489bdc562909861817862212eba0aafdbbd35328d043aba3092463d53a9e3828

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261023-lfy2dace95
SHA256 489bdc562909861817862212eba0aafdbbd35328d043aba3092463d53a9e3828
MD5 7f871e2c303a987c53f531d4423402de
SHA1 f3c198694c4e2bf43c05e31b0b87bce3d15e50cc
SHA512 9e56d024159114e23ea294771bf9f846a1632422aa6906137fe06d8149bf1850e3de4d5211214ed499a7021a5feef64846768415dc85ee49ce2b1ccd29ef90d3
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXP:q6chqTShW/hNbSiQfMJPLmrUlsP
TLSH
T11B97D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\aQSXUX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	LgyXNm.exe

Executes dropped EXE 2 IoCs

pid	Process
5772	LgyXNm.exe
2740	LgyXNm.exe

Loads dropped DLL 2 IoCs

pid	Process
5772	LgyXNm.exe
2740	LgyXNm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\aQSXUX\\LgyXNm.exe\""	LgyXNm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\aQSXUX\\LgyXNm.exe\""	LgyXNm.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4560	cmd.exe
976	cmd.exe
4028	cmd.exe
6100	cmd.exe
4548	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	LgyXNm.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	LgyXNm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1028	cmd.exe
4868	cmd.exe
4252	cmd.exe
2580	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	LgyXNm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	LgyXNm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4916	schtasks.exe
1552	schtasks.exe
1900	schtasks.exe
4660	schtasks.exe
3776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
3896	install.2.0.02.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe
5772	LgyXNm.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 6100	5772	LgyXNm.exe	99
PID 6100 wrote to memory of 3776	6100	cmd.exe	101
PID 6100 wrote to memory of 5108	6100	cmd.exe	103
PID 6100 wrote to memory of 5048	6100	cmd.exe	107
PID 5772 wrote to memory of 4548	5772	LgyXNm.exe	108
PID 5772 wrote to memory of 4560	5772	LgyXNm.exe	111
PID 4548 wrote to memory of 4916	4548	cmd.exe	113
PID 2580 wrote to memory of 3844	2580	cmd.exe	114
PID 4548 wrote to memory of 2504	4548	cmd.exe	115
PID 4560 wrote to memory of 1552	4560	cmd.exe	118
PID 4548 wrote to memory of 1924	4548	cmd.exe	119
PID 4560 wrote to memory of 512	4560	cmd.exe	120
PID 5772 wrote to memory of 976	5772	LgyXNm.exe	121
PID 4560 wrote to memory of 2616	4560	cmd.exe	123
PID 976 wrote to memory of 1900	976	cmd.exe	124
PID 1028 wrote to memory of 3520	1028	cmd.exe	125
PID 976 wrote to memory of 3100	976	cmd.exe	126
PID 4868 wrote to memory of 3900	4868	cmd.exe	129
PID 976 wrote to memory of 2768	976	cmd.exe	130
PID 5772 wrote to memory of 4028	5772	LgyXNm.exe	131
PID 4028 wrote to memory of 4660	4028	cmd.exe	133
PID 4028 wrote to memory of 4264	4028	cmd.exe	134
PID 4028 wrote to memory of 5064	4028	cmd.exe	137
PID 4252 wrote to memory of 1080	4252	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3896

C:\Users\Public\aQSXUX\LgyXNm.exe
C:\Users\Public\aQSXUX\LgyXNm.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\aQSXUX\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\aQSXUX\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1900
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4264
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5064

C:\Users\Public\aQSXUX\LgyXNm.exe
"C:\Users\Public\aQSXUX\LgyXNm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2740

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\aQSXUX" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\aQSXUX" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3844

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3788

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3520

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3900

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 5568366d32130768a0ad7d5b05302ac7b88afc5e54173f87822814ba25f8d7d1
MD5 be746fe57e1660aaa3d5bb1f1f5b5adc
SHA1 d5c9733b03442b528456bd841a5ca1a4771af4d9
SHA512 6162a4556078991de2b29599932db96b6e3a45b5f92bc4ae46688fffe42679a0d32007cdd30188a2faf720b202dd810526b74e7bfd246248ad89fb5c23d41f17
TLSH
T1BF31C6FF2B6C78839F398E9421CDB1312CA0A2C01CD544892219C4989F083B11F6E50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 1d8df58ed098172c6be60f6888f2470ab36724066bbd63cc9fc0e572bedbb082
MD5 187d85d12551c9f9ee357de185159e76
SHA1 5e111c019e08f7b181a73d18f3b3a73e35b75cee
SHA512 07fab70e3938e3728f9575338a81ca6faf6e2410cea1bc1cfefe2acf90319f0b86d2bcba76501e8175c38e100b270c763363eba8b5fdaaa45e19daf1867918c4
TLSH
T1E731D6A74F3900029F094F6562D0E23BBDF591B48DB45401663FC1AB4746FB36FC5008
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 c58ae1e3efbe745861006fcdb784835ac5c9dcdc013dacd6b4fde81cb17d190a
MD5 03507a474856af6386652336c8870b14
SHA1 74c958a046bbfefc4a75b1606c5fb059b4c197fd
SHA512 1e4e5e72cb25578b1065cf393618f59c848045aacac8dcca157575a40d542a202c4718c6bc3c392bc31f368a64e643f58b017faf95a7c16b852a1aa65e1d09ef
TLSH
T10AF05C180B7C412EF233ED3D8AC93BD666ABEB46144686980AB5870DA64B9023E5157D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 4d27b539ba8f1ae1e4112e3f38b0c898418426663d82a6ba2b2f7b3adb5c2f87
MD5 4d3b3a6584ea1b953da549b70442a31d
SHA1 ac6d5b3132fd649b40720759fc16d010c0c316d9
SHA512 b157551f4724313a2065672f53174a1b1a1a4bca7ef7ecc3cb9b3b4b949afb1a921ebb83572699856cf73161a20b85067a6efe1fe512a74630ce55012bc0f5fd
TLSH
T18EF05C3C93D9011EF17B8AB44FE67AB18A75F633405B36AD09A603855E9B8001C4226C
MD5 SHA1 SHA512 TLSH

Submit Download

LgyXNm.exe

Path C:\Users\Public\aQSXUX\LgyXNm.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\aQSXUX\UxEnhance64.dll
Size 3.1MB
SHA256 68652319c3176098819b8d7448f89f08ebd58a63cdc4726cc2c137052fdfc7ca
MD5 9d9fe5498093529b8ebe0e57e8e6b369
SHA1 f7190730336091edee57c2121ec5a72f31288201
SHA512 a151e0be6a022ea2c1d35872eb7367977c3677943d13055b772673151ededf0d25beddbb4f7116df2d685782cef75c7be22e70458df79358e58909c144509dd5
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+t:P9m29xx3Tiqt06ox6+z2rNNrKot
TLSH
T175E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\aQSXUX\adoresd.dat
Size 4.8MB
SHA256 73807d48a52841479f8c445ebff7cb25df22d984cf2ca6d32a4cf228fcbaaf0b
MD5 1501fef8c6d4ffdfb9d4e904a142f6d8
SHA1 0a644fe35c1e74b19f31145b3a1fe789355b1d09
SHA512 3ebed2fe1291674f60147f72c43e6bd1a99f7528788c323a7d42e70fb6d4677f794b93bf7b6b3bb9a90742166326c15bbbf1552b0ef09d018194636789b51f21
SSDEEP 98304:MWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:MWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T16E3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\aQSXUX\msadox.tb
Size 8KB
SHA256 fc095dc8ee651c99376d16acae3365bbee6e3d901258831fbe67d55fb91f8b30
MD5 c3b7f3dfafb5ed6f19ded9a8aa111628
SHA1 7c848212e7cb0efde95ce6655563f55f16f62fb1
SHA512 c6022486e716394e76744e6796ed275f3733323d1356bf823a6f48f953f6954a0efedf95a6c0bf16daffb035d22cacd26e076149d852eecb65ffc757249dcf84
SSDEEP 192:TqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:TsZqZOXQ3uqvR2Kfzp
TLSH
T1DC029E05D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiPolicy.p7b

Path C:\Windows\System32\CodeIntegrity\SiPolicy.p7b
Size 24KB
SHA256 b3f17065ed63b17ffef175f2979907d8eef69a76ba4cbd1d9785035a0b1f0a10
MD5 c99441a9b83d3866d88abfdf45894d3d
SHA1 3e32a4131855a8296b6238294a03d8eabcad6f9c
SHA512 c13bb76ef20055b5e923272c4cd976e93e5f21c5b7f8664e5d60a4918e92d0ab4abd3efa63a549b52536986fc3434a9ef1f808be76a12f47e43fdd9e58f275f6
SSDEEP 48:GwIn0NHUVyHU1yHUccy3GwaAvdV6dVwNdVojdVKdVqdmded9dod1d9Ud0dOdbd81:Any8yU88yldGVDP4NMC2/22M/0rw
TLSH
T11CB2C6803BEEC559F3B3DA71AFB6C6AA903AFC91AD11531F71C9735E1432800D529B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2740-592-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-587-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-617-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-618-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-609-0x000001FCE76C0000-0x000001FCE774A000-memory.dmp

Download

memory/2740-610-0x000001FCE76C0000-0x000001FCE774A000-memory.dmp

Download

memory/2740-611-0x000001FCE76C0000-0x000001FCE774A000-memory.dmp

Download

memory/2740-612-0x000001FCE76C0000-0x000001FCE774A000-memory.dmp

Download

memory/2740-606-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-599-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-586-0x00007FFF835C0000-0x00007FFF835C2000-memory.dmp

Download

memory/2740-593-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-594-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-591-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-573-0x000001FCE6CA0000-0x000001FCE7577000-memory.dmp

Download

memory/2740-571-0x00007FFF66DD0000-0x00007FFF672EE000-memory.dmp

Download

memory/3896-504-0x00007FFF745F0000-0x00007FFF74600000-memory.dmp

Download

memory/3896-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/3896-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/3896-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/3896-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/3896-525-0x00007FFF745F0000-0x00007FFF74600000-memory.dmp

Download

memory/5772-531-0x00007FFF66DD0000-0x00007FFF672EE000-memory.dmp

Download

memory/5772-546-0x0000019446B60000-0x0000019447437000-memory.dmp

Download

memory/5772-560-0x0000019447990000-0x0000019447A1A000-memory.dmp

Download

memory/5772-561-0x0000019447990000-0x0000019447A1A000-memory.dmp

Download

memory/5772-555-0x0000019446B60000-0x0000019447437000-memory.dmp

Download

memory/5772-563-0x0000019447990000-0x0000019447A1A000-memory.dmp

Download

memory/5772-562-0x0000019447990000-0x0000019447A1A000-memory.dmp

Download

memory/5772-550-0x0000019446B60000-0x0000019447437000-memory.dmp

Download

memory/5772-596-0x0000019446B60000-0x0000019447437000-memory.dmp

Download

memory/5772-559-0x0000019447510000-0x000001944755E000-memory.dmp

Download

memory/5772-545-0x0000019446B60000-0x0000019447437000-memory.dmp

Download

memory/5772-558-0x0000019446B60000-0x0000019447437000-memory.dmp

Download

memory/5772-543-0x0000019446B60000-0x0000019447437000-memory.dmp

Download

memory/5772-544-0x0000019446B60000-0x0000019447437000-memory.dmp

Download

memory/5772-538-0x00007FFF835C0000-0x00007FFF835C2000-memory.dmp

Download

memory/5772-539-0x0000019446B60000-0x0000019447437000-memory.dmp

Download

memory/5772-530-0x00007FFF835B0000-0x00007FFF835B2000-memory.dmp

Download

memory/5772-536-0x0000019446B60000-0x0000019447437000-memory.dmp

Download