c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe
Size 683KB
Sample261024-jalgzsav2n
SHA256 c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061
MD5 17ae30d5879c0716433a5ef97b626912
SHA1 fdf13ad12b771b8344d3a19e4ab4753de8743ed2
SHA512 123366f44ca80c14b0f3ce705f77968596bc7b41ba12f0985e021d78928959c459df13b9bef19b08f942f72af5ad601b9d74b3531bc9007b24f088c55f0f645d
SSDEEP 12288:x/hFpTzDKSj5QMJXUGCfBjn3/Svi3PX9rUmKhWq:x/hFtz9tQMJbe3PNr/KhW
TLSH
T181E49E65A79402F9E0B7C278CE578902E77378450371A6EF03D196B25F276E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_f46cfa9aaf1c025c\mshdc.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_f46cfa9aaf1c025c\mshdc.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_7c5144127b6ada21\hdaudbus.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_7c5144127b6ada21\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3512	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2752	ipconfig.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{8F3C7966-92A8-4934-9091-D07558275903}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\System32\\dxdiagn.dll"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{9BD9B8F3-F7DE-4B9B-84BB-395098F28D54}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe
5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe
5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe
5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe
4192	dxdiag.exe
4192	dxdiag.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5360	wevtutil.exe
Token: SeBackupPrivilege	5360	wevtutil.exe
Token: SeDebugPrivilege	3512	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4192	dxdiag.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 5360	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	89
PID 5420 wrote to memory of 4192	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	91
PID 5420 wrote to memory of 2752	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	96
PID 5420 wrote to memory of 5124	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	98
PID 5420 wrote to memory of 2720	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	100
PID 5420 wrote to memory of 3268	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	102
PID 5420 wrote to memory of 1464	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	104
PID 5420 wrote to memory of 4804	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	106
PID 5420 wrote to memory of 3512	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	108
PID 5420 wrote to memory of 4432	5420	c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe	111

C:\Users\Admin\AppData\Local\Temp\c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe
"C:\Users\Admin\AppData\Local\Temp\c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Windows\System32\wevtutil.exe
  "C:\Windows\System32\wevtutil.exe" qe Application /q:"*[System[(EventID=1000 or EventID=1001 or EventID=1002) and TimeCreated[timediff(@SystemTime) <= 604800000]]]" /f:text /c:80 /rd:true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5360
- C:\Windows\System32\dxdiag.exe
  "C:\Windows\System32\dxdiag.exe" /dontskip /whql:off /t "C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\06_dxdiag.txt"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4192
- C:\Windows\System32\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe" /all
  2⤵
  - Gathers network information
  PID:2752
- C:\Windows\System32\route.exe
  "C:\Windows\System32\route.exe" print
  2⤵
  PID:5124
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" winhttp show proxy
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2720
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" interface tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3268
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" interface ipv4 show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1464
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" interface ipv4 show dnsservers
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ChildItem -LiteralPath $env:QIFAN_DIAGNOSTIC_SOURCE -Force | Compress-Archive -DestinationPath $env:QIFAN_DIAGNOSTIC_ARCHIVE -CompressionLevel Optimal -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -tf "C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801.zip"
  2⤵
  PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\ed902ee9a43ed5a7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 6783c2bfcb5c3774cc4da41285b9f1e4198f13da4bf37a72f3bc39958d9a1677
MD5 1125f4f67d59eff8fdecc600d5098597
SHA1 e90b8e0687244c1a8c936ed37707a45250cfa358
SHA512 62024e46586a45049090690825212f1c3b9443423635e1d50f1b6be4257635f1be2583dd9b8549aa7f59a9354df4f98a8e16ec6b2db66e691e1a2eba14dc616f
SSDEEP 3:7WHlGlll/l/lXp9ZjrPBY06ll0xeAXlZP:6H0dPBY0O8Xz
TLSH
T1C353124021C2021BC442033006C60740397412495393086142109230C49970100A12C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\ed902ee9a43ed5a7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\ed902ee9a43ed5a7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 960B
SHA256 ec3c1a143ffa5345e8f408fe6a5e52a164cb291b792cdd6b080cf9d110a511a8
MD5 457588a8703e9dcc0f3f903d88bdd47f
SHA1 b543b52cbfc5dde3d6b27c49d54b5262a0d2d30c
SHA512 6e6a4c68b7476f2e19b182e31879e2f83a1111587b9bc0135aa0247d488e3a4e91d706c722ef6c6195f16ae9f3e79a107e2744fec10950f4bc87fdc58c1a8dc5
TLSH
T1F7118C543BC72DB0E36674364029A2101212A10244D2D24885C088624E23204E021FA5
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_a4h2lxck.g1v.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a4h2lxck.g1v.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

XYG-Client-Diagnostics_20261024_082801.zip

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801.zip
Size 16KB
SHA256 03733f91e75dc53d01d6cd7eab173ccf2bad2762247cec9a5c022f6e9650c23c
MD5 ecfa7b889c5e309b7da70a3f2a62b4e3
SHA1 40dee6f32b69dd89148dcea7e8d7e54cf0a740af
SHA512 bbe19129142a001665b19d736084abb96c5379f933de9402fe86a99c11a2cf6156b64b1138bec193fbdb79ef639de1fafd7e897aa5bad9b9392a50e4d66c7520
SSDEEP 384:ue8mKcYxDC7eRN6u2zvGT8fv+xkiOXQ4859sK5BBqB:dKlwwAu2aamxqPe5B0
TLSH
T1A772AFC74A026488C55F2F34E921777F2D7CAD114575F35B3BA412DE6C804C22B9ADAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00_summary.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\00_summary.txt
Size 702B
SHA256 bfc20d5f31837f844468c18f2ab05e56b9902f23cd357c26bc086315304265a2
MD5 9de5d548200618b07d246ea6ee1201e5
SHA1 147619f1dfdb068351b7dac0cc3881f3f661348f
SHA512 0a04a924a53f184949401495c03ca0e4b30baf7f7efd391222b2f5ee1da94efeddae8ef3dde578768485152a57f8ae6a9fd4569e09e915d12781203b2c459fda
TLSH
T18A011029B791F24A08E082E3D2444F6DB5A79443E33690C802F3066DB940222648BED3
MD5 SHA1 SHA512 TLSH

Submit Download

01_system_display.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\01_system_display.txt
Size 892B
SHA256 0557804e5cee9312bd172e05ac40d5c058f49c9b543255f9eb138dfbb73ae96d
MD5 19432309d505f12af4ffeaf5f7f66ca1
SHA1 36b7064c655474bf472ff92222d17025b0ec93b3
SHA512 d840420c6fb519964f8ee5d5db26163a97842c785d5ad0d89e33a6a50700df5d5e30149b950982df64b98a977ea74f85eac814f69b11d566038db23727f83185
TLSH
T149116F1349A0802A332F6167DD2A4C4F40BDBA6A9533D498B2356FC40CC3F3797BB848
MD5 SHA1 SHA512 TLSH

Submit Download

02_process_windows.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\02_process_windows.txt
Size 76B
SHA256 0a54e3568c8d5c3e48fe867864d7968171c304541323cf4e8720a113e6dcac79
MD5 913bfcc51432fe6d8ca94d5f8340efe5
SHA1 d04719fa68ec6035ee127e20e4fd780961062723
SHA512 126ab00a22ddf14a60f22d8ef7864f8015dd2c5c8d0e9b53cfb274102117e1aea6df420e4c56573ef56b7bbf2c71c7df426c87bb50e00bca071000183cf891dd
TLSH
T1BAA00138B9576A801D94C28B610B2D0539AE358090136AA666CAB58A0409484598FCCE
MD5 SHA1 SHA512 TLSH

Submit Download

03_critical_files.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\03_critical_files.txt
Size 150B
SHA256 f341238154d7d01fa418049cb84d1e3473516ade0acd487dbf78a380d70c7588
MD5 b986bb98fce162f22be7534e17734b20
SHA1 6d30ac483f94fe58b2b70f780dbf1da4afef9eaa
SHA512 334741876928e94f9998a73363bde72955b88bdb21788fbabbd756d991197e41e758b1597a10a120af4c3de70e13110d6fdf5fbf37306b915d87620850be77e6
TLSH
T16BC08CC2612249520129106486AA0619B2C0831C2E87D6501B970481B28255C02DBA2B
MD5 SHA1 SHA512 TLSH

Submit Download

04_startup_stage.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\04_startup_stage.txt
Size 65B
SHA256 bc690fb1bec899bf1cf5efcfdffb730dab5ab774dc51f6289d6cec722db424a2
MD5 d63b190c0e8fbf0fc398d46206f5883a
SHA1 6531df5a7b08e1ca4513d768c49a25192d3c3f08
SHA512 55386438036cd4dc85aeef2c91ab0bc633c7958b74dbb873c2a1a3112687dc835ac1b2c6870cfb1d5fc2b6f542b06054f470cfb0b337b6376d528e27cd822669
TLSH
T14AA022CC30C0AA0B2EA000F008E8002AF2E0C0CA22C033EB000208228008008BC0880A
MD5 SHA1 SHA512 TLSH

Submit Download

05_windows_application_events.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\05_windows_application_events.txt
Size 71B
SHA256 dfb5fe7e449c594331982cfd3c783df6cf25d0da0c1ca2adef2c83d9fc3f4532
MD5 5f585fdaaf01f9c1f2fad220961bcc2b
SHA1 b342b1a892c97aff317f5ac09107ff6fd516107e
SHA512 6bacbb50e399047b99fe4d1e29daf579838bbf1a43da1904902ccac4ffe6f19f95dc3db4502044ccd2a565c57cd18e3be142095fdfabebf0de1620cf559f1e95
TLSH
T1ADA02203C028080ECB08003C02B280322002AAEB3A230CE0F083030FFCA088880C2CA0
MD5 SHA1 SHA512 TLSH

Submit Download

06_dxdiag.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\06_dxdiag.txt
Size 84KB
SHA256 d30ef4ea3218bf2cd7d7c384639ed80bddaf660802dcfe2313fcee027e03264f
MD5 d49c453ede01faed3f912b43d28b92be
SHA1 f12d080313947ebbe8bce890fbe18f33c8e7a038
SHA512 298bb13ec24d2fc73ee819dcfd59f6d70f36dffd8e9e316986fc541e357e0c380ffe76e7abe641886e8a8ca3022891a74384953313635f034bff172c6ea4728a
SSDEEP 768:V0M1QZHKBV0We4VBKiEnfTMv5y90+WtGuhdrfkNEr+aL/FKJLBKwY0:VVBCfwvm0d6LC0
TLSH
T18B83A9FA6C41C454F052C156A2787626DA1D34D320E98DED3BBCEBC90F229EAD27CE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07_display_update_evidence.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\07_display_update_evidence.txt
Size 247B
SHA256 e32b876f862cb0be0bb88e7fc966e96be83b9e88432efc6e0df022b190df1b49
MD5 26a4d4964e52bc841481476d2b8ed94a
SHA1 19873f782c1e52e23f83586fe0ff916cbeb7eca3
SHA512 1f5208285c9420531d5cafc14fd9d7eb8c21cc5a0e8600a266b23262cd66a1103022e9e9e7d5c3820a4496eb896d67b9732f3f915a6d13a9f39c1a3644fe1691
TLSH
T193D09591453FE549955C4011179D81EFE3311D78D443775405404D50BC9D525D031314
MD5 SHA1 SHA512 TLSH

Submit Download

08_collection_manifest.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\08_collection_manifest.txt
Size 201B
SHA256 fab3a0e13be7c7257b7e79a87e3a23c3c73b2f80e1de85e8485da12833ba5cfd
MD5 55f90efacb9f6767c751e5153f9d6504
SHA1 5dfde97d4bbc3143a20b9e86298284fd96c67b46
SHA512 d894f46278eb4daecec9a5d80c55799b550b42d39f173f61525780e6e68368cdc1ed901358cd3d5719046551605ceb31dd730757d7500f8682da01859ce58a66
TLSH
T180D022296329BA84B8024BF17B7808BD50243A1A9718208E33B005FE2D42413300D71C
MD5 SHA1 SHA512 TLSH

Submit Download

09_final_config_snapshot.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\09_final_config_snapshot.txt
Size 195B
SHA256 215d615c7c9f73e8058363884db2ed055d11db8cc1b2e87c2fa9a6b72fb07f51
MD5 c8094d9413cefc1cb631896f94d975a5
SHA1 fe8c914f9bb58e33926ed1a41cf7f8b9a68321b9
SHA512 6d2d77708cc2f78289341750d3f07d477dd24a75837c6116e74ee1d5fac86bffb80e5fa0355cd7164c5f4a6bc4dc8059f46acdcfa464ac189fde7dfc4e8689a9
TLSH
T140D0228A0A1EF5C2906D40A3430646ABA54385428FA00B507F3652AC5CEC8E1000B328
MD5 SHA1 SHA512 TLSH

Submit Download

10_network.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\10_network.txt
Size 563B
SHA256 b35a71a8b2bf04ebd7662b91f7ad13e6b8d423911f1e668d4a8d16d2457899a1
MD5 7d786b0cb7e2eb99a70ca047c7e3e4bd
SHA1 4fc1428cf53f570cbc35f847e4d2b7f143217143
SHA512 66eb6b7a4b58f452b13467a90385249a6cc7e7cdbdd31eea860eccc3610ce0514349999eff16f23272d5f0514e3af7a8b56a469e01ea04d82073c17c6ecec47e
TLSH
T1D1F0C2BF463E79D445E606B8EA24768E6CC81D13DBBD04DD399123EA5E4015638485E2
MD5 SHA1 SHA512 TLSH

Submit Download

dxdiag_command.log

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\dxdiag_command.log
Size 41B
SHA256 99257db1f470b67aca2d989d2133d1b7a5893119e874a2f48cf2f31eb714ea37
MD5 aaec13afe1cb519a226e056f7700f383
SHA1 65cfbf1edb0c3b06d3e712932786a92918bac715
SHA512 b576852850450c959b9172485c87fc58bcf505b94165b3c520780c59cd6d83213e987fa27fea3a26b6acd4e3787911e1a8330c0dc74411f01ba27461532333e3
MD5 SHA1 SHA512

Submit Download

ipconfig_all.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\network_evidence\ipconfig_all.txt
Size 1KB
SHA256 7ed1c75ba1bf3429d351e46a893ea4fdc0b62f175f23e417a291bb4ba836661d
MD5 0b29634fbfb5294b2d3729d543f922cb
SHA1 7f428e486955352ba668c49fb2a70932d210c820
SHA512 41e08689f0c8212d070b84cc987844cec317f4cbe2a7b754aabaa0fc2f9547928d082dffd38a8206bcb427393d13963528aaf85877674d3d862e2d04911c99ac
TLSH
T12211C99806E4F00377BB86011CA9A732E1E44D938003E5A0BDADA548BC322F0E7819A3
MD5 SHA1 SHA512 TLSH

Submit Download

ipv4_dnsservers.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\network_evidence\ipv4_dnsservers.txt
Size 319B
SHA256 0c4fab51ae15d6dabc34411d0069e82d4a8cf65727257144bc0b4042e7acc4bf
MD5 269282fa777118328144e671a4507384
SHA1 1be9beae464a9b51a4f9f732e6f80d1bab5ce938
SHA512 f4bedc1ee0875d7bc085679ba62eab26d1bf314a2b664fd84b95c03df3d654c2bc67ff441556e955b55bea3b9ba82e5501f82459b66a6c1f39d6594945377d28
TLSH
T1B2E0C20708033C438CE167870C029CB0BDB7A12A051E982AB12EA2851FDA0FFC7081EE
MD5 SHA1 SHA512 TLSH

Submit Download

ipv4_interfaces.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\network_evidence\ipv4_interfaces.txt
Size 264B
SHA256 b2c288205aa1096fc1c59ec622fbc6e88718f4892b7a6445df41bfc90ceaf35c
MD5 0fb5b40d23531be60ffe6d02c4b1d9fb
SHA1 d16e6d87022d1976846c087a60f6e004690c6147
SHA512 80f5ebbecea8ccbf19dbf20bd94200b3a356ebb66df66b92f3932333b2c068029fb8c5760e9493061d7226ad871b77105da81b07a8e570e3ce9c878c460f495b
TLSH
T182D012032C19AA0040E0D3B338A62E13CC3700136B10018C72EC1705679B382FA8EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

route_print.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\network_evidence\route_print.txt
Size 2KB
SHA256 8c81c6ce3ae16b9d0dac850eda687346400866fe69ac95d94cbe96e8e81ba966
MD5 a9a425a78d8bb826f5743a459e3eabbf
SHA1 0072da40bb36f897ef2a5e31623ce7cf80f6fa51
SHA512 a23efe006473b61109e7db51e4366321fc1460b2e93efcca540d1ff1c7221f9d493f35781e211c27bedc61a7ad7fa997625df519d5dec83556b72e20d9f82585
TLSH
T113416BEB0A263996287FCAC580654E21C97EDC1B52376413F0BF5EF9CB60B0D7B9A014
MD5 SHA1 SHA512 TLSH

Submit Download

tcp_global.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\network_evidence\tcp_global.txt
Size 764B
SHA256 8ecbe9f1ca8c7a4c93caff3685cce8fe46063caa0e9448fdfe18eb2a07b4e8ae
MD5 7660dae7a7f46eb554eb726e7d0f14a7
SHA1 8ba2c06cf97c2d170f985d0230de041db4c98c00
SHA512 2864fbaf3059f17933ba5ffc86511b336b5b19c85c686c9730a8cbd14107f794d3c50ae485cd14436d06e56a734177ad940e301136e1c0e6c6357a59524f5d98
TLSH
T1CE0122362DC175371AA1C901A6A50636C429BD413712B4A1345D67BC1F0728E33FEC67
MD5 SHA1 SHA512 TLSH

Submit Download

winhttp_proxy.txt

Path C:\Users\Admin\Desktop\XYG-Client-Diagnostics_20261024_082801\network_evidence\winhttp_proxy.txt
Size 80B
SHA256 62cbddb57a841c58cef5aec0972f657856fd30bcda735741234d3dacdf7d0a80
MD5 85b2d921b383d42381eab3adf51abd0c
SHA1 4e14de8fe5e4100f9c9e8219aa6a7b8f42955b65
SHA512 e4b0b92119522a341812e3458428e924963f8d4d146bedc9206c751b48d549157c3b8307e7f356a49d741241834819a89539be2b55839160009601b065c4d306
TLSH
T1D7A01122A80A000AC8BC0E3A0E22032CB30E000B2008A00038C002C00EA00CA88000EE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3512-117-0x00000202D3190000-0x00000202D31B2000-memory.dmp

Download

memory/3512-124-0x00000202D3430000-0x00000202D343A000-memory.dmp

Download

memory/3512-146-0x00000202BA630000-0x00000202BAFD4000-memory.dmp

Download

memory/3512-120-0x00000202D3430000-0x00000202D344E000-memory.dmp

Download

memory/3512-121-0x00000202D3450000-0x00000202D3502000-memory.dmp

Download

memory/3512-123-0x00000202D3670000-0x00000202D3682000-memory.dmp

Download

memory/3512-122-0x00000202D3510000-0x00000202D351A000-memory.dmp

Download

memory/4192-6-0x000001CC9FD00000-0x000001CC9FD01000-memory.dmp

Download

memory/4192-15-0x000001CC9FD00000-0x000001CC9FD01000-memory.dmp

Download

memory/4192-14-0x000001CC9FD00000-0x000001CC9FD01000-memory.dmp

Download

memory/4192-17-0x000001CC9FD00000-0x000001CC9FD01000-memory.dmp

Download

memory/4192-13-0x000001CC9FD00000-0x000001CC9FD01000-memory.dmp

Download

memory/4192-12-0x000001CC9FD00000-0x000001CC9FD01000-memory.dmp

Download

memory/4192-16-0x000001CC9FD00000-0x000001CC9FD01000-memory.dmp

Download

memory/4192-8-0x000001CC9FD00000-0x000001CC9FD01000-memory.dmp

Download