1a947aa83fe1210cd0dc958fbaea3dc1fcaeba58aa3b8b4aefc74bcfd3f6cefb

Analysis

max time kernel
151s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.11.exe
Size 38.9MB
Sample261023-gtpmmscs8j
SHA256 1a947aa83fe1210cd0dc958fbaea3dc1fcaeba58aa3b8b4aefc74bcfd3f6cefb
MD5 ff40be6ff3d618d39bb6fed3dd94cee4
SHA1 2430cbf3503f794359c1ec53b4c6c766003130c8
SHA512 73496681ad6eae33809e5a7d2c1f93f5002071cfee50fc1bee576221f5ce27750aca8abafe9a1bbc6f4f31bc4bac199bfb2793b660eb4510ac5b6516b824e891
SSDEEP 49152:BPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXv:B6chqTShW/hNbSiQfMJPLmrUlsv
TLSH
T12597D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\3D6Aek = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1868	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3184	W3yF54.exe
3104	W3yF54.exe

Loads dropped DLL 2 IoCs

pid	Process
3184	W3yF54.exe
3104	W3yF54.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\3D6Aek\\W3yF54.exe\""	W3yF54.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3040	cmd.exe
2684	cmd.exe
1880	cmd.exe
1516	cmd.exe
5820	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	W3yF54.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2936	cmd.exe
2004	cmd.exe
5212	cmd.exe
3516	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	W3yF54.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	W3yF54.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.11.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
692	schtasks.exe
5948	schtasks.exe
5324	schtasks.exe
5996	schtasks.exe
2892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3068	install.2.0.11.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe
3184	W3yF54.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeIncreaseQuotaPrivilege	1868	powershell.exe
Token: SeSecurityPrivilege	1868	powershell.exe
Token: SeTakeOwnershipPrivilege	1868	powershell.exe
Token: SeLoadDriverPrivilege	1868	powershell.exe
Token: SeSystemProfilePrivilege	1868	powershell.exe
Token: SeSystemtimePrivilege	1868	powershell.exe
Token: SeProfSingleProcessPrivilege	1868	powershell.exe
Token: SeIncBasePriorityPrivilege	1868	powershell.exe
Token: SeCreatePagefilePrivilege	1868	powershell.exe
Token: SeBackupPrivilege	1868	powershell.exe
Token: SeRestorePrivilege	1868	powershell.exe
Token: SeShutdownPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeSystemEnvironmentPrivilege	1868	powershell.exe
Token: SeRemoteShutdownPrivilege	1868	powershell.exe
Token: SeUndockPrivilege	1868	powershell.exe
Token: SeManageVolumePrivilege	1868	powershell.exe
Token: 33	1868	powershell.exe
Token: 34	1868	powershell.exe
Token: 35	1868	powershell.exe
Token: 36	1868	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 1868	3184	W3yF54.exe	92
PID 3184 wrote to memory of 5820	3184	W3yF54.exe	94
PID 5820 wrote to memory of 5996	5820	cmd.exe	96
PID 5820 wrote to memory of 1508	5820	cmd.exe	97
PID 5820 wrote to memory of 2204	5820	cmd.exe	99
PID 3184 wrote to memory of 3040	3184	W3yF54.exe	103
PID 3040 wrote to memory of 2892	3040	cmd.exe	107
PID 3184 wrote to memory of 2684	3184	W3yF54.exe	108
PID 3040 wrote to memory of 5724	3040	cmd.exe	109
PID 3040 wrote to memory of 6120	3040	cmd.exe	112
PID 2684 wrote to memory of 692	2684	cmd.exe	113
PID 3184 wrote to memory of 1880	3184	W3yF54.exe	114
PID 1880 wrote to memory of 5948	1880	cmd.exe	116
PID 2684 wrote to memory of 3220	2684	cmd.exe	117
PID 1880 wrote to memory of 1992	1880	cmd.exe	118
PID 2684 wrote to memory of 2788	2684	cmd.exe	120
PID 1880 wrote to memory of 5584	1880	cmd.exe	121
PID 3184 wrote to memory of 1516	3184	W3yF54.exe	122
PID 1516 wrote to memory of 5324	1516	cmd.exe	124
PID 1516 wrote to memory of 1944	1516	cmd.exe	125
PID 1516 wrote to memory of 2732	1516	cmd.exe	127
PID 5212 wrote to memory of 3204	5212	cmd.exe	132
PID 2004 wrote to memory of 4536	2004	cmd.exe	134
PID 3516 wrote to memory of 4112	3516	cmd.exe	133
PID 2936 wrote to memory of 3080	2936	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.11.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.11.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2488

C:\Users\Public\3D6Aek\W3yF54.exe
"C:\Users\Public\3D6Aek\W3yF54.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\3D6Aek\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\3D6Aek\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2892
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5724
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5324
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2732

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\3D6Aek" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\3D6Aek" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3080

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4072

C:\Users\Public\3D6Aek\W3yF54.exe
"C:\Users\Public\3D6Aek\W3yF54.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3104

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4536

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3204

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 131c9dda888c1e77ffd638132150765304dd9d60afdfaa6daf0396adbc319488
MD5 3a321b9713dd662a14e008f977283ca6
SHA1 ac557b1b7d5c9e97e2a2c5369f2538441de6a0a4
SHA512 4ca491d262887ca8f415397911ac15f5529ac0f30950efc3281c56b91d9f4dc2e1c3973bfadd9532e4ca3b7c050eae387b4a5bd0e98539261ede27e99ab2f2fd
TLSH
T14D31C6BF2F6D7D828F3A8E9115CAF2322CE9E1D09CD9149D1111C4545F443F22F5A80E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 c71f96581f2c4acc9d067c4961c5459561f20e0816dc5bc5ad96309e16538e91
MD5 20d56aaaaf5ff187e8b5986bfa4bb9fb
SHA1 35f53fab55af9a882ad23973e3b5541231f99b65
SHA512 19c8f2e68e094a67221cc9b4425c13c3df2c9eec5442593d0969a3d8905a6e9cef102d64842ef4ca601676d962ede8683e19332175b087b216601de6978f38ac
TLSH
T1EE31D69A8A390006AF0C8F3492D5D63FACF092A04CF9084A563FD1AFE556B779F82410
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 aaf41267f2c60827d7b4ad32aca7324fa46b563c19645f1b31ad85b2c7d3b5cb
MD5 a2c5cf7794cb6eeba3759639c0bcc107
SHA1 9b74954b7d52d064a7e9012db7664eace66d93ef
SHA512 4bf09f6404187f20f6f921303a39d752bfab41d0d907b1015670affbe0b2f98e52455c6d2e8cc85a7b8a38192ede34fc550556506004fa173f5d4fc1246f64e6
TLSH
T102F0DC0C68B8413EF137DE3C8ECE3BAA4AAFF705280281A402FA470AA445A053D5057A
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 b030bf45ec22705a8c1bed4c3bee66549a39ce076c2db606bdd95a531590a46a
MD5 5b84acbdf652c27f1a469dd93a24059f
SHA1 b285fcece130898f7a07ea1e6fca9881bf3e7b89
SHA512 38167216340d481b9324c617289a927e7adeb95aaff89e37c2dbe3c540ae72990ca916941b35118e4cd66f3ef3d069c4b07c065b3fb3a0057f3e88c757de8628
TLSH
T12FF05C2D45D9403AF17BD7B84A867E70C526F223000A79BE1AF752582B658421C4262E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5rgdb1um.1vr.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5rgdb1um.1vr.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\3D6Aek\UxEnhance64.dll
Size 3.1MB
SHA256 589fca27b8ffeeeacd90a456524e4b35f7fd97270334ad14cbe8a8a991a1d563
MD5 5d62d42825f779e6a6d5147ca710ebf2
SHA1 1783c4f576107729dae33315d8b08d450d627ace
SHA512 4c560329f84a3fb7b6cd4dfd9f12610b69185dcef18d946d2589c1466349d2737d7a0e7e67be4892c080a59d6c90a16afa5fdb70df0154b45678740a2b3994d2
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+5:P9m29xx3Tiqt06ox6+z2rNNrKo5
TLSH
T123E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W3yF54.exe

Path C:\Users\Public\3D6Aek\W3yF54.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\3D6Aek\adoresd.dat
Size 4.8MB
SHA256 cc2e5e9dd06ff660ec56dbbc413309a15eb9f74e0ee8ce49983193f72a9b448b
MD5 849e032432bee08427e5c1c2c9279496
SHA1 827752665f662f2fc42e69bc80cd96bee74542b1
SHA512 35313d3b6b5bfc9911501be6f8fdcc95c0963336d6f46f3277082ce6279b7d6037394a98b96b7fe55c0ae0feb5ce2bae00d907256c234fa24a4db2e230b36d3e
SSDEEP 98304:RWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:RWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1393633AF2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\3D6Aek\msadox.tb
Size 8KB
SHA256 3356ba550cf906d1b7991eeb3388c960f82f2897977b86489d911bdf7f6b3532
MD5 d9ea043e7fd97cf0442c23f3ce75ae55
SHA1 186af17c8fb417f2dbd276e91c9d4729ae45d9dd
SHA512 251887249f24bd915ad51d8f7e903810fbd95e5eba7f77ba9f9948954a2ee468f043fec04516efdb2cc54ddcb046dc1dd387c5f3a020d49f70d3ce1396b75f9a
SSDEEP 192:gqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:gsZqZOXQ3uqvR2Kfzp
TLSH
T12D029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1868-609-0x000002FBB1E20000-0x000002FBB1ED2000-memory.dmp

Download

memory/1868-608-0x000002FBB1E00000-0x000002FBB1E1E000-memory.dmp

Download

memory/1868-610-0x000002FBB1EE0000-0x000002FBB1EEA000-memory.dmp

Download

memory/1868-603-0x000002FB99A10000-0x000002FB99A32000-memory.dmp

Download

memory/3068-527-0x00007FFD69E50000-0x00007FFD69E62000-memory.dmp

Download

memory/3068-526-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/3068-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/3068-504-0x00007FFD69E50000-0x00007FFD69E62000-memory.dmp

Download

memory/3068-2-0x00000000005B0000-0x00000000005BC000-memory.dmp

Download

memory/3068-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/3104-583-0x0000022660FB0000-0x0000022661887000-memory.dmp

Download

memory/3104-594-0x00007FFD72290000-0x00007FFD72292000-memory.dmp

Download

memory/3104-591-0x0000022660FB0000-0x0000022661887000-memory.dmp

Download

memory/3104-593-0x0000022660FB0000-0x0000022661887000-memory.dmp

Download

memory/3104-592-0x0000022660FB0000-0x0000022661887000-memory.dmp

Download

memory/3104-590-0x0000022660FB0000-0x0000022661887000-memory.dmp

Download

memory/3104-585-0x00007FFD722A0000-0x00007FFD722A2000-memory.dmp

Download

memory/3104-586-0x0000022660FB0000-0x0000022661887000-memory.dmp

Download

memory/3104-580-0x00007FFD51070000-0x00007FFD5158E000-memory.dmp

Download

memory/3184-561-0x00000180BD280000-0x00000180BD2CE000-memory.dmp

Download

memory/3184-562-0x00000180BE6C0000-0x00000180BE74A000-memory.dmp

Download

memory/3184-550-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-548-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-569-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-547-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-559-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-567-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-549-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-554-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-564-0x00000180BE6C0000-0x00000180BE74A000-memory.dmp

Download

memory/3184-565-0x00000180BE6C0000-0x00000180BE74A000-memory.dmp

Download

memory/3184-563-0x00000180BE6C0000-0x00000180BE74A000-memory.dmp

Download

memory/3184-543-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-542-0x00007FFD722A0000-0x00007FFD722A2000-memory.dmp

Download

memory/3184-540-0x00000180BDD50000-0x00000180BE627000-memory.dmp

Download

memory/3184-535-0x00007FFD51070000-0x00007FFD5158E000-memory.dmp

Download

memory/3184-534-0x00007FFD72290000-0x00007FFD72292000-memory.dmp

Download