cmd.exe
5888	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	yZPgFG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1968	cmd.exe
3020	cmd.exe
1304	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	yZPgFG.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	yZPgFG.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1724	schtasks.exe
456	schtasks.exe
1412	schtasks.exe
1416	schtasks.exe
4976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
1252	install.2.0.02.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe
2836	yZPgFG.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeIncreaseQuotaPrivilege	4588	powershell.exe
Token: SeSecurityPrivilege	4588	powershell.exe
Token: SeTakeOwnershipPrivilege	4588	powershell.exe
Token: SeLoadDriverPrivilege	4588	powershell.exe
Token: SeSystemProfilePrivilege	4588	powershell.exe
Token: SeSystemtimePrivilege	4588	powershell.exe
Token: SeProfSingleProcessPrivilege	4588	powershell.exe
Token: SeIncBasePriorityPrivilege	4588	powershell.exe
Token: SeCreatePagefilePrivilege	4588	powershell.exe
Token: SeBackupPrivilege	4588	powershell.exe
Token: SeRestorePrivilege	4588	powershell.exe
Token: SeShutdownPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeSystemEnvironmentPrivilege	4588	powershell.exe
Token: SeRemoteShutdownPrivilege	4588	powershell.exe
Token: SeUndockPrivilege	4588	powershell.exe
Token: SeManageVolumePrivilege	4588	powershell.exe
Token: 33	4588	powershell.exe
Token: 34	4588	powershell.exe
Token: 35	4588	powershell.exe
Token: 36	4588	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4588	2836	yZPgFG.exe	91
PID 2836 wrote to memory of 5724	2836	yZPgFG.exe	92
PID 5724 wrote to memory of 1724	5724	cmd.exe	96
PID 2836 wrote to memory of 972	2836	yZPgFG.exe	98
PID 5724 wrote to memory of 4652	5724	cmd.exe	100
PID 972 wrote to memory of 456	972	cmd.exe	103
PID 2836 wrote to memory of 2916	2836	yZPgFG.exe	104
PID 5724 wrote to memory of 3428	5724	cmd.exe	105
PID 972 wrote to memory of 596	972	cmd.exe	107
PID 2916 wrote to memory of 1412	2916	cmd.exe	109
PID 2836 wrote to memory of 5888	2836	yZPgFG.exe	110
PID 972 wrote to memory of 5524	972	cmd.exe	112
PID 5888 wrote to memory of 1416	5888	cmd.exe	114
PID 2916 wrote to memory of 1476	2916	cmd.exe	113
PID 5888 wrote to memory of 1664	5888	cmd.exe	115
PID 2916 wrote to memory of 2344	2916	cmd.exe	116
PID 5888 wrote to memory of 6100	5888	cmd.exe	118
PID 2836 wrote to memory of 6036	2836	yZPgFG.exe	121
PID 6036 wrote to memory of 4976	6036	cmd.exe	123
PID 6036 wrote to memory of 3564	6036	cmd.exe	124
PID 6036 wrote to memory of 1444	6036	cmd.exe	126
PID 1304 wrote to memory of 5260	1304	cmd.exe	128
PID 1968 wrote to memory of 4800	1968	cmd.exe	129
PID 3020 wrote to memory of 4900	3020	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1252

C:\Users\Public\hXbfab\yZPgFG.exe
"C:\Users\Public\hXbfab\yZPgFG.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\hXbfab\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\hXbfab\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1724
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:596
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1412
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1664
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3564
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1444

C:\Users\Public\hXbfab\yZPgFG.exe
"C:\Users\Public\hXbfab\yZPgFG.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\hXbfab" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\hXbfab" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5260

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3580

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4800

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 40d9e50da72f40d014edf729b996532671d14a31ee98873ad791d339a378bcbf
MD5 adc55c14448fadedd4a57cc73c08a16b
SHA1 863847d8739c54b215e2763d2ff14db239b46ed1
SHA512 2f5674122784310b6f3e7ed98fbe111ccbe5572e387093194ca588e52d4c6b6e998207174a7cc5bd6837520ceda6161e0b56895938725b082250a124aa5b9d27
TLSH
T1DB3196B70F6D7D82AF694E9914CAE1322CF0E5C05D8A04AB5114C0DC6F493B32E8AC0D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 d9867d8b403f33e33ae6fe37d25f6b29941b54a514b45655b340ce8b51e7f069
MD5 0fa64627e975c6926b8e6f8bffe984b5
SHA1 780457f8da433291ac3f311b77e8b58f8eee63b3
SHA512 96c21d54eefc0faf1994ff27af8f570a8799d06ca9f2be87b46313a09bdb1cffb4e2912a125d2a91fb9a68496227e937f73a07c4eb7e405fea674bda29764947
TLSH
T13731D8D69A3D1002DB0C9F7922D4E23B7DF591A45CE85851233DD1AA460AFBBBFC5410
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 b16d7c6c639cc3875b112b7fb8ae613b7530c87d0f9abf2e075c9c81e74156c3
MD5 48168326fa1d485a3e3d065143f15d1e
SHA1 9f445f8ce4e219fb3bdb2e49eef3e7d2df8c496d
SHA512 e250fd664fe245877c64fa21a62c37677f90a802086de77078a45dcf49adb18fbb10e08f60300ccfd5c17ad516081848dd6482110d8d52e38785b62c78546feb
TLSH
T143F0D41C48B8422EF172DB3DC7DE34DD07FBF116200785E012E4470966935057C402B5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 0156975e30f90b9270cb621aaf2199466ea9dd52c4c13543051b5a471420ad1b
MD5 9a7b547a6d73c53c8aa0f97ffc13bd2a
SHA1 bc8c4c7bb99d12dc156bcd91493a63f2b3db6ec8
SHA512 12e01ee80b58242948587ea66c1ce24003739559e1765f18435bf3bf3500b5fcf8673c3889fd48d9ed7de290c108a56dfa120a3dd5a264dd11da6c4e9ce34574
TLSH
T1F3F0543442D5004FF07BE1B587D377F17576F5231446AABD0AE902441D62C825C8125D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4k1sqh4x.isl.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4k1sqh4x.isl.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\hXbfab\UxEnhance64.dll
Size 3.1MB
SHA256 e2fb909328a5175345da2354628db7dfb33919eba241672b067336f25e00202a
MD5 13842571172cffbebf0f660282e6ccd3
SHA1 96b38161452db3d2f43edc2b2a76c01534a27900
SHA512 6351ba3dec9f1b5da3b07af946bd081afe82ddf0cc4e082040d343ac0c6ddcf1559c05037ec36d9af3e5f18b3a5d025b541d2c99a6115f27f8ad9702fa4c0ba8
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+N:P9m29xx3Tiqt06ox6+z2rNNrKoN
TLSH
T113E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\hXbfab\adoresd.dat
Size 4.8MB
SHA256 e012ca8926900543f5b13b5a4dae59497b2497a549e1c6f72639d14360cca6f1
MD5 e2ea2b280442c5cc2f56a485bc58fefa
SHA1 1c0f6c7532dff9536635e17c710d20bc5ffbd18c
SHA512 5f294749f9da2610d609906ebcb374fe91f05b4ca9fd24f9bbcabf333a4f23c8963679826498d586ede8e4c0e936c8b1b2e41ae8e6659303d2090bd907ce1593
SSDEEP 98304:IWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:IWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1583633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\hXbfab\msadox.tb
Size 8KB
SHA256 eeccbaa9d8ff3f2839eb326cd0ad17661b334b58fb715a674c2ed3e3f1071027
MD5 245e068a397cc031a331ede5cb62a2fa
SHA1 bb089067f0682ee49859c9791cc63f4f42f423de
SHA512 ab92e817ee89584e379aad898805d7ea85762fe2f3ac8ac58df33265b172ae74a5698bf9782134331e1e970566c4b7ca065bf14463b0e95229d6e1448039e1a2
SSDEEP 192:fqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:fsZqZOXQ3uqvR2Kfzp
TLSH
T1BD029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yZPgFG.exe

Path C:\Users\Public\hXbfab\yZPgFG.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-504-0x00007FF833A80000-0x00007FF833A92000-memory.dmp

Download

memory/1252-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/1252-525-0x00007FF833A80000-0x00007FF833A92000-memory.dmp

Download

memory/1252-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/1252-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/1252-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/2368-580-0x000001F9A5290000-0x000001F9A5B67000-memory.dmp

Download

memory/2368-576-0x00007FF821480000-0x00007FF82199E000-memory.dmp

Download

memory/2368-590-0x000001F9A5290000-0x000001F9A5B67000-memory.dmp

Download

memory/2368-589-0x000001F9A5290000-0x000001F9A5B67000-memory.dmp

Download

memory/2368-591-0x00007FF844350000-0x00007FF844352000-memory.dmp

Download

memory/2368-588-0x000001F9A5290000-0x000001F9A5B67000-memory.dmp

Download

memory/2368-583-0x000001F9A5290000-0x000001F9A5B67000-memory.dmp

Download

memory/2368-587-0x000001F9A5290000-0x000001F9A5B67000-memory.dmp

Download

memory/2368-582-0x00007FF844360000-0x00007FF844362000-memory.dmp

Download

memory/2836-559-0x000002CB3FD90000-0x000002CB3FE1A000-memory.dmp

Download

memory/2836-560-0x000002CB3FD90000-0x000002CB3FE1A000-memory.dmp

Download

memory/2836-564-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-566-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-544-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-543-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-538-0x00007FF844360000-0x00007FF844362000-memory.dmp

Download

memory/2836-536-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-558-0x000002CB3E630000-0x000002CB3E67E000-memory.dmp

Download

memory/2836-531-0x00007FF821480000-0x00007FF82199E000-memory.dmp

Download

memory/2836-545-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-556-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-562-0x000002CB3FD90000-0x000002CB3FE1A000-memory.dmp

Download

memory/2836-561-0x000002CB3FD90000-0x000002CB3FE1A000-memory.dmp

Download

memory/2836-550-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-539-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-546-0x000002CB3F170000-0x000002CB3FA47000-memory.dmp

Download

memory/2836-530-0x00007FF844350000-0x00007FF844352000-memory.dmp

Download

memory/4588-603-0x000001C33D210000-0x000001C33D22E000-memory.dmp

Download

memory/4588-604-0x000001C33D230000-0x000001C33D2E2000-memory.dmp

Download

memory/4588-597-0x000001C33D1B0000-0x000001C33D1D2000-memory.dmp

Download

memory/4588-607-0x000001C33D2F0000-0x000001C33D2FA000-memory.dmp

Download