48d514c5f9ac54a9e0619ddb63bc3cd914016a2aab7d65e31084c62488261748

Analysis

max time kernel
151s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261024-2pv9vasw2p
SHA256 48d514c5f9ac54a9e0619ddb63bc3cd914016a2aab7d65e31084c62488261748
MD5 3d18ec2ae8bcd1f751a2931aa607961c
SHA1 f19953e52550b25891f2c0459c809c363572271c
SHA512 ce619c5d9613dd9fff37ffd20a67849a9cfb4a65e7471ae422624822a6fd5e362ac0bfe85ccf5623827c085252d4bf92392baa08ed2405105ad5292763d7c8fa
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXc:q6chqTShW/hNbSiQfMJPLmrUlsc
TLSH
T12D97D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\wbeGzb = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5788	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3992	RFaAwi.exe
568	RFaAwi.exe

Loads dropped DLL 4 IoCs

pid	Process
3992	RFaAwi.exe
3992	RFaAwi.exe
568	RFaAwi.exe
568	RFaAwi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\wbeGzb\\RFaAwi.exe\""	RFaAwi.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3220	cmd.exe
4300	cmd.exe
4508	cmd.exe
1640	cmd.exe
2620	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	RFaAwi.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\pL9WWt	RFaAwi.exe
File created	C:\Program Files (x86)\pL9WWt\pL9WWt.exe	RFaAwi.exe
File created	C:\Program Files (x86)\pL9WWt\XPSPLOG.dll	RFaAwi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1668	cmd.exe
1260	cmd.exe
1140	cmd.exe
5920	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RFaAwi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RFaAwi.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1168	schtasks.exe
2060	schtasks.exe
3996	schtasks.exe
5880	schtasks.exe
1720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
5976	install.2.0.02.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe
3992	RFaAwi.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeIncreaseQuotaPrivilege	5788	powershell.exe
Token: SeSecurityPrivilege	5788	powershell.exe
Token: SeTakeOwnershipPrivilege	5788	powershell.exe
Token: SeLoadDriverPrivilege	5788	powershell.exe
Token: SeSystemProfilePrivilege	5788	powershell.exe
Token: SeSystemtimePrivilege	5788	powershell.exe
Token: SeProfSingleProcessPrivilege	5788	powershell.exe
Token: SeIncBasePriorityPrivilege	5788	powershell.exe
Token: SeCreatePagefilePrivilege	5788	powershell.exe
Token: SeBackupPrivilege	5788	powershell.exe
Token: SeRestorePrivilege	5788	powershell.exe
Token: SeShutdownPrivilege	5788	powershell.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeSystemEnvironmentPrivilege	5788	powershell.exe
Token: SeRemoteShutdownPrivilege	5788	powershell.exe
Token: SeUndockPrivilege	5788	powershell.exe
Token: SeManageVolumePrivilege	5788	powershell.exe
Token: 33	5788	powershell.exe
Token: 34	5788	powershell.exe
Token: 35	5788	powershell.exe
Token: 36	5788	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 5788	3992	RFaAwi.exe	93
PID 3992 wrote to memory of 4300	3992	RFaAwi.exe	95
PID 4300 wrote to memory of 3996	4300	cmd.exe	97
PID 4300 wrote to memory of 1772	4300	cmd.exe	98
PID 4300 wrote to memory of 1900	4300	cmd.exe	100
PID 3992 wrote to memory of 4508	3992	RFaAwi.exe	103
PID 4508 wrote to memory of 5880	4508	cmd.exe	107
PID 4508 wrote to memory of 3332	4508	cmd.exe	108
PID 4508 wrote to memory of 3820	4508	cmd.exe	110
PID 3992 wrote to memory of 1640	3992	RFaAwi.exe	111
PID 1640 wrote to memory of 1720	1640	cmd.exe	113
PID 3992 wrote to memory of 2620	3992	RFaAwi.exe	114
PID 1640 wrote to memory of 5504	1640	cmd.exe	116
PID 1640 wrote to memory of 4480	1640	cmd.exe	120
PID 2620 wrote to memory of 1168	2620	cmd.exe	121
PID 3992 wrote to memory of 3220	3992	RFaAwi.exe	122
PID 3220 wrote to memory of 2060	3220	cmd.exe	124
PID 2620 wrote to memory of 2572	2620	cmd.exe	125
PID 3220 wrote to memory of 3948	3220	cmd.exe	126
PID 2620 wrote to memory of 5236	2620	cmd.exe	128
PID 3220 wrote to memory of 1044	3220	cmd.exe	129
PID 1260 wrote to memory of 2108	1260	cmd.exe	132
PID 1140 wrote to memory of 1536	1140	cmd.exe	133
PID 5920 wrote to memory of 2732	5920	cmd.exe	134
PID 1668 wrote to memory of 876	1668	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:792

C:\Users\Public\wbeGzb\RFaAwi.exe
"C:\Users\Public\wbeGzb\RFaAwi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\wbeGzb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\wbeGzb\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3332
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1168
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1044

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\wbeGzb" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\wbeGzb" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:876

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1492

C:\Users\Public\wbeGzb\RFaAwi.exe
"C:\Users\Public\wbeGzb\RFaAwi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2108

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1536

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 e253546561c6984faea369628f4b0f0b80ae2dac8370e36883ca90551458b829
MD5 4d01c650f544282519b30da801b484ab
SHA1 d6547b81e855fd2b888657afc9ce07c6176e1e42
SHA512 77a2a7cc41fca4b7e35b487b3ff135930c75262764688edf1e2f413a376da79292435647554cef29cabdb8627c805e50bf7e1362bfa67c933d6a75d3b80cdad9
TLSH
T1EF31C97A1FBD7D838F368D9112CDA1251DFDA1901CCE04565141C569DF043F25E8AD0D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 9bbb89221f1bf278d8da8d8a138dd8fe74ddcaa5124f0f0cece258179d9107eb
MD5 d9090e44f14b2054fb6806f32bdef506
SHA1 9da7678e027e32e444ddbf9e11f4cb10e83a6be1
SHA512 0bfaf79d0808b11dcd54901c05793bc8a39f99071c399c17e178c910ede113b72e2aa9f70469a85b9c7c827d4766bf4f6ec5dda774fad35ff2208d51a042c67b
TLSH
T1AC31D69A8E3A0056EB0D8F7552C0D13BACF19574ACE84888657ED73F5A05FB79FCA400
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 d25c9748e91d92081df39ea1886e01d5725c0ac10fcfbd5d771f93547ac4b5e6
MD5 37b76a8c290fb29d6db3881687f4e28a
SHA1 d3db77f0261884db081c71d5b935c3f07ac066b9
SHA512 851389da4bb91a08bfccce10414f26940f0c5c2a0ddedcdd7f1201e3b23f2e837eb1329d82707e4bb2dd9886fc64753c3c50c77ab2232e58254ad6d15f4463bc
TLSH
T17BF0272858BC816DF432DA3CCFDB36AA1AAFFE04241681A807A54709B553E02AD5167E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 4092ebe8d86a3b9e531914add60f9858e107f8d4ec516f9f9031c25ac72ca153
MD5 b60cbc538b3a814475e8be1ad6fb4cee
SHA1 80c737bde94841c411221181a8375b6ae1f9aa8d
SHA512 61bc1aa854e4769c5a358758039005312e8b6b854533a79e009cbeb940a046d6bd42a0bb72972dc7e3f5e25b22246232f6d973ee9068ee806fd8c39e842b8c25
TLSH
T190F05C2926E9601FF07BD6B48EEB7B711A69FA22202792BE0AA903045B59D045C4177D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dwdnrl53.wkw.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dwdnrl53.wkw.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

RFaAwi.exe

Path C:\Users\Public\wbeGzb\RFaAwi.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\wbeGzb\UxEnhance64.dll
Size 3.1MB
SHA256 4fe771b3d019cd4152323eae4b94c7567b4ba8b4475114fe20b669e83ea97c57
MD5 c81a73dc6a91cf8fa4cf726e20abaf8a
SHA1 78a028191dded046d06c5bbfefc95eb01f3f12e6
SHA512 bbeee269f0457075927c882cac91a28a08c41c1f7cbd2c6b445ad978eb8bc3952d0badc0c3d02f01563ee84b35fd87c08d0cd016dca470dbb70a254e069e6285
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+j:P9m29xx3Tiqt06ox6+z2rNNrKoj
TLSH
T170E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\wbeGzb\adoresd.dat
Size 4.8MB
SHA256 7a967e0040b7b8b7b31b3cbb2d90ad7cebc77592f6d3779276ead573776e55a1
MD5 654c33cf3fd7b5dc381cc8eeabcda44c
SHA1 3efae5741b369cb0bffff4de11be7a7ecaf7f1f5
SHA512 b5b0159d76bae3ff553572031dfcccb230cda62a2bfcbddd4c79c410199a2142e7bdbbd03cd99d9d42a528912986318bd5cbd29c784eee29b2fe277d7029dc04
SSDEEP 98304:SWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:SWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1453633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\wbeGzb\msadox.tb
Size 8KB
SHA256 4fe47efa98520760bd5e2ea7021f5f9022a0b6fc4ea92537ae5de2fc60b3f34a
MD5 4d4b19cccf173980926748330363a5d2
SHA1 00e1a2ef709a330afb04496a4d1e2f1a978bd939
SHA512 3ba5049e8d032753694f65100f91e17a00f70568bb1598ace548798cc17c37c626539e9c8aa3f70ee2a7b9647e1182063acc60ebd401e6f4010db0379d5a707f
SSDEEP 192:bqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:bsZqZOXQ3uqvR2Kfzp
TLSH
T1FA029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C1670B2DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-599-0x000001BE10DD0000-0x000001BE116A7000-memory.dmp

Download

memory/568-597-0x000001BE10DD0000-0x000001BE116A7000-memory.dmp

Download

memory/568-600-0x00007FF992790000-0x00007FF992792000-memory.dmp

Download

memory/568-592-0x000001BE10DD0000-0x000001BE116A7000-memory.dmp

Download

memory/568-591-0x00007FF9927A0000-0x00007FF9927A2000-memory.dmp

Download

memory/568-587-0x000001BE10DD0000-0x000001BE116A7000-memory.dmp

Download

memory/568-584-0x000001BE0E4C0000-0x000001BE0E9DE000-memory.dmp

Download

memory/568-583-0x00007FF992790000-0x00007FF992792000-memory.dmp

Download

memory/568-596-0x000001BE10DD0000-0x000001BE116A7000-memory.dmp

Download

memory/568-598-0x000001BE10DD0000-0x000001BE116A7000-memory.dmp

Download

memory/568-601-0x000001BE0E4C0000-0x000001BE0E9DE000-memory.dmp

Download

memory/3992-540-0x000002C0B0430000-0x000002C0B0D07000-memory.dmp

Download

memory/3992-542-0x00007FF9927A0000-0x00007FF9927A2000-memory.dmp

Download

memory/3992-567-0x000002C0B1190000-0x000002C0B121A000-memory.dmp

Download

memory/3992-566-0x000002C0B1190000-0x000002C0B121A000-memory.dmp

Download

memory/3992-565-0x000002C0B1190000-0x000002C0B121A000-memory.dmp

Download

memory/3992-563-0x000002C0B0D50000-0x000002C0B0D9E000-memory.dmp

Download

memory/3992-572-0x000002C0B0430000-0x000002C0B0D07000-memory.dmp

Download

memory/3992-564-0x000002C0B1190000-0x000002C0B121A000-memory.dmp

Download

memory/3992-556-0x000002C0B0430000-0x000002C0B0D07000-memory.dmp

Download

memory/3992-553-0x000002C0ADB50000-0x000002C0AE06E000-memory.dmp

Download

memory/3992-549-0x000002C0B0430000-0x000002C0B0D07000-memory.dmp

Download

memory/3992-550-0x000002C0B0430000-0x000002C0B0D07000-memory.dmp

Download

memory/3992-548-0x000002C0B0430000-0x000002C0B0D07000-memory.dmp

Download

memory/3992-561-0x000002C0B0430000-0x000002C0B0D07000-memory.dmp

Download

memory/3992-543-0x000002C0B0430000-0x000002C0B0D07000-memory.dmp

Download

memory/3992-547-0x000002C0B0430000-0x000002C0B0D07000-memory.dmp

Download

memory/3992-534-0x00007FF992790000-0x00007FF992792000-memory.dmp

Download

memory/3992-535-0x000002C0ADB50000-0x000002C0AE06E000-memory.dmp

Download

memory/5788-605-0x0000015DA8D00000-0x0000015DA8D22000-memory.dmp

Download

memory/5788-611-0x0000015DA8FD0000-0x0000015DA8FEE000-memory.dmp

Download

memory/5788-612-0x0000015DA8FF0000-0x0000015DA90A2000-memory.dmp

Download

memory/5788-614-0x0000015DA8DB0000-0x0000015DA8DBA000-memory.dmp

Download

memory/5976-0-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/5976-526-0x00007FF98C0D0000-0x00007FF98C0E2000-memory.dmp

Download

memory/5976-525-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/5976-503-0x00007FF98C0D0000-0x00007FF98C0E2000-memory.dmp

Download

memory/5976-1-0x0000000001F50000-0x0000000001F5C000-memory.dmp

Download