c9c411b2d066cc14d9c57e0f6d9be2918c3c59bde056b63ff9f5808aa307fb10

Analysis

max time kernel
145s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.03.exe
Size 30.5MB
Sample261024-mt1mssbs6l
SHA256 c9c411b2d066cc14d9c57e0f6d9be2918c3c59bde056b63ff9f5808aa307fb10
MD5 013326781f326ea21a7ac0d666411efb
SHA1 1af4c1f02501d10428597058b792a1a46a05fa63
SHA512 8c627b3bc56b2b36e3144c95be90c44b6cce76dafb480908eaef79604138dcb5a7c46b4daa5a3a410b1a3761c6d10adb8750ffe61fa2f3c96603c566a0122a65
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYp:YC/p+HuPOc4U
TLSH
T1EC67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\9U7SDc = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1484	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3648	FTxZ40.exe
4924	FTxZ40.exe

Loads dropped DLL 2 IoCs

pid	Process
3648	FTxZ40.exe
4924	FTxZ40.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\9U7SDc\\FTxZ40.exe\""	FTxZ40.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3716	cmd.exe
2380	cmd.exe
5740	cmd.exe
3496	cmd.exe
5856	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	FTxZ40.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\474xnY\ov6vOU.exe	FTxZ40.exe
File created	C:\Program Files (x86)\474xnY\ov6vOU.exe	FTxZ40.exe
File created	C:\Program Files (x86)\474xnY\image.png	FTxZ40.exe
File opened for modification	C:\Program Files (x86)\474xnY\XPSPLOG.dll	FTxZ40.exe
File opened for modification	C:\Program Files (x86)\474xnY\image.png	FTxZ40.exe
File opened for modification	C:\Program Files (x86)\474xnY\thumbs.db	FTxZ40.exe
File opened for modification	C:\Program Files (x86)\474xnY	FTxZ40.exe
File created	C:\Program Files (x86)\474xnY\XPSPLOG.dll	FTxZ40.exe
File created	C:\Program Files (x86)\474xnY\thumbs.db	FTxZ40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1132	cmd.exe
4756	cmd.exe
2344	cmd.exe
2972	cmd.exe
2036	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FTxZ40.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FTxZ40.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4684	schtasks.exe
1384	schtasks.exe
1796	schtasks.exe
4332	schtasks.exe
2128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3356	install.2.0.03.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe
3648	FTxZ40.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeIncreaseQuotaPrivilege	1484	powershell.exe
Token: SeSecurityPrivilege	1484	powershell.exe
Token: SeTakeOwnershipPrivilege	1484	powershell.exe
Token: SeLoadDriverPrivilege	1484	powershell.exe
Token: SeSystemProfilePrivilege	1484	powershell.exe
Token: SeSystemtimePrivilege	1484	powershell.exe
Token: SeProfSingleProcessPrivilege	1484	powershell.exe
Token: SeIncBasePriorityPrivilege	1484	powershell.exe
Token: SeCreatePagefilePrivilege	1484	powershell.exe
Token: SeBackupPrivilege	1484	powershell.exe
Token: SeRestorePrivilege	1484	powershell.exe
Token: SeShutdownPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeSystemEnvironmentPrivilege	1484	powershell.exe
Token: SeRemoteShutdownPrivilege	1484	powershell.exe
Token: SeUndockPrivilege	1484	powershell.exe
Token: SeManageVolumePrivilege	1484	powershell.exe
Token: 33	1484	powershell.exe
Token: 34	1484	powershell.exe
Token: 35	1484	powershell.exe
Token: 36	1484	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1484	3648	FTxZ40.exe	92
PID 3648 wrote to memory of 3716	3648	FTxZ40.exe	94
PID 3716 wrote to memory of 2128	3716	cmd.exe	96
PID 3716 wrote to memory of 684	3716	cmd.exe	99
PID 3648 wrote to memory of 2380	3648	FTxZ40.exe	102
PID 3716 wrote to memory of 3384	3716	cmd.exe	105
PID 2380 wrote to memory of 4684	2380	cmd.exe	106
PID 3648 wrote to memory of 5740	3648	FTxZ40.exe	107
PID 2380 wrote to memory of 2636	2380	cmd.exe	109
PID 5740 wrote to memory of 1384	5740	cmd.exe	111
PID 2380 wrote to memory of 872	2380	cmd.exe	112
PID 3648 wrote to memory of 3496	3648	FTxZ40.exe	113
PID 5740 wrote to memory of 932	5740	cmd.exe	115
PID 3496 wrote to memory of 1796	3496	cmd.exe	116
PID 5740 wrote to memory of 2456	5740	cmd.exe	117
PID 3496 wrote to memory of 5776	3496	cmd.exe	118
PID 3648 wrote to memory of 5856	3648	FTxZ40.exe	121
PID 3496 wrote to memory of 3208	3496	cmd.exe	123
PID 5856 wrote to memory of 4332	5856	cmd.exe	124
PID 5856 wrote to memory of 3380	5856	cmd.exe	125
PID 5856 wrote to memory of 4124	5856	cmd.exe	127
PID 4756 wrote to memory of 996	4756	cmd.exe	128
PID 1132 wrote to memory of 4964	1132	cmd.exe	129
PID 2344 wrote to memory of 2476	2344	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3356

C:\Users\Public\9U7SDc\FTxZ40.exe
"C:\Users\Public\9U7SDc\FTxZ40.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9U7SDc\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9U7SDc\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:932
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1796
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4332
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3380
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4124
- C:\Program Files (x86)\474xnY\ov6vOU.exe
  "C:\Program Files (x86)\474xnY\ov6vOU.exe"
  2⤵
  PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\474xnY" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2036

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9U7SDc" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9U7SDc" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4964

C:\Users\Public\9U7SDc\FTxZ40.exe
"C:\Users\Public\9U7SDc\FTxZ40.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4924

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4848

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:996

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2476

C:\Program Files (x86)\474xnY\ov6vOU.exe
"C:\Program Files (x86)\474xnY\ov6vOU.exe"
1⤵
PID:1828

C:\Program Files (x86)\XZ81H8KG2\762gFiFe.exe
"C:\Program Files (x86)\XZ81H8KG2\762gFiFe.exe"
1⤵
PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\474xnY\XPSPLOG.dll
Size 4.6MB
SHA256 e32a53ff6a9422b9ea4eb5a62f486efe36c10e0b225e8aaddd9fb743d4ded4da
MD5 391d07367661ba254c3374fa5e8b119e
SHA1 dc5258cd70b04654a017927a1306e0dd05420d2b
SHA512 3366dc26882ad8537a059f4cf6ccdaf2b3d2bdc8d77fd485280e5342168d694b9d2da1f7934a8c29626d990ed12ffc59459f41c1ed5883cddb86635fa7f47ac1
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyA:BMWKfU+BcUTHCCCfqCiUffnA
TLSH
T1B0263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\474xnY\XPSPLOG.dll
Size 2.6MB
SHA256 2e0857146d92dcd194fc2827c08f028ad0dd577cc96b2738a34b312f15d6df2b
MD5 03f2a486a2939d6731f4d3b63c9eb068
SHA1 4f20664b647512e3026b5edb3aa0fbf84ad9bb57
SHA512 446990b71ebb5db5bcf462a815530840d7cce4c4191d5ab363e22ab62b56a0d3dddc8dd5c5654463d31b866a550ff9a3cb04769c15b12627f3d8750b782bc9ce
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOK:yCMWmcKfST5t+BceThTHfas
TLSH
T163D533DBFA8B461EE66177792F7DECADB6BC49C4821DE544D0A2314F0044B9E903E68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\474xnY\image.png
Size 4.8MB
SHA256 c65a551441e1b6a7ef44d6baee1371a0b83bdd1160ae57026502d61a1698382c
MD5 ea8cc72f0dd333fb4573150a735476fd
SHA1 e5f136270666968e512cf54326cb9bf6df88a9f0
SHA512 e0524d938fc26d9fd14184f28fb24e1404e54157448e840be99e6fede344943021e2959c39e87218beaed36a4eefbaa03b311e842254ac7b063bff57693825a2
SSDEEP 98304:K/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:KMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T18536334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ov6vOU.exe

Path C:\Program Files (x86)\474xnY\ov6vOU.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\474xnY\thumbs.db
Size 358KB
SHA256 332100218619181612a8d3b52a8cdf60f97ca27809896e06d2342367e7bb2c4c
MD5 3b5a1e8e3dfafae0eec98698b6364db2
SHA1 133941fd21dfdcd8f03a89fa35128a9bd04ac209
SHA512 4d2804ff1d60f1dd576fcad884ed466da43a8fcc7941d20bccc1fd839668e96589f15d96379b109d3428abd7809763d4adecb70324ce483dd7553e76352c262a
SSDEEP 6144:8iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:b8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1E574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\XZ81H8KG2\XPSPLOG.dll
Size 2.4MB
SHA256 7c648831704b6a2f08aca7b016d12616051039e54d658876b5a59db09435aff2
MD5 916c33af4030e0e061804186e3363071
SHA1 f222a9f5d47df5cd433aff810b26ac7b0e81e060
SHA512 356c97f9dc324754a6ca048cb76c758159f8bfa86bd2580ae3d6bf4014d35f5b8a0ea9f55539493bc8e43d2d8217c1bedce4b63ee52856089a3ae1c8be957ddd
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqa1:yCMWmcKfST5t+BceThTHfa1
TLSH
T1D4C533DBF657560EEAA132792FADEC6DB2BD09C4812DE548D4D2304F4054B6E803FA8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\XZ81H8KG2\XPSPLOG.dll
Size 1.7MB
SHA256 32c652edb33d0b10b53875795257715d09f0982808f93b145c3ae7c47339a360
MD5 30fbab214ab13adf9ad81f13583909e3
SHA1 e180b120a9d7b99f722ea1881d0c92e986e6909b
SHA512 0fa3771080f9336d40b2b9eca0c0671ce6b6b9ecef606569a903cfa76f9b41c9a937c9a94451f4fd6f4964a9d1d94ed7558e02b8b117552120a648c081920ea2
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXT5tpB1JA6nvsNBFGGLncDYW:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBc/
TLSH
T1678533DBB2DB401EF6A173B52F9CED2CB17E59C881BEC4159CA6718B0031AAE503974D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\XZ81H8KG2\image.png
Size 64KB
SHA256 299b0879f2e5a0da194946c34f62ffd747abc8418264d52571518c1183f2ecb9
MD5 a6abf2d621907ca0a47d648e93b9503d
SHA1 d375e94034f7ee051c2cca41ce209c47d85c63e6
SHA512 eb43c1fff98036cce4447c1553925bd88f06f85f8d9d428e662740cad74be41c7c15faa98dc9b33c376333c597f01631f032a2083e446b8b3b4d941c0334c987
SSDEEP 1536:h23qm6+1hxb4JU+45wHmis93MyJG+yDUhp6O/qnvkvXZgrTM3:hWt91z4a+2+mrNG+SUXDkYXf3
TLSH
T1FB53F136DEEB4ED919E2F0AB820B4CB1EB1A989105C114773997B3644BE4377E05A07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 7738054fc915d59309e06c7b83f042860aa38485957c231b6650a9153df3d8af
MD5 8ac53d126952510ab2aa86a64f61bdc9
SHA1 939a683d70855a8457a9bd4fde909910f708ca3e
SHA512 4f883c91e145bdf67162e730275285a24c627e288e070fe7efe4813b574620ab4dedf1b46397db3621b87a67be8b051395fa69031b8557031df85c2cba13344a
TLSH
T1583196F72FA869C28F2A4D9125DAF1262CE5A1849CD9049D6205C8545F043B22E5D90D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 0c705c94eacd313aec7b6e8dbf1b60649f9c670da754214793a5ded830b7da97
MD5 54e9d2639db287c76257a0b836626961
SHA1 b418f6ed30010a6dc2568023c0d2e3de0a01765b
SHA512 dfa4e4f21b43d8f28455e72a93252388cd3d15d7a7281e3726daaaa525d81c703b07433d2ecddf4aea6d52fbbee49f2a049d00ac8638d023732a4fe7c2a1ffcd
TLSH
T12831D893FE780022FB084F6866C0D53FBCF275255DA55459B52FD26A4229B776F85004
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 25c876cda11ce91b70b57db709135fd9c06634742e93ad243b6b840e1992f64b
MD5 ec0c4feb3f09393c5ad9cdf1d5b9c652
SHA1 2699e8ff9197b54bd3c2dc43705cf06fe5c2807e
SHA512 c53ba407e14184f8885d9528cdebc87f5cbf0de0c5a37cf3ce81e065a32dee048d0bcd07b8d44dc0768fe91437c4d49c7faa35096ed0b20daa7f6599ff2e7367
TLSH
T1B3F05C345DBC433DF133EB3DCAC575E6066BF6011812459407A547086A137435C53575
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 2a6125c9dce7c178e90f178b2aee1c01f5d491dbab93971afe252751c4754f24
MD5 fc760c6c897736ec10848380eb354b30
SHA1 41c4314b5b4bdf6955b5cd14192db76019d57b76
SHA512 80964093aa07b01f9134adbde67e92deae5b5f90768a62c2aa8a7d2a309a2a83fb9e14912f10ebd636be2188f9302fb4cfd19ac5d0924ca4720250f0e9cfcb7b
TLSH
T110F05C3D43EA011BF03FE2B847C6B6F3AA25F123644666EA0AE503449F71E403C01769
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_n4jtoem5.e53.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n4jtoem5.e53.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

FTxZ40.exe

Path C:\Users\Public\9U7SDc\FTxZ40.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\9U7SDc\UxEnhance64.dll
Size 3.1MB
SHA256 a6175b49fbf9c645a9df7577b0920dc37908d1eb33721700cb2181fbc390b395
MD5 a69ef5370d9b3e83e0ff3fd0cd328651
SHA1 3d16879bdf8ff17fec187dea6efbdcaec997d9f4
SHA512 d633a3e46b52702e6662aa3b6617b12eea04eb303c30cdea904181b51cdd1dce15ead2619d044587eb4c5b627c7a7b232424c17cb677a6f685d636476cf3798c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+g:P9m29xx3Tiqt06ox6+z2rNNrKog
TLSH
T134E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\9U7SDc\adoresd.dat
Size 4.8MB
SHA256 567f9a5bee29e87b09e897b952c96efc857ac33de4a2ec294ec56d08b7d2aff5
MD5 3cfa1cdce0a9d2c0f1a44326f6752f94
SHA1 e0b267e0559c7e77f75c18e9462b8e4c4b4426f8
SHA512 d62f7ec5658ee51d6bf4dcc27412d434258c244ea37849e584ea6be0c6cba03ead681e2531b5fa498a524604ddd84dae8d02a27fe803fe3277534cf0f303642f
SSDEEP 98304:yWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:yWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1BB3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\9U7SDc\msadox.tb
Size 8KB
SHA256 d9e750fb15cec4c93d4daca35bdfb819af1a662900e7acab38254d1fd26cbe6d
MD5 a72b68656a4dfe24b1b3d0386d5fc5f7
SHA1 dfcadfa1df8220f736e331924026df71cda1a40b
SHA512 cc5730539f21e4cd4ab2888164b347c5135ad86a400d015d5f6a8cc0e03cbff8056ef443f1934935fe792bcd6dac9e7db2990d41573504c6f13e7427ef5a2f2b
SSDEEP 192:QqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:QsZqZOXQ3uqvR2Kfzp
TLSH
T17A029E05D7A20CC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

memory/1484-601-0x000002C77EFA0000-0x000002C77F052000-memory.dmp

Download

memory/1484-600-0x000002C77EF80000-0x000002C77EF9E000-memory.dmp

Download

memory/1484-597-0x000002C77E9E0000-0x000002C77EA02000-memory.dmp

Download

memory/1484-605-0x000002C77E9C0000-0x000002C77E9CA000-memory.dmp

Download

memory/1828-718-0x0000000074F00000-0x000000007564A000-memory.dmp

Download

memory/1828-722-0x00000000035F0000-0x0000000003DCD000-memory.dmp

Download

memory/1828-717-0x0000000000D60000-0x0000000000D61000-memory.dmp

Download

memory/3356-0-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/3356-524-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/3356-525-0x00007FFA119B0000-0x00007FFA119C2000-memory.dmp

Download

memory/3356-504-0x00007FFA119B0000-0x00007FFA119C2000-memory.dmp

Download

memory/3356-2-0x0000000002630000-0x000000000263C000-memory.dmp

Download

memory/3356-1-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/3648-536-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-567-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-566-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-556-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-559-0x000001CBF1060000-0x000001CBF10EA000-memory.dmp

Download

memory/3648-560-0x000001CBF1060000-0x000001CBF10EA000-memory.dmp

Download

memory/3648-561-0x000001CBF1060000-0x000001CBF10EA000-memory.dmp

Download

memory/3648-562-0x000001CBF1060000-0x000001CBF10EA000-memory.dmp

Download

memory/3648-564-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-558-0x000001CBF0F80000-0x000001CBF0FCE000-memory.dmp

Download

memory/3648-550-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-544-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-546-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-545-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-539-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-543-0x000001CBF0360000-0x000001CBF0C37000-memory.dmp

Download

memory/3648-538-0x00007FFA1D7A0000-0x00007FFA1D7A2000-memory.dmp

Download

memory/3648-531-0x00007FF9FBFA0000-0x00007FF9FC4BE000-memory.dmp

Download

memory/3648-530-0x00007FFA1D790000-0x00007FFA1D792000-memory.dmp

Download

memory/4584-675-0x0000000074F00000-0x000000007564A000-memory.dmp

Download

memory/4584-674-0x0000000001050000-0x0000000001051000-memory.dmp

Download

memory/4584-679-0x00000000037C0000-0x0000000003F9D000-memory.dmp

Download

memory/4584-681-0x0000000001070000-0x0000000001071000-memory.dmp

Download

memory/4584-682-0x00000000037C0000-0x0000000003F9D000-memory.dmp

Download

memory/4584-706-0x00000000037C0000-0x0000000003F9D000-memory.dmp

Download

memory/4584-686-0x00000000037C0000-0x0000000003F9D000-memory.dmp

Download

memory/4584-693-0x0000000002DC0000-0x0000000002DD4000-memory.dmp

Download

memory/4924-589-0x000002B61C390000-0x000002B61CC67000-memory.dmp

Download

memory/4924-590-0x000002B61C390000-0x000002B61CC67000-memory.dmp

Download

memory/4924-591-0x00007FFA1D790000-0x00007FFA1D792000-memory.dmp

Download

memory/4924-588-0x000002B61C390000-0x000002B61CC67000-memory.dmp

Download

memory/4924-587-0x000002B61C390000-0x000002B61CC67000-memory.dmp

Download

memory/4924-583-0x000002B61C390000-0x000002B61CC67000-memory.dmp

Download

memory/4924-582-0x00007FFA1D7A0000-0x00007FFA1D7A2000-memory.dmp

Download

memory/4924-580-0x000002B61C390000-0x000002B61CC67000-memory.dmp

Download

memory/4924-577-0x00007FF9FBFA0000-0x00007FF9FC4BE000-memory.dmp

Download

memory/5256-724-0x0000000001400000-0x0000000001401000-memory.dmp

Download

memory/5256-725-0x0000000074340000-0x0000000074A8A000-memory.dmp

Download