391b9fc5ec50d474d802d1456d42d0170857320cd46f26fedd5da82f3aaeada6

Analysis

max time kernel
146s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261023-tpjxtatt6l
SHA256 391b9fc5ec50d474d802d1456d42d0170857320cd46f26fedd5da82f3aaeada6
MD5 a357e372ffebb2dd082e678a76569814
SHA1 40d2fd104887f2093fb569f38f011bd0464f42b9
SHA512 8e4e274a49d95c3ad7fd0a722b375abd9b8bc17ee7061b4805a2e32c9af51e996c4342cccf291a9d4cf26c6b5f387c110f80a29a55aef29c2380aa16f0face85
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXV:q6chqTShW/hNbSiQfMJPLmrUlsV
TLSH
T18497D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\ofCkDm = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4160	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2844	1HikvN.exe
5740	1HikvN.exe

Loads dropped DLL 2 IoCs

pid	Process
2844	1HikvN.exe
5740	1HikvN.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\ofCkDm\\1HikvN.exe\""	1HikvN.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3540	cmd.exe
2620	cmd.exe
1648	cmd.exe
684	cmd.exe
4204	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	1HikvN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1540	cmd.exe
4792	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1HikvN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1HikvN.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3556	schtasks.exe
1736	schtasks.exe
5096	schtasks.exe
4192	schtasks.exe
2388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
1096	install.2.0.02.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe
2844	1HikvN.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 4160	2844	1HikvN.exe	92
PID 2844 wrote to memory of 3540	2844	1HikvN.exe	94
PID 3540 wrote to memory of 3556	3540	cmd.exe	97
PID 3540 wrote to memory of 1656	3540	cmd.exe	99
PID 2844 wrote to memory of 2620	2844	1HikvN.exe	101
PID 2620 wrote to memory of 1736	2620	cmd.exe	104
PID 3540 wrote to memory of 1856	3540	cmd.exe	105
PID 2844 wrote to memory of 1648	2844	1HikvN.exe	106
PID 2620 wrote to memory of 4308	2620	cmd.exe	108
PID 1648 wrote to memory of 5096	1648	cmd.exe	109
PID 2620 wrote to memory of 4888	2620	cmd.exe	110
PID 1648 wrote to memory of 5904	1648	cmd.exe	111
PID 2844 wrote to memory of 684	2844	1HikvN.exe	113
PID 1648 wrote to memory of 4332	1648	cmd.exe	114
PID 684 wrote to memory of 4192	684	cmd.exe	116
PID 1540 wrote to memory of 4636	1540	cmd.exe	117
PID 2844 wrote to memory of 4204	2844	1HikvN.exe	118
PID 684 wrote to memory of 1476	684	cmd.exe	120
PID 4204 wrote to memory of 2388	4204	cmd.exe	122
PID 684 wrote to memory of 6104	684	cmd.exe	123
PID 4204 wrote to memory of 5928	4204	cmd.exe	124
PID 4204 wrote to memory of 1232	4204	cmd.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1096

C:\Users\Public\ofCkDm\1HikvN.exe
"C:\Users\Public\ofCkDm\1HikvN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ofCkDm\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ofCkDm\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1656
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4308
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4192
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5928
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1232

C:\Users\Public\ofCkDm\1HikvN.exe
"C:\Users\Public\ofCkDm\1HikvN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5740

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ofCkDm" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ofCkDm" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4636

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3180

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4792
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 a2a913fb459541af5b35eac1fa6a771228c8739446ef851c2e0a54790da51485
MD5 5483d5a54c9357388eb6df52cf031632
SHA1 2acb16fa55c94f9286cbf4cffaa0da05c15614d5
SHA512 ef3a5192553600d77f3576de1e0436cc2c9b0efd8ea2d94b713cf8ae615c6397917ee12b569e98c9b776f576acb4047c26508f305872586cab9858db737381a3
TLSH
T13331B6BB3F6E68869F3A4D9155CEE1321CF5E180ACCA005E7155C0A8AF487713F2E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a6b0f6a44dd96965a00f4e245bf186c12f6ff9f63bb9cb6c82d0e40b4ec561ac
MD5 bcd4b0559361f9a709e5c758e66bea37
SHA1 eb0f3410d134d5d0d7e22d706b22436bb29ba674
SHA512 e359408a9c99a3155c0b0e9bfc2ffc54faecdcbaac4dbe09de83ab93a402de39d81f644f1fc98bae16bf125a1468e6f6a383417babeb667ed936b0bd06150aca
TLSH
T12531D6A34E350012DF1C5F3096C0D13BBCF2AAB45DE808416A6EE2AE961AB774FC5495
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 abd16087abaf9e6c93ccf6a64382e715bbee221d417afa4bb24b582facbe109b
MD5 fdbfe220d8b3e198e952d70fb6c5e50e
SHA1 a78d75b451e5e786b9ba29779b8f0d1094b9d3c8
SHA512 5ffcd9ad5d9eeec72c7e8f962d0c4be0db652ab005706a6f9f7a43cf01379c8d9fa470a25c77c35df36302b65e7c6ca3e5ad4a87c5d76443a12a5343366bbb7b
TLSH
T108F05C0C147C412DF133DA3C46C97AAA2EBFE645240785A006F55B09F625D462D115BD
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 bad3becfb7254d92acb8006a21a00a19eaffeeaccc9c71ce21af15299dbcad6f
MD5 9da386b62626bd5d82ce6ffa422059ce
SHA1 b782af55a48d6058a0dea34a2085b1f2f1c97c0f
SHA512 1bba210ba47b0dbe17f5351995c8c64720cbdeaed3b677f7cb43e6272a7d9ef3f58454e3969eb6c4b7d49ec941ecb217d62db2acb9e34a7c9bf002cbfa428c7d
TLSH
T11DF05C3D52DA810FF23BD1B456C63AF25B3AE122600A32AE09F803542E60A416C4226E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_swwjuhma.pci.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_swwjuhma.pci.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

1HikvN.exe

Path C:\Users\Public\ofCkDm\1HikvN.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ofCkDm\UxEnhance64.dll
Size 3.1MB
SHA256 de7ebb8eb96f5300396535df5e2d04bc12f09e75a26d40ca544204c081666b05
MD5 368d0fc599cbdcc7f699159065a8351c
SHA1 05fd9a74de7d9aade87806b5e4300d31155b1304
SHA512 e811064e10967b20775eb054dc10d55fd9204025756fa5000bcbe551256dc7c5391b93d7929350fc04fc270098def41a148c937368bfb3b69d89283a3a3e7e44
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+/:P9m29xx3Tiqt06ox6+z2rNNrKo/
TLSH
T1C4E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\ofCkDm\adoresd.dat
Size 4.8MB
SHA256 b58cc282f6dd16f21ed6ef0668c8eb6a9dd58beb58c3a0846274f1122b53052d
MD5 ef39e1d9d2b828bd17d34d789e0afdf4
SHA1 ed6eb8f700047665daa9ad447a2d95d0ebe8f0cc
SHA512 7e9301df6058030b21a3e845e5400e79e047515637813411900832dc7e5ececce99ec7daf93efd03888b40a6e1da1738c152fa0e1222f6aab83044ad1cc156ce
SSDEEP 98304:zWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:zWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1C73633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\ofCkDm\msadox.tb
Size 8KB
SHA256 456ff60ae9349ddcf097248b1796ad11581b640d6a9f4f896d3adf02af798555
MD5 f80ceb010f4490a8084cd28e5faffbda
SHA1 05c0ce21372a4dda26a46f655244651c3a520420
SHA512 5ccb2ab58d44b14fc90d9aa8f31eaa8ee41279bf0ce3b0fa5203c8f357da10e855af09b0e08f6eb7c7ff79b6ea2616b7e2ec91b55bd4b7e9184b37c4b48db2cf
SSDEEP 192:hqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:hsZqZOXQ3uqvR2Kfzp
TLSH
T11A029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-0-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/1096-524-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/1096-525-0x00007FFF30BD0000-0x00007FFF30BE2000-memory.dmp

Download

memory/1096-504-0x00007FFF30BD0000-0x00007FFF30BE2000-memory.dmp

Download

memory/1096-2-0x0000000001F50000-0x0000000001F5C000-memory.dmp

Download

memory/1096-1-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/2844-558-0x0000018A21390000-0x0000018A213DE000-memory.dmp

Download

memory/2844-536-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-545-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-546-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-550-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-561-0x0000018A214B0000-0x0000018A2153A000-memory.dmp

Download

memory/2844-562-0x0000018A214B0000-0x0000018A2153A000-memory.dmp

Download

memory/2844-560-0x0000018A214B0000-0x0000018A2153A000-memory.dmp

Download

memory/2844-559-0x0000018A214B0000-0x0000018A2153A000-memory.dmp

Download

memory/2844-539-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-564-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-556-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-566-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-567-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-606-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-530-0x00007FFF38E50000-0x00007FFF38E52000-memory.dmp

Download

memory/2844-531-0x00007FFF16230000-0x00007FFF1674E000-memory.dmp

Download

memory/2844-544-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/2844-538-0x00007FFF38E60000-0x00007FFF38E62000-memory.dmp

Download

memory/2844-543-0x0000018A206A0000-0x0000018A20F77000-memory.dmp

Download

memory/4160-599-0x000001BFA14F0000-0x000001BFA1512000-memory.dmp

Download

memory/4160-607-0x000001BFA1620000-0x000001BFA162A000-memory.dmp

Download

memory/4160-603-0x000001BFA1560000-0x000001BFA1612000-memory.dmp

Download

memory/4160-602-0x000001BFA1540000-0x000001BFA155E000-memory.dmp

Download

memory/5740-586-0x000002935FA40000-0x0000029360317000-memory.dmp

Download

memory/5740-578-0x00007FFF38E60000-0x00007FFF38E62000-memory.dmp

Download

memory/5740-580-0x000002935FA40000-0x0000029360317000-memory.dmp

Download

memory/5740-587-0x00007FFF38E50000-0x00007FFF38E52000-memory.dmp

Download

memory/5740-585-0x000002935FA40000-0x0000029360317000-memory.dmp

Download

memory/5740-584-0x000002935FA40000-0x0000029360317000-memory.dmp

Download

memory/5740-576-0x000002935FA40000-0x0000029360317000-memory.dmp

Download

memory/5740-572-0x00007FFF16230000-0x00007FFF1674E000-memory.dmp

Download

memory/5740-583-0x000002935FA40000-0x0000029360317000-memory.dmp

Download