dbe58fa26463d5d7a818ae49a1ba96b1298e1ed2edeca65144b539ebdcc2597c

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.04.exe
Size 30.5MB
Sample261024-npd4nstyc1
SHA256 dbe58fa26463d5d7a818ae49a1ba96b1298e1ed2edeca65144b539ebdcc2597c
MD5 dc0d138a309221382eb561f477162a49
SHA1 f9daeb286d8cb410c20362423f348a542ef2a61c
SHA512 8dc5753169f5dd8ade9c61b3a1913e8240028ff8e450b665a65307a82aa288979219a0e9ead6da1c9b6dcced09e5794141d1e077616b4f175aefd9543afbf3bc
SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYW:TC/p+HuPOc4v
TLSH
T1CB67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Tts2oo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	Qkb1IL.exe

Executes dropped EXE 2 IoCs

pid	Process
4972	Qkb1IL.exe
1540	Qkb1IL.exe

Loads dropped DLL 2 IoCs

pid	Process
4972	Qkb1IL.exe
1540	Qkb1IL.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Tts2oo\\Qkb1IL.exe\""	Qkb1IL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Tts2oo\\Qkb1IL.exe\""	Qkb1IL.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4720	cmd.exe
368	cmd.exe
1840	cmd.exe
1636	cmd.exe
2244	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Qkb1IL.exe
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Qkb1IL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1608	cmd.exe
1388	cmd.exe
4708	cmd.exe
5060	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.04.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.04.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Qkb1IL.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Qkb1IL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4636	schtasks.exe
204	schtasks.exe
2008	schtasks.exe
3820	schtasks.exe
1732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
1536	install.2.0.04.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe
4972	Qkb1IL.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4720	4972	Qkb1IL.exe	95
PID 4720 wrote to memory of 4636	4720	cmd.exe	97
PID 4720 wrote to memory of 4668	4720	cmd.exe	98
PID 4720 wrote to memory of 4192	4720	cmd.exe	100
PID 1388 wrote to memory of 1912	1388	cmd.exe	104
PID 4972 wrote to memory of 368	4972	Qkb1IL.exe	105
PID 368 wrote to memory of 204	368	cmd.exe	107
PID 368 wrote to memory of 4436	368	cmd.exe	110
PID 368 wrote to memory of 5104	368	cmd.exe	112
PID 4972 wrote to memory of 1840	4972	Qkb1IL.exe	114
PID 1840 wrote to memory of 2008	1840	cmd.exe	116
PID 4708 wrote to memory of 1660	4708	cmd.exe	117
PID 4972 wrote to memory of 1636	4972	Qkb1IL.exe	118
PID 1840 wrote to memory of 2504	1840	cmd.exe	120
PID 1840 wrote to memory of 1956	1840	cmd.exe	123
PID 1636 wrote to memory of 3820	1636	cmd.exe	124
PID 1636 wrote to memory of 4584	1636	cmd.exe	125
PID 5060 wrote to memory of 4692	5060	cmd.exe	126
PID 1636 wrote to memory of 396	1636	cmd.exe	127
PID 4972 wrote to memory of 2244	4972	Qkb1IL.exe	128
PID 2244 wrote to memory of 1732	2244	cmd.exe	130
PID 2244 wrote to memory of 2144	2244	cmd.exe	131
PID 2244 wrote to memory of 3036	2244	cmd.exe	134
PID 1608 wrote to memory of 436	1608	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Users\Public\Tts2oo\Qkb1IL.exe
C:\Users\Public\Tts2oo\Qkb1IL.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Tts2oo\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Tts2oo\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2008
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4584
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2144
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3036

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Tts2oo" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Tts2oo" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1912

C:\Users\Public\Tts2oo\Qkb1IL.exe
"C:\Users\Public\Tts2oo\Qkb1IL.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1540

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2392

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1660

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4692

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 7738054fc915d59309e06c7b83f042860aa38485957c231b6650a9153df3d8af
MD5 8ac53d126952510ab2aa86a64f61bdc9
SHA1 939a683d70855a8457a9bd4fde909910f708ca3e
SHA512 4f883c91e145bdf67162e730275285a24c627e288e070fe7efe4813b574620ab4dedf1b46397db3621b87a67be8b051395fa69031b8557031df85c2cba13344a
TLSH
T1583196F72FA869C28F2A4D9125DAF1262CE5A1849CD9049D6205C8545F043B22E5D90D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a63b47dec175a827b588c54002ff7740cdaa5b114c5d8b82dfcd01d1af92074a
MD5 42ab06de6d510c09d3ed82faead50097
SHA1 80bbbe85e5a3ccf7a8c3e20d4633920350b90fac
SHA512 5e28c7e1310a2b488421ceb701e752629c4df40625310d55291c4870274a855be019b1b57fe847c18c7c16fdce5490615ce10e1f651155fd46f7272444bc90db
TLSH
T1DE31D6A78A3900539F0C5F2966C1D23F6CF6A2265CA04812253EC3FA8204FBB6F89010
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 b5d25371ac33d20022c8164f0f9b12ccc40225c879c44c87117c1b8b04ec6c66
MD5 09b054396a5d9edae3874d7f6493ceb4
SHA1 c0f6c6856ffafc1fdc5855af00452ec5f0941e1e
SHA512 ca81861084dfd229f3c6b3c3959adbda149e3fd176274eb33d66700c0bf8cce00f82a64a097b095628b24e0aa5f74498e18d542fcbd0b0e0b13c237670e523f2
TLSH
T163F05C345DBC533DF133AB3DCAC579D6066BF602181245A407A557086A136839C53575
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 43ef60b95a94531c997ca2318825f4bda4ce789e75bfa041e49261d2a30caf20
MD5 054ca105ad2edb2ef7646bb71056788b
SHA1 7ac7b4fce7046b2a06303d4c3027dc40da8a0a29
SHA512 173a65959c0ba9072d07bae694acccdc7692ab7cb80dc4b68117511f5b55b437567ad4e109eed8d78afc02eb7ac72b2827378ee8239b252085fe89b37502d46c
TLSH
T1CFF05C3957EA411BF17BD2BC86C27AF25F29F523144669BB09F603441AA1C407C5266A
MD5 SHA1 SHA512 TLSH

Submit Download

Qkb1IL.exe

Path C:\Users\Public\Tts2oo\Qkb1IL.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Tts2oo\UxEnhance64.dll
Size 3.1MB
SHA256 540a84606aa05be2282ca1e39d9669f06f7314bf2c639189c4a931b9b200d30e
MD5 3eb8481550c88d8223d2a928ca5280b8
SHA1 695c6889de8cf64a3b296292c2379ba6752699eb
SHA512 915ad77dec99b0fbab762924dda3eda7af45a2756e2796fa9563e7aeca3ec5414048cbbd0f92580b32913aa9f64455982a8880f03e0403f859b2930a03586cef
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+e:P9m29xx3Tiqt06ox6+z2rNNrKoe
TLSH
T15BE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Tts2oo\adoresd.dat
Size 4.8MB
SHA256 5bf30e00545ba265000f671df20265987c86476605d34b55cbb82ec195bc0ca7
MD5 c2310d0ddfd2d4d191af6f39bf04c056
SHA1 fe91ad8b84fd23cb988790dc9c4fd842ef84196a
SHA512 afcf716d12a81643f8afcac751ae55fc5e9da4e968a473e524370a3130390772fa04f552a08a02ae0b1335ea2b08efa6a63bf5a1423b4428bf342bfceecd5b57
SSDEEP 98304:RWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:RWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T13E3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Tts2oo\msadox.tb
Size 8KB
SHA256 0fcaf56a72eabe968ee9601bfb14348a6915ef070095da776b136b6cf61c0a73
MD5 63dd457ec60510da8ff31f525a4f4dab
SHA1 4cd0fbe5d0cf47f98570f50ac731d154e231f8ff
SHA512 b98d23a52094d28df3a43feb70770a6b1f164ae5a7a2c1d33fcd11430b9faa50d6a9e50fbd7e8602f435d7a0a3384729ab56ccc133af438a181b76bd292c1017
SSDEEP 192:KqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:KsZqZOXQ3uqvR2Kfzp
TLSH
T1FC029E05D7A20DC3E2016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiPolicy.p7b

Path C:\Windows\System32\CodeIntegrity\SiPolicy.p7b
Size 24KB
SHA256 b3f17065ed63b17ffef175f2979907d8eef69a76ba4cbd1d9785035a0b1f0a10
MD5 c99441a9b83d3866d88abfdf45894d3d
SHA1 3e32a4131855a8296b6238294a03d8eabcad6f9c
SHA512 c13bb76ef20055b5e923272c4cd976e93e5f21c5b7f8664e5d60a4918e92d0ab4abd3efa63a549b52536986fc3434a9ef1f808be76a12f47e43fdd9e58f275f6
SSDEEP 48:GwIn0NHUVyHU1yHUccy3GwaAvdV6dVwNdVojdVKdVqdmded9dod1d9Ud0dOdbd81:Any8yU88yldGVDP4NMC2/22M/0rw
TLSH
T11CB2C6803BEEC559F3B3DA71AFB6C6AA903AFC91AD11531F71C9735E1432800D529B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-525-0x00007FF8D0120000-0x00007FF8D0130000-memory.dmp

Download

memory/1536-524-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/1536-504-0x00007FF8D0120000-0x00007FF8D0130000-memory.dmp

Download

memory/1536-0-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/1536-2-0x0000000000500000-0x000000000050C000-memory.dmp

Download

memory/1536-1-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/1540-611-0x000001BD99980000-0x000001BD99A0A000-memory.dmp

Download

memory/1540-592-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/1540-612-0x000001BD99980000-0x000001BD99A0A000-memory.dmp

Download

memory/1540-619-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/1540-599-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/1540-594-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/1540-593-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/1540-617-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/1540-591-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/1540-586-0x00007FF8DB720000-0x00007FF8DB722000-memory.dmp

Download

memory/1540-587-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/1540-585-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/1540-581-0x00007FF8BD2A0000-0x00007FF8BD7BE000-memory.dmp

Download

memory/1540-610-0x000001BD99980000-0x000001BD99A0A000-memory.dmp

Download

memory/1540-609-0x000001BD99980000-0x000001BD99A0A000-memory.dmp

Download

memory/1540-606-0x000001BD9A3D0000-0x000001BD9ACA7000-memory.dmp

Download

memory/4972-536-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-555-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-557-0x000002969C610000-0x000002969C65E000-memory.dmp

Download

memory/4972-558-0x000002969CAB0000-0x000002969CB3A000-memory.dmp

Download

memory/4972-559-0x000002969CAB0000-0x000002969CB3A000-memory.dmp

Download

memory/4972-566-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-563-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-560-0x000002969CAB0000-0x000002969CB3A000-memory.dmp

Download

memory/4972-561-0x000002969CAB0000-0x000002969CB3A000-memory.dmp

Download

memory/4972-596-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-550-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-543-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-539-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-545-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-546-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-544-0x000002969BC70000-0x000002969C547000-memory.dmp

Download

memory/4972-538-0x00007FF8DB720000-0x00007FF8DB722000-memory.dmp

Download

memory/4972-531-0x00007FF8BD2A0000-0x00007FF8BD7BE000-memory.dmp

Download

memory/4972-530-0x00007FF8DB710000-0x00007FF8DB712000-memory.dmp

Download