235c45fec424ed2588a7bac17e8943c73d16273e075cce84b8e839ad86e11aaa

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.13.exe
Size 30.5MB
Sample261023-s2t3wact91
SHA256 235c45fec424ed2588a7bac17e8943c73d16273e075cce84b8e839ad86e11aaa
MD5 03ed9c22d3db1bf8a47bc797e76c08f3
SHA1 036ebc7a056e91bb5a7e0c43b239c62b5a25ed6f
SHA512 7969ecf8339f879eb98c7559b1b0d322531e3a8bc01bec268eca81aa68c43c8ab883fc4836778d51e312fc11355fa761fdb134b7954e1d7d1296c4e491559bd7
SSDEEP 196608:CZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYO:ZC/p+HuPOc4z
TLSH
T1F867181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\aGQuBl = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
872	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4400	IGgB29.exe
4496	IGgB29.exe

Loads dropped DLL 2 IoCs

pid	Process
4400	IGgB29.exe
4496	IGgB29.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\aGQuBl\\IGgB29.exe\""	IGgB29.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3520	cmd.exe
3840	cmd.exe
3844	cmd.exe
1776	cmd.exe
6004	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	IGgB29.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
700	cmd.exe
2228	cmd.exe
2176	cmd.exe
5660	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	IGgB29.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	IGgB29.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3280	schtasks.exe
1184	schtasks.exe
5684	schtasks.exe
2420	schtasks.exe
4260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
2876	install.2.0.13.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe
4400	IGgB29.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	powershell.exe
Token: SeIncreaseQuotaPrivilege	872	powershell.exe
Token: SeSecurityPrivilege	872	powershell.exe
Token: SeTakeOwnershipPrivilege	872	powershell.exe
Token: SeLoadDriverPrivilege	872	powershell.exe
Token: SeSystemProfilePrivilege	872	powershell.exe
Token: SeSystemtimePrivilege	872	powershell.exe
Token: SeProfSingleProcessPrivilege	872	powershell.exe
Token: SeIncBasePriorityPrivilege	872	powershell.exe
Token: SeCreatePagefilePrivilege	872	powershell.exe
Token: SeBackupPrivilege	872	powershell.exe
Token: SeRestorePrivilege	872	powershell.exe
Token: SeShutdownPrivilege	872	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeSystemEnvironmentPrivilege	872	powershell.exe
Token: SeRemoteShutdownPrivilege	872	powershell.exe
Token: SeUndockPrivilege	872	powershell.exe
Token: SeManageVolumePrivilege	872	powershell.exe
Token: 33	872	powershell.exe
Token: 34	872	powershell.exe
Token: 35	872	powershell.exe
Token: 36	872	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 872	4400	IGgB29.exe	90
PID 4400 wrote to memory of 3844	4400	IGgB29.exe	92
PID 3844 wrote to memory of 3280	3844	cmd.exe	94
PID 3844 wrote to memory of 972	3844	cmd.exe	97
PID 3844 wrote to memory of 476	3844	cmd.exe	100
PID 4400 wrote to memory of 1776	4400	IGgB29.exe	101
PID 1776 wrote to memory of 1184	1776	cmd.exe	104
PID 1776 wrote to memory of 4120	1776	cmd.exe	105
PID 1776 wrote to memory of 4684	1776	cmd.exe	107
PID 4400 wrote to memory of 6004	4400	IGgB29.exe	108
PID 4400 wrote to memory of 3520	4400	IGgB29.exe	110
PID 6004 wrote to memory of 5684	6004	cmd.exe	112
PID 3520 wrote to memory of 2420	3520	cmd.exe	113
PID 6004 wrote to memory of 4784	6004	cmd.exe	114
PID 6004 wrote to memory of 4856	6004	cmd.exe	118
PID 3520 wrote to memory of 6000	3520	cmd.exe	119
PID 3520 wrote to memory of 4840	3520	cmd.exe	120
PID 4400 wrote to memory of 3840	4400	IGgB29.exe	121
PID 3840 wrote to memory of 4260	3840	cmd.exe	123
PID 3840 wrote to memory of 716	3840	cmd.exe	124
PID 3840 wrote to memory of 1816	3840	cmd.exe	129
PID 5660 wrote to memory of 3176	5660	cmd.exe	130
PID 700 wrote to memory of 4640	700	cmd.exe	131
PID 2228 wrote to memory of 4048	2228	cmd.exe	132
PID 2176 wrote to memory of 204	2176	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2876

C:\Users\Public\aGQuBl\IGgB29.exe
"C:\Users\Public\aGQuBl\IGgB29.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\aGQuBl\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\aGQuBl\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3280
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1184
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6000
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1816

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\aGQuBl" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\aGQuBl" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4640

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5528

C:\Users\Public\aGQuBl\IGgB29.exe
"C:\Users\Public\aGQuBl\IGgB29.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4496

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4048

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:204

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 a2a913fb459541af5b35eac1fa6a771228c8739446ef851c2e0a54790da51485
MD5 5483d5a54c9357388eb6df52cf031632
SHA1 2acb16fa55c94f9286cbf4cffaa0da05c15614d5
SHA512 ef3a5192553600d77f3576de1e0436cc2c9b0efd8ea2d94b713cf8ae615c6397917ee12b569e98c9b776f576acb4047c26508f305872586cab9858db737381a3
TLSH
T13331B6BB3F6E68869F3A4D9155CEE1321CF5E180ACCA005E7155C0A8AF487713F2E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 f7b3af19b10ab5ab509ecd8e2aa492fe8893d8c8fc0b9f51198efed6115bc12f
MD5 069c3d80bd2808098fae12b8d5b79ad2
SHA1 36e4bdef5e44fe0b3960672eedcc7a69f2420492
SHA512 98aae4dd7399cbff977e898f5b5acd38846645b5ab94d60c95b79389c9c312863eb60ba611a8dee5b10415bee379598fdc2071a12601c0f30b08e795442def5b
TLSH
T1EA31F8A28F399462AB0CCF3252D0C53F6CF0A5B98DEA4C56212FC39B6609B775F46014
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 c6df47390ef011ab90f38ac56da48df90079df6af1efd9926b5f966f467d2a5e
MD5 4beedff5746f75b4492f317fe7cd6f8d
SHA1 a68c321d827d7510706be68194607caa8f383e09
SHA512 57a3156a0f7b710fc520762ab4750c380326fdcd3ecf5af126f9537954681258f487f9fcd00fd725e323bccbcfa685beffe31280f5f520f903bfe286c7c20578
TLSH
T1C4F05C0C187C412DF133DA3C4BC87AAA5ABFE645304785A006E55B49F62AD852D12A7D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 e7352c9fc7efe1c77a8e2a8f244b4cb0344d7aa4c6e8f99aab29389ef75d9ab9
MD5 6e178a92fd5c67fc2e23460029784466
SHA1 e9e1951540dd77d78324d56465881ff5ceceaa40
SHA512 be726cbf00dc9a1bddc117c7c2e4f3b0bd41eece0b24489328a762e9567c5a17cd6554276cfe7f0ff31b806257d1481ddad28a8f3b3a2bf3091aa781d8d47f12
TLSH
T120F0A33D46ED111FF0BBC2BC0BE736F25A66F3232006527D0AE40388AE58C005C513A9
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cjol3znu.d2l.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjol3znu.d2l.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

IGgB29.exe

Path C:\Users\Public\aGQuBl\IGgB29.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\aGQuBl\UxEnhance64.dll
Size 3.1MB
SHA256 a35705dbac64f01837e17c9f1464929a3f76483ff873c8b3f3e85fed6246e965
MD5 8a0e3e0f9fe2a990f712693821dd61c5
SHA1 6238936a86db95c33755d4bc4dd874e19d107fcb
SHA512 e3c0b3739376ca33f7f6328b51e90bbdebe9cd7378e5fa810b0d2c6479898a3a0770627338fd9fd36ff4d9f015df60d6b9a3a92e875892b0924691dc80c8a084
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+e:P9m29xx3Tiqt06ox6+z2rNNrKoe
TLSH
T14BE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\aGQuBl\adoresd.dat
Size 4.8MB
SHA256 05c39edae5a16b441be834a0acf097bcd8ffc6422887c2ab360654e8d0b4f2e1
MD5 1b354ed6853272104068f8a05965440f
SHA1 41be1b1ac8269b1428a7cee71140e8356385598d
SHA512 3256000e29d697201bb10a44855b863d4bda9171353598d72e57f5cedd8da6d590ffd8d2960b03326b333a91986c56759bb099459d48b110d51d0a70780f027f
SSDEEP 98304:3Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:3Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1CC3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\aGQuBl\msadox.tb
Size 8KB
SHA256 06ee129634a7693a9c2c1762185f726ca3e701496ea4026f19aa33af0f63ca81
MD5 a827170abe2db4eb602b1dfe1c602b98
SHA1 fb5023729b735156395b996dc490b8f087f52210
SHA512 1b9ade7278decc5b73dce0640b2e5a4cb8b3bd451242f748898514227aea4720c2f12b5e718c1300b86b556cc877d5eb6c99b386e45cdfd5ea6e8080de8ca3b3
SSDEEP 192:FqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:FsZqZOXQ3uqvR2Kfzp
TLSH
T1ED029E05D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-603-0x000001EEF7BF0000-0x000001EEF7C0E000-memory.dmp

Download

memory/872-604-0x000001EEF7C10000-0x000001EEF7CC2000-memory.dmp

Download

memory/872-605-0x000001EEF7DD0000-0x000001EEF7DDA000-memory.dmp

Download

memory/872-598-0x000001EEF7980000-0x000001EEF79A2000-memory.dmp

Download

memory/2876-0-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/2876-525-0x00007FFBCB540000-0x00007FFBCB552000-memory.dmp

Download

memory/2876-524-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/2876-504-0x00007FFBCB540000-0x00007FFBCB552000-memory.dmp

Download

memory/2876-2-0x00000000004E0000-0x00000000004EC000-memory.dmp

Download

memory/2876-1-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/4400-561-0x000001AE42030000-0x000001AE420BA000-memory.dmp

Download

memory/4400-546-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-560-0x000001AE42030000-0x000001AE420BA000-memory.dmp

Download

memory/4400-550-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-559-0x000001AE42030000-0x000001AE420BA000-memory.dmp

Download

memory/4400-558-0x000001AE41F50000-0x000001AE41F9E000-memory.dmp

Download

memory/4400-556-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-564-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-566-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-539-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-545-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-544-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-543-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-562-0x000001AE42030000-0x000001AE420BA000-memory.dmp

Download

memory/4400-530-0x00007FFBD39D0000-0x00007FFBD39D2000-memory.dmp

Download

memory/4400-531-0x00007FFBBFD50000-0x00007FFBC026E000-memory.dmp

Download

memory/4400-536-0x000001AE42AA0000-0x000001AE43377000-memory.dmp

Download

memory/4400-538-0x00007FFBD39E0000-0x00007FFBD39E2000-memory.dmp

Download

memory/4496-577-0x00007FFBBFD50000-0x00007FFBC026E000-memory.dmp

Download

memory/4496-589-0x000001DBA0420000-0x000001DBA0CF7000-memory.dmp

Download

memory/4496-591-0x00007FFBD39D0000-0x00007FFBD39D2000-memory.dmp

Download

memory/4496-590-0x000001DBA0420000-0x000001DBA0CF7000-memory.dmp

Download

memory/4496-588-0x000001DBA0420000-0x000001DBA0CF7000-memory.dmp

Download

memory/4496-587-0x000001DBA0420000-0x000001DBA0CF7000-memory.dmp

Download

memory/4496-583-0x000001DBA0420000-0x000001DBA0CF7000-memory.dmp

Download

memory/4496-582-0x00007FFBD39E0000-0x00007FFBD39E2000-memory.dmp

Download

memory/4496-580-0x000001DBA0420000-0x000001DBA0CF7000-memory.dmp

Download