403b2f75ca230571c41752865c1535b47b3998c14968d9e755f55bcc4ef608a1

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.03.exe
Size 34.6MB
Sample261023-ap29lsa13k
SHA256 403b2f75ca230571c41752865c1535b47b3998c14968d9e755f55bcc4ef608a1
MD5 00abe3a82c1c462e296696ef6ab972c5
SHA1 06c17dae2fe80bc1300b7404b2cd8732a25d96c8
SHA512 72329c55f0b38f0e378810500c6af7862f56a4f2b8853032c2a594d971debc3dd878449163c497be93b635332784d000364867b75bd410341ab9e5ee5dd1dc07
SSDEEP 98304:66ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAn:hukQmH0HmKxofM3nl6UfMYrLgAn
TLSH
T1F4876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\oexWe0 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4516	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5248	pxwN10.exe
4932	pxwN10.exe

Loads dropped DLL 2 IoCs

pid	Process
5248	pxwN10.exe
4932	pxwN10.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\oexWe0\\pxwN10.exe\""	pxwN10.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4968	cmd.exe
420	cmd.exe
1248	cmd.exe
5848	cmd.exe
4748	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	pxwN10.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\hq9SO5\hq9SO5.exe	pxwN10.exe
File created	C:\Program Files (x86)\hq9SO5\XPSPLOG.dll	pxwN10.exe
File created	C:\Program Files (x86)\hq9SO5\image.png	pxwN10.exe
File opened for modification	C:\Program Files (x86)\hq9SO5\XPSPLOG.dll	pxwN10.exe
File opened for modification	C:\Program Files (x86)\hq9SO5\image.png	pxwN10.exe
File opened for modification	C:\Program Files (x86)\hq9SO5	pxwN10.exe
File created	C:\Program Files (x86)\hq9SO5\thumbs.db	pxwN10.exe
File opened for modification	C:\Program Files (x86)\hq9SO5\hq9SO5.exe	pxwN10.exe
File opened for modification	C:\Program Files (x86)\hq9SO5\thumbs.db	pxwN10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe
5768	cmd.exe
3836	cmd.exe
3468	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pxwN10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pxwN10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.03.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4712	schtasks.exe
2172	schtasks.exe
6012	schtasks.exe
1564	schtasks.exe
4228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
920	install.2.0.03.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe
5248	pxwN10.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeIncreaseQuotaPrivilege	4516	powershell.exe
Token: SeSecurityPrivilege	4516	powershell.exe
Token: SeTakeOwnershipPrivilege	4516	powershell.exe
Token: SeLoadDriverPrivilege	4516	powershell.exe
Token: SeSystemProfilePrivilege	4516	powershell.exe
Token: SeSystemtimePrivilege	4516	powershell.exe
Token: SeProfSingleProcessPrivilege	4516	powershell.exe
Token: SeIncBasePriorityPrivilege	4516	powershell.exe
Token: SeCreatePagefilePrivilege	4516	powershell.exe
Token: SeBackupPrivilege	4516	powershell.exe
Token: SeRestorePrivilege	4516	powershell.exe
Token: SeShutdownPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeSystemEnvironmentPrivilege	4516	powershell.exe
Token: SeRemoteShutdownPrivilege	4516	powershell.exe
Token: SeUndockPrivilege	4516	powershell.exe
Token: SeManageVolumePrivilege	4516	powershell.exe
Token: 33	4516	powershell.exe
Token: 34	4516	powershell.exe
Token: 35	4516	powershell.exe
Token: 36	4516	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5248 wrote to memory of 4516	5248	pxwN10.exe	91
PID 5248 wrote to memory of 4968	5248	pxwN10.exe	93
PID 4968 wrote to memory of 2172	4968	cmd.exe	96
PID 4968 wrote to memory of 6048	4968	cmd.exe	97
PID 5248 wrote to memory of 420	5248	pxwN10.exe	99
PID 4968 wrote to memory of 5692	4968	cmd.exe	103
PID 420 wrote to memory of 6012	420	cmd.exe	105
PID 5248 wrote to memory of 1248	5248	pxwN10.exe	106
PID 420 wrote to memory of 2984	420	cmd.exe	108
PID 5248 wrote to memory of 5848	5248	pxwN10.exe	110
PID 1248 wrote to memory of 1564	1248	cmd.exe	112
PID 420 wrote to memory of 5520	420	cmd.exe	113
PID 5848 wrote to memory of 4228	5848	cmd.exe	114
PID 1248 wrote to memory of 2700	1248	cmd.exe	115
PID 5848 wrote to memory of 1284	5848	cmd.exe	117
PID 5248 wrote to memory of 4748	5248	pxwN10.exe	118
PID 1248 wrote to memory of 5516	1248	cmd.exe	120
PID 5848 wrote to memory of 1520	5848	cmd.exe	121
PID 4748 wrote to memory of 4712	4748	cmd.exe	122
PID 4748 wrote to memory of 520	4748	cmd.exe	123
PID 4748 wrote to memory of 1476	4748	cmd.exe	129
PID 3836 wrote to memory of 5780	3836	cmd.exe	131
PID 4312 wrote to memory of 1112	4312	cmd.exe	132
PID 3468 wrote to memory of 3480	3468	cmd.exe	133
PID 5768 wrote to memory of 5004	5768	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:920

C:\Users\Public\oexWe0\pxwN10.exe
"C:\Users\Public\oexWe0\pxwN10.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\oexWe0\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\oexWe0\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1564
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4228
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4712
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:520
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1476
- C:\Program Files (x86)\hq9SO5\hq9SO5.exe
  "C:\Program Files (x86)\hq9SO5\hq9SO5.exe"
  2⤵
  PID:4484

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\oexWe0" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\oexWe0" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1112

C:\Users\Public\oexWe0\pxwN10.exe
"C:\Users\Public\oexWe0\pxwN10.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4932

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5376

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5004

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5780

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\hq9SO5\XPSPLOG.dll
Size 4.6MB
SHA256 a194f9b56ab895d910f85859e5984fe4478abaaf573fd0b9482879da8b8ca7bf
MD5 f453e4a6fd073390a23521175398980a
SHA1 842e2ffc309da67dff35c0622a364584bb3ae6cb
SHA512 8d935ffed198f271f934ea7a4a7455aebce7bcc7168c48eb70142272664d1c070133d8c7973ec7e847008db4d256be6d4cb5bc7b4c165a1067407cdc6e098f3b
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyh:BMWKfU+BcUTHCCCfqCiUffnh
TLSH
T177263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hq9SO5.exe

Path C:\Program Files (x86)\hq9SO5\hq9SO5.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\hq9SO5\image.png
Size 128KB
SHA256 d1f7a82c162f9ffa9e8e535057242040d964b63bd0316455a01c20d09537e85a
MD5 75cecc626f57824b17511d0f95cc5c43
SHA1 5314156bc607bb78d0dcb8f77d9edd075fb59a68
SHA512 3930e0896ff8147d30b9bc290a49c4fb45544a01d496ed4a4b27f46a6d17d08ccca8999c8cfae39458efdb5e742c6ab8eac7e0dec8081437052619716c5bed52
SSDEEP 3072:5Wt91z4a+2+mrNG+SUXDkYXfKOHR23sA3ZVrlTTR:5+V4yNG2zkYXCOHU3sGLZTl
TLSH
T1D7D3126BEDE78FDD62E5E1AB5107CC90FA2F24F149C02AA510C7BA945B54357E04C0AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 671cea3c14d5ec2eb9f537d07d0a2e688ba7bdb42b5c8fc4003aafe51ee7d8a7
MD5 11cf854611d323ae9af28482d5747909
SHA1 6f56b03d19cbefb8940d9cf403295ceb45132548
SHA512 57ff61b38e385d27eb5c13f476e407dc7fd3935b42ef833fef7415135fcd20318ea9060cd4708715cce17785a88630229883d7d20245ddca9e70022ba229c6b9
TLSH
T16A31C6FB5FBD7982AF2E8EA424CAB2322CF8E1905DD0009E6115C8A85B4C3B52F0940C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 b7f21244d0db41358dc919a8b2bd7eca574d46a9e99ec47a81de7e44ff901296
MD5 ccd550fb215dec7d65fc887faca73799
SHA1 d0f6052cdd30197c915ffe8c17d37cd9d20605ec
SHA512 cdffdef3bd1b0f9450c083d2cd3affeeaf6fa5dd57e697a3848dec94e0191207dbd467459f1a7fc61439d81e09f2bf8af922f3638df67de95c3db3779991f56c
TLSH
T10B31B4978E390062EB1D8FB442C5D63B7CF1A1304CA4480A212ED16B8218BB75FC5404
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 8200fc33483aaab7283da3a6c7c44eecd341e9e028a38926d73e183461bdc401
MD5 a04bdd0a503800fa4fbf74211ded4054
SHA1 14b8a4ad21d43be006d74b9ff36092e92de96138
SHA512 736c99bde8d9c47b7213d03a08665795cdd418ab12c311247c2a7f612fcca95f7313d1538bca1f745ce1d9a30654d14d2a3077735472ef6d050b4fa0a05f5fca
TLSH
T12BF0DC180C7C422DF132EA388AC539EA0A3BF6063C0286B40AA94708E10A8822D01179
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 25754c30c631aba4e7abe9fe93bbff290e1e3cbd76755bac63f2770469dd98ef
MD5 d66a4f5b38dafaa5cde34e6c5c7d6a8f
SHA1 59d19d17f138c02df8a6a9bdbbefa6d2dea4bda8
SHA512 8c15c4b8bdb6118ca7e9444e98a093dacf9578ec3afc30003ec04dd244d779c2e4c77c140a75a3962c09efe91e1e976d44e0e9972a753437dbda21233f89aa72
TLSH
T15AF0DC3C85E9800AF07AE6B84AD636A25D2AE622040B127A0DE803841F64D405C4122E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kakeyqox.y43.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kakeyqox.y43.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\oexWe0\UxEnhance64.dll
Size 3.1MB
SHA256 56366a4e705b5dc577129178baf7a7f4923fc6f567f380221878752e9c81b52e
MD5 51bd90043ef8c3ecf3cdb299120d9eb0
SHA1 181f57f8f0f89ea5b580881b98fd582106ec85f1
SHA512 7cf886587c3949fb444c8d0eadd30bcc97c8e8cdb3c5bb6e73b70983efa080a491a55a619b56c3a3cb58164da93a7c27c5f13d4c236613bb4e7cc7561736ea91
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+Z:P9m29xx3Tiqt06ox6+z2rNNrKoZ
TLSH
T15DE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\oexWe0\adoresd.dat
Size 4.8MB
SHA256 d947f6088663eb03a286aab413fefefeb0f1fe4af47b3efb6d4b6d34e6e40031
MD5 4dea0a565981a04668d53d5d01361f56
SHA1 a154614b3688873ec0ac625e82c348e9b354fe2e
SHA512 86ab4a60d4b884b6a0589ba4f44b373375d110fa4efe4096dde37ca3334afe10b2d818256fbb1648c6797c90fe9a0039f88737b72108c597a363f4aa372be097
SSDEEP 98304:UWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:UWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1183633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\oexWe0\msadox.tb
Size 8KB
SHA256 f7af1a75c9e85985f6b9b38156bb9af1cfc522cd0ca77b39d623b29f998ef1de
MD5 08324cd9da3e297f2c8a825754b1bd55
SHA1 03e4390f1e5c58bb7125b428e4ef9891e887c3fc
SHA512 763ff193379c7c6a5b4d1ad6cc4c4adfc179a5ef7b7521ae98a260a4d34895559dbca9e94a988be780c5e8560ca29e5eda2609c9a66fd531fbba914a9553a6b5
SSDEEP 192:8qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:8sZqZOXQ3uqvR2Kfzp
TLSH
T1F9029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67E4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxwN10.exe

Path C:\Users\Public\oexWe0\pxwN10.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-0-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/920-524-0x00007FFF30BD0000-0x00007FFF30BE2000-memory.dmp

Download

memory/920-523-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/920-503-0x00007FFF30BD0000-0x00007FFF30BE2000-memory.dmp

Download

memory/920-1-0x00000000004E0000-0x00000000004EC000-memory.dmp

Download

memory/4484-673-0x00000000018C0000-0x00000000018C1000-memory.dmp

Download

memory/4484-675-0x0000000074D60000-0x00000000754AA000-memory.dmp

Download

memory/4516-604-0x0000025AF2AB0000-0x0000025AF2B62000-memory.dmp

Download

memory/4516-599-0x0000025AF2280000-0x0000025AF22A2000-memory.dmp

Download

memory/4516-603-0x0000025AF2850000-0x0000025AF286E000-memory.dmp

Download

memory/4516-605-0x0000025AF2870000-0x0000025AF287A000-memory.dmp

Download

memory/4932-587-0x000002557B5D0000-0x000002557BEA7000-memory.dmp

Download

memory/4932-588-0x000002557B5D0000-0x000002557BEA7000-memory.dmp

Download

memory/4932-589-0x000002557B5D0000-0x000002557BEA7000-memory.dmp

Download

memory/4932-590-0x00007FFF38E50000-0x00007FFF38E52000-memory.dmp

Download

memory/4932-586-0x000002557B5D0000-0x000002557BEA7000-memory.dmp

Download

memory/4932-582-0x000002557B5D0000-0x000002557BEA7000-memory.dmp

Download

memory/4932-581-0x00007FFF38E60000-0x00007FFF38E62000-memory.dmp

Download

memory/4932-579-0x000002557B5D0000-0x000002557BEA7000-memory.dmp

Download

memory/4932-576-0x00007FFF16230000-0x00007FFF1674E000-memory.dmp

Download

memory/5248-538-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-566-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-565-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-563-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-559-0x0000022806960000-0x00000228069EA000-memory.dmp

Download

memory/5248-560-0x0000022806960000-0x00000228069EA000-memory.dmp

Download

memory/5248-561-0x0000022806960000-0x00000228069EA000-memory.dmp

Download

memory/5248-558-0x0000022806960000-0x00000228069EA000-memory.dmp

Download

memory/5248-555-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-557-0x0000022806880000-0x00000228068CE000-memory.dmp

Download

memory/5248-549-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-545-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-544-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-537-0x00007FFF38E60000-0x00007FFF38E62000-memory.dmp

Download

memory/5248-543-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-542-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-535-0x0000022805B40000-0x0000022806417000-memory.dmp

Download

memory/5248-530-0x00007FFF16230000-0x00007FFF1674E000-memory.dmp

Download

memory/5248-529-0x00007FFF38E50000-0x00007FFF38E52000-memory.dmp

Download