eb7ca9cc7e0aaae1d0604818118723c94bc6073e36d53a79cc0debd71133b1ef

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.13.exe
Size 30.5MB
Sample261024-jbp7kagw21
SHA256 eb7ca9cc7e0aaae1d0604818118723c94bc6073e36d53a79cc0debd71133b1ef
MD5 2df9ac269097de5b0770ce90aa55510d
SHA1 669d31ae18c8d4f9c4199696bde96dbf7361e099
SHA512 936b4db8f5d9624eb19284a894509dcb4c00bb05af8dc82ce7288416eedc194b42c1eb58cee63a0627b4ed81601ee917c93bb5ca30b533450caa2380cbe60e83
SSDEEP 196608:CZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYe:ZC/p+HuPOc4j
TLSH
T14567181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\lwl2ZW = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	tuKJsn.exe

Executes dropped EXE 2 IoCs

pid	Process
5760	tuKJsn.exe
2516	tuKJsn.exe

Loads dropped DLL 2 IoCs

pid	Process
5760	tuKJsn.exe
2516	tuKJsn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\lwl2ZW\\tuKJsn.exe\""	tuKJsn.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5040	cmd.exe
1584	cmd.exe
3316	cmd.exe
6064	cmd.exe
5104	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	tuKJsn.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SCRdX9\XPSPLOG.dll	tuKJsn.exe
File opened for modification	C:\Program Files (x86)\SCRdX9	tuKJsn.exe
File created	C:\Program Files (x86)\SCRdX9\SCRdX9.exe	tuKJsn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2912	cmd.exe
4716	cmd.exe
4520	cmd.exe
6140	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tuKJsn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tuKJsn.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4164	schtasks.exe
1372	schtasks.exe
6108	schtasks.exe
5004	schtasks.exe
4020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
4340	install.2.0.13.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe
5760	tuKJsn.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 6064	5760	tuKJsn.exe	94
PID 6064 wrote to memory of 6108	6064	cmd.exe	96
PID 6064 wrote to memory of 6124	6064	cmd.exe	97
PID 6064 wrote to memory of 1624	6064	cmd.exe	100
PID 6140 wrote to memory of 204	6140	cmd.exe	103
PID 5760 wrote to memory of 5104	5760	tuKJsn.exe	104
PID 5104 wrote to memory of 5004	5104	cmd.exe	108
PID 5104 wrote to memory of 2512	5104	cmd.exe	109
PID 5104 wrote to memory of 2228	5104	cmd.exe	111
PID 5760 wrote to memory of 5040	5760	tuKJsn.exe	112
PID 5040 wrote to memory of 4020	5040	cmd.exe	115
PID 2912 wrote to memory of 2660	2912	cmd.exe	116
PID 5760 wrote to memory of 1584	5760	tuKJsn.exe	117
PID 5040 wrote to memory of 3792	5040	cmd.exe	118
PID 1584 wrote to memory of 4164	1584	cmd.exe	121
PID 5040 wrote to memory of 1196	5040	cmd.exe	122
PID 1584 wrote to memory of 4744	1584	cmd.exe	123
PID 1584 wrote to memory of 2272	1584	cmd.exe	124
PID 4716 wrote to memory of 4300	4716	cmd.exe	126
PID 5760 wrote to memory of 3316	5760	tuKJsn.exe	127
PID 3316 wrote to memory of 1372	3316	cmd.exe	129
PID 3316 wrote to memory of 5080	3316	cmd.exe	130
PID 3316 wrote to memory of 1960	3316	cmd.exe	133
PID 4520 wrote to memory of 1952	4520	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4340

C:\Users\Public\lwl2ZW\tuKJsn.exe
C:\Users\Public\lwl2ZW\tuKJsn.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\lwl2ZW\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\lwl2ZW\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6124
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5004
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1960

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\lwl2ZW" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\lwl2ZW" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:204

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1072

C:\Users\Public\lwl2ZW\tuKJsn.exe
"C:\Users\Public\lwl2ZW\tuKJsn.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2660

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4300

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 40a78dd9736f0dfc5c5738cac1c73ca0dc6d861e0dd3c60d54eeacb0262f9287
MD5 d9001fd1c234e1a02bfbdcb2ce15d2cb
SHA1 39f4a934a8cb88fb4c9695f65af97e82d02eccc3
SHA512 649bdc8a5c8c9301b63d470641c289cd69c2da07b412de086a3a56f30b8247c21c031f739404775e1e23130dd7c7dd0383b7d5b1aa457f7f1343e435ba47c8b4
TLSH
T16131A4BF1F7D3C429F6A8EC815CAF2222CE9E0806CD6549A6151D0D99F483B23F5E609
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 d5d5cabdb3bab9ab7f918dde5b14e3879fe408577bedfbe1df9909c6ecf6cd34
MD5 06add41e505026db90fd0b9cc46cb2c7
SHA1 24fb95d32ce5e153cdf265256a4ad194a5355956
SHA512 7507f8583bcf02529db0de8431b2514692b4af36f9860312dc6987bef04635868543dad73d6d1b5ecb2b3c3762e71200f4dd4dbdb55319738e622951aa9eadde
TLSH
T1D831D8AB5D391053DF0C9F3462C1D23BACF0A53098A80C53223ED2EA5704BBBAF85849
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 38ac475d51f2879e1c1420c23df99d5ef6802f6f7d1f50a629f9f5fa5b01affd
MD5 d3c18705f576ec85fdc07a92b3676699
SHA1 4fd8f7f435f9c99af2ce5fe4d72bf9a50dad1f7c
SHA512 a0ab26ad9555eaabc0b22505e12138e09cd2c37093791d45638e234fd2fedd302d95a43091a2fcd4f910bbccbf5ee674371e2caa266e8347279f2ef019960f0c
TLSH
T1BFF05C145DBD413EF533DE3DC6CA39AA1E7BF6072406899506E04B0DA113D432D52AB5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 bfb8e64e8b40e2302b510d290dce45b6add7787606dc7e71320c984c1623c09d
MD5 5c865b5db12c0015b3df1821179f429a
SHA1 3ff4eed97dcb21658081ca7893c3617349af3c2f
SHA512 0dec5f40d7861fc22324c7f701e8fa6bceceb164cdba196b30e5cbcb39d8be2cfdaa11df1f7d536c5b684ac2bba80337a0f200b09138385fc6e9f6ac1f44f989
TLSH
T16DF0272D56DA413BF13BD6BC46C63EB1DA25E623080652B91AAB02451EA19406C0126D
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\lwl2ZW\UxEnhance64.dll
Size 3.1MB
SHA256 283a9107683d2338c72cd34a13c47dcf20693bcc442ecd179257a04eade2a2b2
MD5 88e0fc2adf96df61000a49e480f69312
SHA1 a3a5e9fa97180ba173c6f57c42dac6e1ddec11de
SHA512 2e951cb5d712ed6f0efd5d9796ff893e11e91cec5b6976aa55d8fbd4df9df41123c4c94e426572bed747a0593b6643f0939f6d5168adbfd2a640dd0bd83e0ede
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+q:P9m29xx3Tiqt06ox6+z2rNNrKoq
TLSH
T1AAE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\lwl2ZW\adoresd.dat
Size 4.8MB
SHA256 e0fa43fd7f14aeb2881df59cf8c8185b9d67619b37436c7994611380bcb487fa
MD5 48e6339e6ae7b200b7dd469e35b15d0f
SHA1 68f5ea4b9b98907fb35cadb768756566e5442e7a
SHA512 2f152696ea1aaeacc7b69c4d39a80f4afe30843a18217b010b9acee73302819263710d32d9f57873174d85796d10fbcf7516ed41e8aa9fdbd8c37df5f544bd2c
SSDEEP 98304:KWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:KWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1743633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\lwl2ZW\msadox.tb
Size 8KB
SHA256 3f89a45c10c0bff1ef53777f6540f8525fb5cb9bfc06902f7fef6b499e529f3d
MD5 140f36fd6f6cdfe97efd857409fce6f0
SHA1 aca924a8f6162ebac112394732a2db92702029f6
SHA512 dbae21ce2bd31776af9a4dc3ecbd62f32b39089d9ef75d40a92b149fe9b18c10d84cbbfb3ff0e6d5bb94567ada38057a3e72289b0f15830edf7c7722a51aab32
SSDEEP 192:KqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:KsZqZOXQ3uqvR2Kfzp
TLSH
T1F1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tuKJsn.exe

Path C:\Users\Public\lwl2ZW\tuKJsn.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2516-574-0x00007FFBB1C00000-0x00007FFBB211E000-memory.dmp

Download

memory/2516-590-0x0000025E19180000-0x0000025E19A57000-memory.dmp

Download

memory/2516-578-0x0000025E19180000-0x0000025E19A57000-memory.dmp

Download

memory/2516-587-0x0000025E19180000-0x0000025E19A57000-memory.dmp

Download

memory/2516-586-0x0000025E19180000-0x0000025E19A57000-memory.dmp

Download

memory/2516-591-0x00007FFBD0550000-0x00007FFBD0552000-memory.dmp

Download

memory/2516-589-0x0000025E19180000-0x0000025E19A57000-memory.dmp

Download

memory/2516-581-0x00007FFBD0560000-0x00007FFBD0562000-memory.dmp

Download

memory/2516-582-0x0000025E19180000-0x0000025E19A57000-memory.dmp

Download

memory/4340-524-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/4340-0-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/4340-525-0x00007FFBC0D60000-0x00007FFBC0D70000-memory.dmp

Download

memory/4340-504-0x00007FFBC0D60000-0x00007FFBC0D70000-memory.dmp

Download

memory/4340-2-0x0000000002570000-0x000000000257C000-memory.dmp

Download

memory/4340-1-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/5760-536-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download

memory/5760-562-0x00000216F0060000-0x00000216F00EA000-memory.dmp

Download

memory/5760-561-0x00000216F0060000-0x00000216F00EA000-memory.dmp

Download

memory/5760-560-0x00000216EFF10000-0x00000216EFF5E000-memory.dmp

Download

memory/5760-563-0x00000216F0060000-0x00000216F00EA000-memory.dmp

Download

memory/5760-564-0x00000216F0060000-0x00000216F00EA000-memory.dmp

Download

memory/5760-555-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download

memory/5760-556-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download

memory/5760-550-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download

memory/5760-544-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download

memory/5760-546-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download

memory/5760-545-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download

memory/5760-543-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download

memory/5760-539-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download

memory/5760-538-0x00007FFBD0560000-0x00007FFBD0562000-memory.dmp

Download

memory/5760-531-0x00007FFBB1C00000-0x00007FFBB211E000-memory.dmp

Download

memory/5760-530-0x00007FFBD0550000-0x00007FFBD0552000-memory.dmp

Download

memory/5760-596-0x00000216EF240000-0x00000216EFB17000-memory.dmp

Download