2ef90f900fecf403037f39f9ddae98bda8ad6bbdb8db430d0eec9642594a7a1a

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.06.exe
Size 30.5MB
Sample261024-pl5ynahy31
SHA256 2ef90f900fecf403037f39f9ddae98bda8ad6bbdb8db430d0eec9642594a7a1a
MD5 d564fe83bf0021ea38efa9407703f58b
SHA1 fb69c6209955f45835c66dbc827686b13d6b95ec
SHA512 6257a8a4feb2c0172fa9181fc212cb218c4aaf7d8b59127e7b2c13d95655bc417bb55541c604b2d99e9fcf65cf087976f92fb9356169bb6a3aae4d7aa7a96e5d
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY4:YC/p+HuPOc4F
TLSH
T1FF67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\rjblS1 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4772	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
6044	0jDshN.exe
4868	0jDshN.exe

Loads dropped DLL 2 IoCs

pid	Process
6044	0jDshN.exe
4868	0jDshN.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\rjblS1\\0jDshN.exe\""	0jDshN.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4180	cmd.exe
2168	cmd.exe
944	cmd.exe
5640	cmd.exe
4884	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	0jDshN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2920	cmd.exe
1660	cmd.exe
1664	cmd.exe
4108	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0jDshN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0jDshN.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5956	schtasks.exe
4188	schtasks.exe
472	schtasks.exe
1732	schtasks.exe
5816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
1296	install.2.0.06.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe
6044	0jDshN.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeIncreaseQuotaPrivilege	4772	powershell.exe
Token: SeSecurityPrivilege	4772	powershell.exe
Token: SeTakeOwnershipPrivilege	4772	powershell.exe
Token: SeLoadDriverPrivilege	4772	powershell.exe
Token: SeSystemProfilePrivilege	4772	powershell.exe
Token: SeSystemtimePrivilege	4772	powershell.exe
Token: SeProfSingleProcessPrivilege	4772	powershell.exe
Token: SeIncBasePriorityPrivilege	4772	powershell.exe
Token: SeCreatePagefilePrivilege	4772	powershell.exe
Token: SeBackupPrivilege	4772	powershell.exe
Token: SeRestorePrivilege	4772	powershell.exe
Token: SeShutdownPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeSystemEnvironmentPrivilege	4772	powershell.exe
Token: SeRemoteShutdownPrivilege	4772	powershell.exe
Token: SeUndockPrivilege	4772	powershell.exe
Token: SeManageVolumePrivilege	4772	powershell.exe
Token: 33	4772	powershell.exe
Token: 34	4772	powershell.exe
Token: 35	4772	powershell.exe
Token: 36	4772	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 4772	6044	0jDshN.exe	91
PID 6044 wrote to memory of 4180	6044	0jDshN.exe	93
PID 4180 wrote to memory of 5956	4180	cmd.exe	95
PID 4180 wrote to memory of 2340	4180	cmd.exe	96
PID 4180 wrote to memory of 4408	4180	cmd.exe	98
PID 6044 wrote to memory of 2168	6044	0jDshN.exe	102
PID 2168 wrote to memory of 4188	2168	cmd.exe	105
PID 2168 wrote to memory of 2796	2168	cmd.exe	106
PID 6044 wrote to memory of 944	6044	0jDshN.exe	108
PID 2168 wrote to memory of 2512	2168	cmd.exe	110
PID 944 wrote to memory of 472	944	cmd.exe	111
PID 2920 wrote to memory of 3544	2920	cmd.exe	114
PID 1660 wrote to memory of 4912	1660	cmd.exe	115
PID 6044 wrote to memory of 5640	6044	0jDshN.exe	116
PID 944 wrote to memory of 4164	944	cmd.exe	118
PID 5640 wrote to memory of 1732	5640	cmd.exe	120
PID 944 wrote to memory of 2368	944	cmd.exe	121
PID 5640 wrote to memory of 2136	5640	cmd.exe	122
PID 5640 wrote to memory of 4628	5640	cmd.exe	123
PID 6044 wrote to memory of 4884	6044	0jDshN.exe	124
PID 4884 wrote to memory of 5816	4884	cmd.exe	126
PID 4884 wrote to memory of 4572	4884	cmd.exe	127
PID 4884 wrote to memory of 3772	4884	cmd.exe	129
PID 1664 wrote to memory of 4776	1664	cmd.exe	132
PID 4108 wrote to memory of 6112	4108	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1296

C:\Users\Public\rjblS1\0jDshN.exe
"C:\Users\Public\rjblS1\0jDshN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\rjblS1\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\rjblS1\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4188
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2796
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3772

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\rjblS1" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\rjblS1" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3544

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1200

C:\Users\Public\rjblS1\0jDshN.exe
"C:\Users\Public\rjblS1\0jDshN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4868

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4912

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4776

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 a807939139840894595f17589c91dfdb2ce9d07e3e070c76a0aa45bab36234c7
MD5 8b387d4927be91515a3aa5ca6500a44c
SHA1 c169bbf749909f48ebc57d30500fba9e8382bbae
SHA512 891be89a1007cd40cdd24683e271bd6335df1e0c21668c2399ddaa6ee04d88fe1df2db94beaf49275934a13bdc5349ea32892117b708a8d59e89d6fa68337da4
TLSH
T1FE3174BF2F6D39878F794D5414C9E2313CE5E1D09CD600597109C4989F083B22F5E60C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a63b47dec175a827b588c54002ff7740cdaa5b114c5d8b82dfcd01d1af92074a
MD5 42ab06de6d510c09d3ed82faead50097
SHA1 80bbbe85e5a3ccf7a8c3e20d4633920350b90fac
SHA512 5e28c7e1310a2b488421ceb701e752629c4df40625310d55291c4870274a855be019b1b57fe847c18c7c16fdce5490615ce10e1f651155fd46f7272444bc90db
TLSH
T1DE31D6A78A3900539F0C5F2966C1D23F6CF6A2265CA04812253EC3FA8204FBB6F89010
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 5c4d22b61fd0af3bb3e9813a53578df793ae838b395e786f7aba7205d9f48e67
MD5 1f3d6c3f1909895b95a538e9b52688af
SHA1 1c81851435411455775c0c985377d4434880702b
SHA512 e4db352bf0e2c85b0f477edf2c4ce7114b160d74c17267872d9065c1f2dfb033ac09fbe8af6034277c0b3eb95e6dfa5cb5155f22e17fdffccd102bc8c7b1f4d3
TLSH
T139F0DC0C8DB8433DF132DA3DC7CB7AD31AAFF606341289A803F4070CA1228816C42676
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 56a50974aea27f03c173248e5287aa0f638e60a42aec4f8f326347a0a41870e8
MD5 bcbed3479959c17c0165d46d8c1edfc7
SHA1 0a77883b7c2f5a85dc146e431ac9b91d33ef0725
SHA512 fdc5fdabfcff823512b2d83cf40b70568cc5f093be69c2e10a0916fc2c5af855bf5dcf066a04f389b1ac355e015b0ec4c46745e408ced27243d2b45f3619f98d
TLSH
T1DDF0972857FA011BF07B92BC86C276F24F29E123104669AB09E103401AA1C407C42A6A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3qz1c1p3.w2n.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qz1c1p3.w2n.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0jDshN.exe

Path C:\Users\Public\rjblS1\0jDshN.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\rjblS1\UxEnhance64.dll
Size 3.1MB
SHA256 0baa4a440c0573a68d0d9a5f0e2625b9cd2e46b4cf8b22d532a1ff6c2781a481
MD5 bead6ae7c976ffaaa25b1c6fc69e4915
SHA1 3604e174aad2ed9917ee7545d6fa0fc64b924631
SHA512 8e1db6679ef904c4bee6dfc14f332bed8d4808d2b3a50e9640cb0a54d8ec0e719411f8120e0ee8558213888ca048d9e5b4ea9e2c44474e20b524af87896c35e6
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+R:P9m29xx3Tiqt06ox6+z2rNNrKoR
TLSH
T107E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\rjblS1\adoresd.dat
Size 4.8MB
SHA256 0c4bff22a6bac63808af1e193072c24971103bac7a718ae696ab0c1646db760e
MD5 08e0c979f496b26948077a06f1c09c97
SHA1 8a1d76bb3d4ca03723d22cc0a54ce1d5652d6abc
SHA512 6ac314a936f6334f99fce7a2656b6e3c160c2772fe5b52b04994c029547b86dd51c87406119d9831795d5076f3cb4abf5906a62c800c71ca9db92829f3dc87e4
SSDEEP 98304:7Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:7Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1B03633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\rjblS1\msadox.tb
Size 8KB
SHA256 3177e688d03364d3cd756350b65cd17ec4906672019e1837963a2d3e40858358
MD5 636ecd935edde8758d1ddf813ede363e
SHA1 40f432101ca95e9f60c531857d03fa4372b6985c
SHA512 0de006bf2e7a6268489e37322b864d8ac6ce22b240591f495070c0000e0605749f3fca7264877e64257550cff9be0c2773cde5a2baef6def31ae4e994ec07675
SSDEEP 192:NqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:NsZqZOXQ3uqvR2Kfzp
TLSH
T17A029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-0-0x0000000003DD0000-0x0000000003DDE000-memory.dmp

Download

memory/1296-525-0x00007FFB42D50000-0x00007FFB42D62000-memory.dmp

Download

memory/1296-524-0x0000000003DD0000-0x0000000003DDE000-memory.dmp

Download

memory/1296-504-0x00007FFB42D50000-0x00007FFB42D62000-memory.dmp

Download

memory/1296-2-0x0000000003DE0000-0x0000000003DEC000-memory.dmp

Download

memory/1296-1-0x0000000003DD0000-0x0000000003DDE000-memory.dmp

Download

memory/4772-607-0x0000019B29930000-0x0000019B2993A000-memory.dmp

Download

memory/4772-601-0x0000019B298D0000-0x0000019B298F2000-memory.dmp

Download

memory/4772-605-0x0000019B41EC0000-0x0000019B41EDE000-memory.dmp

Download

memory/4772-606-0x0000019B41EE0000-0x0000019B41F92000-memory.dmp

Download

memory/4868-582-0x00007FFB529E0000-0x00007FFB529E2000-memory.dmp

Download

memory/4868-590-0x000001ECE5FF0000-0x000001ECE68C7000-memory.dmp

Download

memory/4868-583-0x000001ECE5FF0000-0x000001ECE68C7000-memory.dmp

Download

memory/4868-588-0x000001ECE5FF0000-0x000001ECE68C7000-memory.dmp

Download

memory/4868-589-0x000001ECE5FF0000-0x000001ECE68C7000-memory.dmp

Download

memory/4868-591-0x00007FFB529D0000-0x00007FFB529D2000-memory.dmp

Download

memory/4868-587-0x000001ECE5FF0000-0x000001ECE68C7000-memory.dmp

Download

memory/4868-580-0x000001ECE5FF0000-0x000001ECE68C7000-memory.dmp

Download

memory/4868-577-0x00007FFB2F960000-0x00007FFB2FE7E000-memory.dmp

Download

memory/6044-560-0x000001B3EF3D0000-0x000001B3EF45A000-memory.dmp

Download

memory/6044-558-0x000001B3EEF50000-0x000001B3EEF9E000-memory.dmp

Download

memory/6044-545-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-550-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-567-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-539-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-564-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-559-0x000001B3EF3D0000-0x000001B3EF45A000-memory.dmp

Download

memory/6044-544-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-546-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-562-0x000001B3EF3D0000-0x000001B3EF45A000-memory.dmp

Download

memory/6044-561-0x000001B3EF3D0000-0x000001B3EF45A000-memory.dmp

Download

memory/6044-543-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-602-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-538-0x00007FFB529E0000-0x00007FFB529E2000-memory.dmp

Download

memory/6044-536-0x000001B3EE5A0000-0x000001B3EEE77000-memory.dmp

Download

memory/6044-531-0x00007FFB2F960000-0x00007FFB2FE7E000-memory.dmp

Download

memory/6044-530-0x00007FFB529D0000-0x00007FFB529D2000-memory.dmp

Download