89db2a7d2d642a5db63c6a516c1cba379c6774120629e52b45bfe7b68417c8b0

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.03.exe
Size 30.5MB
Sample261024-bf2gdswt6r
SHA256 89db2a7d2d642a5db63c6a516c1cba379c6774120629e52b45bfe7b68417c8b0
MD5 678bb62c968f2d484ead52636cb7ea15
SHA1 5a20409a78c298c8e9c6f1209d1aa1935afc7971
SHA512 4cb15caf6c68e4865a14e8dd4f5768320d482e60156f7bfa0d7d44c606abc5115cc15c803cfd8d2a7a059ae43f14fcaf9ad451617fae45e9e3fd104951c83281
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY1:YC/p+HuPOc40
TLSH
T16267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\G04JOT = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1744	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
6020	SzrROK.exe
5516	SzrROK.exe

Loads dropped DLL 2 IoCs

pid	Process
6020	SzrROK.exe
5516	SzrROK.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\G04JOT\\SzrROK.exe\""	SzrROK.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1128	cmd.exe
5044	cmd.exe
3012	cmd.exe
4360	cmd.exe
2764	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	SzrROK.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\DA2HkS	SzrROK.exe
File created	C:\Program Files (x86)\DA2HkS\DA2HkS.exe	SzrROK.exe
File created	C:\Program Files (x86)\DA2HkS\XPSPLOG.dll	SzrROK.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1348	cmd.exe
2456	cmd.exe
3820	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SzrROK.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SzrROK.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2032	schtasks.exe
3824	schtasks.exe
5052	schtasks.exe
5128	schtasks.exe
1320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
972	install.2.0.03.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe
6020	SzrROK.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeIncreaseQuotaPrivilege	1744	powershell.exe
Token: SeSecurityPrivilege	1744	powershell.exe
Token: SeTakeOwnershipPrivilege	1744	powershell.exe
Token: SeLoadDriverPrivilege	1744	powershell.exe
Token: SeSystemProfilePrivilege	1744	powershell.exe
Token: SeSystemtimePrivilege	1744	powershell.exe
Token: SeProfSingleProcessPrivilege	1744	powershell.exe
Token: SeIncBasePriorityPrivilege	1744	powershell.exe
Token: SeCreatePagefilePrivilege	1744	powershell.exe
Token: SeBackupPrivilege	1744	powershell.exe
Token: SeRestorePrivilege	1744	powershell.exe
Token: SeShutdownPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeSystemEnvironmentPrivilege	1744	powershell.exe
Token: SeRemoteShutdownPrivilege	1744	powershell.exe
Token: SeUndockPrivilege	1744	powershell.exe
Token: SeManageVolumePrivilege	1744	powershell.exe
Token: 33	1744	powershell.exe
Token: 34	1744	powershell.exe
Token: 35	1744	powershell.exe
Token: 36	1744	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 1744	6020	SzrROK.exe	94
PID 6020 wrote to memory of 5044	6020	SzrROK.exe	96
PID 5044 wrote to memory of 3824	5044	cmd.exe	99
PID 6020 wrote to memory of 3012	6020	SzrROK.exe	100
PID 5044 wrote to memory of 5900	5044	cmd.exe	103
PID 3012 wrote to memory of 5052	3012	cmd.exe	104
PID 5044 wrote to memory of 2500	5044	cmd.exe	106
PID 3012 wrote to memory of 3380	3012	cmd.exe	108
PID 6020 wrote to memory of 4360	6020	SzrROK.exe	109
PID 3012 wrote to memory of 3844	3012	cmd.exe	112
PID 4360 wrote to memory of 5128	4360	cmd.exe	113
PID 6020 wrote to memory of 2764	6020	SzrROK.exe	115
PID 4360 wrote to memory of 1504	4360	cmd.exe	117
PID 2764 wrote to memory of 1320	2764	cmd.exe	119
PID 4360 wrote to memory of 6044	4360	cmd.exe	120
PID 2764 wrote to memory of 4952	2764	cmd.exe	121
PID 2764 wrote to memory of 3452	2764	cmd.exe	122
PID 6020 wrote to memory of 1128	6020	SzrROK.exe	124
PID 1128 wrote to memory of 2032	1128	cmd.exe	126
PID 1128 wrote to memory of 3564	1128	cmd.exe	127
PID 1128 wrote to memory of 3684	1128	cmd.exe	129
PID 2456 wrote to memory of 1268	2456	cmd.exe	132
PID 3820 wrote to memory of 3908	3820	cmd.exe	133
PID 1348 wrote to memory of 4496	1348	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5068

C:\Users\Public\G04JOT\SzrROK.exe
"C:\Users\Public\G04JOT\SzrROK.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\G04JOT\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\G04JOT\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5900
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5052
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3380
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1320
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4952
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3564
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3684

C:\Users\Public\G04JOT\SzrROK.exe
"C:\Users\Public\G04JOT\SzrROK.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5516

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\G04JOT" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\G04JOT" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3908

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4860

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4496

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 0c0c7b6ffee9f2f1b7d688b2c57db7c9638ba814f36d7a1bdb98f5458cc13c84
MD5 e1c9fd3a58e9cd0ba15f2afabb923e33
SHA1 e62d960122b34f20232f225e537867420ea3ce8a
SHA512 cdc89328de1cab934d2e0fdfae08cef1e9a3c663ed9fc73dae84225ccc36472bcc1b584c4e281408bb321f89640f700031e9a4ba430bc1e279e7ae1bb3cc87ed
TLSH
T1D831A4BB1B7DB8828F3A8DA015C5B1261CF4E2905DC9049A6204C494AE443B36E4D50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 ed554e72a01aa79c2323459e088d096adf8b596813e399bce19cc91cb71a945b
MD5 b11eb48609e43bb71268b7a753ab14d0
SHA1 f30cf88d9b53164af5ca99d9493d7f7462a0dbbd
SHA512 5658b7ac0599235a65f6b6fed35d70ee96dbab4933ff8abf950792b45dc5ca7a755c3ca100a1bc12291371eac17dd009f4f77b92eba7f2e55712be7581302e39
TLSH
T11731B6A3993500079F0C5F7A56C8D63BADF1A5B15CE40C552A2EC2AA1A09BB75FC9440
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 6dc08df344207974157d34e7932ce7da368f8e9ee9fadac04533f8c06eb42f26
MD5 84f8e51aa14d64051637dafac794af11
SHA1 0d06844364b800cc7f413d716aec86237e60a1b3
SHA512 ae8a3ea78ce7e58c69c15638f1cfeb2fafce49231d52dd8a6a23be162da2d1ac053aafc5065f20d84ae92f67cada4f32d244a7819d56789faf7a2ec4f55d5d97
TLSH
T1F2F05C0C05B8412EF173DE3C87DD399A166FFB172413459406F44B0D62169853D53576
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 607054150b4e2d02c9bd656f3fdc76f26f28b57f6df809ceb0fae235bf26d608
MD5 b730bdbfd49870d571f3f375083c01fd
SHA1 3eb032a53c29c3d6aac59ca33738cc6b1cccc130
SHA512 cd49dbf75ed84e7afc7ab9053509b5c50ee39409cfe9a125e56382f982425d24b526f12702cbd1cf71eac79b797ebb64639f104afba0e1ab27ec009828375edf
TLSH
T109F0DC384AE8023BF03BA6F587C235B15D26E5220007627B19B903942E50C451CD266A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dfmfzhcn.f1v.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dfmfzhcn.f1v.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SzrROK.exe

Path C:\Users\Public\G04JOT\SzrROK.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\G04JOT\UxEnhance64.dll
Size 3.1MB
SHA256 1a7e9361e591e537019b024af8331b6eeac4a21d32d938796d229d54461e77d1
MD5 0c3e88b4f27eb61f48e09edf870d8b67
SHA1 547c93ea7deaeb41ca32e4e275048508fc887205
SHA512 16879e0bfbe57919b5816745b88a93e0c88ec6aace414bf9be28f552dee922d77085592d8f730bb38a48bc145e9287686e0ed7c20d6aa3ce580cd0988c04d510
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+e:P9m29xx3Tiqt06ox6+z2rNNrKoe
TLSH
T1E8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\G04JOT\adoresd.dat
Size 4.8MB
SHA256 b19a52c87057cf3c5792e13f548e11abc486b84d0b41eab6607221386922ff22
MD5 018098521f6f1cc73c4896f74c47f271
SHA1 8fe9a2ac039a5b39e042dca54225d719c2c75caf
SHA512 acdaf55ca5346250fa93c33ea29088bf2522747ef453f30ed24e4564e6545952e28210d7b0a6846f752b4a2bba04691e75a0e4c9cb1cd2821ccda68a043e52eb
SSDEEP 98304:tWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:tWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1753633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\G04JOT\msadox.tb
Size 8KB
SHA256 153315d6b4e5335d84e0cd12ffcd225db3936680e10755534e8d100eca370f5f
MD5 0952774276e005fe8ec63d3c7a8fe47c
SHA1 f6f2e473e28506708bc55c1f732099ba6b1fc6e5
SHA512 62fdad6334435d964ece8de33a29ccfe356f7202b7d8a43c6e17e25a420c99308909ded787c3181f9436dc9809ddbec046fcaf06a90bb63ca7f3c5846a3b88e1
SSDEEP 192:8qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:8sZqZOXQ3uqvR2Kfzp
TLSH
T159029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/972-0-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/972-525-0x00007FF9B61E0000-0x00007FF9B61F2000-memory.dmp

Download

memory/972-524-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/972-504-0x00007FF9B61E0000-0x00007FF9B61F2000-memory.dmp

Download

memory/972-2-0x00000000004E0000-0x00000000004EC000-memory.dmp

Download

memory/972-1-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/1744-607-0x000001CBF4360000-0x000001CBF436A000-memory.dmp

Download

memory/1744-602-0x000001CBF4320000-0x000001CBF4342000-memory.dmp

Download

memory/1744-605-0x000001CBF4370000-0x000001CBF438E000-memory.dmp

Download

memory/1744-606-0x000001CBF4610000-0x000001CBF46C2000-memory.dmp

Download

memory/5516-578-0x00007FF99C000000-0x00007FF99C51E000-memory.dmp

Download

memory/5516-584-0x00000202AB410000-0x00000202ABCE7000-memory.dmp

Download

memory/5516-593-0x00000202AB410000-0x00000202ABCE7000-memory.dmp

Download

memory/5516-594-0x00000202AB410000-0x00000202ABCE7000-memory.dmp

Download

memory/5516-595-0x00007FF9BEC10000-0x00007FF9BEC12000-memory.dmp

Download

memory/5516-592-0x00000202AB410000-0x00000202ABCE7000-memory.dmp

Download

memory/5516-591-0x00000202AB410000-0x00000202ABCE7000-memory.dmp

Download

memory/5516-586-0x00007FF9BEC20000-0x00007FF9BEC22000-memory.dmp

Download

memory/5516-587-0x00000202AB410000-0x00000202ABCE7000-memory.dmp

Download

memory/6020-565-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-559-0x000001F4E5FB0000-0x000001F4E5FFE000-memory.dmp

Download

memory/6020-547-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-546-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-545-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-544-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-568-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-567-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-557-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-551-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-560-0x000001F4E63E0000-0x000001F4E646A000-memory.dmp

Download

memory/6020-561-0x000001F4E63E0000-0x000001F4E646A000-memory.dmp

Download

memory/6020-563-0x000001F4E63E0000-0x000001F4E646A000-memory.dmp

Download

memory/6020-562-0x000001F4E63E0000-0x000001F4E646A000-memory.dmp

Download

memory/6020-540-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-539-0x00007FF9BEC20000-0x00007FF9BEC22000-memory.dmp

Download

memory/6020-537-0x000001F4E55E0000-0x000001F4E5EB7000-memory.dmp

Download

memory/6020-532-0x00007FF99C000000-0x00007FF99C51E000-memory.dmp

Download

memory/6020-531-0x00007FF9BEC10000-0x00007FF9BEC12000-memory.dmp

Download