ab175edd428d80f98c0eb7625444cd4121ec9c01c3de7e88ca930cadecc3a6c2

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.06.exe
Size 30.5MB
Sample261024-sb456act3q
SHA256 ab175edd428d80f98c0eb7625444cd4121ec9c01c3de7e88ca930cadecc3a6c2
MD5 3963ab5bb3554a9d2fa2d676a299784c
SHA1 342577e7db227a9a36d33054943df0a039df7175
SHA512 ddc685f30d216b7181a72568d65598d72b0e9e92251251ac4a1645b260a56b3db65891ae5002dd8bbacb5ac9d932e863047ce692a31728b85899a87f07e8aa31
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYb:YC/p+HuPOc4m
TLSH
T14767181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Qdm4nm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6028	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4340	PhdZVx.exe
1536	PhdZVx.exe

Loads dropped DLL 2 IoCs

pid	Process
4340	PhdZVx.exe
1536	PhdZVx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Qdm4nm\\PhdZVx.exe\""	PhdZVx.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4388	cmd.exe
4868	cmd.exe
1808	cmd.exe
2840	cmd.exe
5168	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	PhdZVx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2728	cmd.exe
1404	cmd.exe
5972	cmd.exe
4972	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PhdZVx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PhdZVx.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3128	schtasks.exe
2744	schtasks.exe
2828	schtasks.exe
3804	schtasks.exe
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4160	install.2.0.06.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe
4340	PhdZVx.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeIncreaseQuotaPrivilege	6028	powershell.exe
Token: SeSecurityPrivilege	6028	powershell.exe
Token: SeTakeOwnershipPrivilege	6028	powershell.exe
Token: SeLoadDriverPrivilege	6028	powershell.exe
Token: SeSystemProfilePrivilege	6028	powershell.exe
Token: SeSystemtimePrivilege	6028	powershell.exe
Token: SeProfSingleProcessPrivilege	6028	powershell.exe
Token: SeIncBasePriorityPrivilege	6028	powershell.exe
Token: SeCreatePagefilePrivilege	6028	powershell.exe
Token: SeBackupPrivilege	6028	powershell.exe
Token: SeRestorePrivilege	6028	powershell.exe
Token: SeShutdownPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeSystemEnvironmentPrivilege	6028	powershell.exe
Token: SeRemoteShutdownPrivilege	6028	powershell.exe
Token: SeUndockPrivilege	6028	powershell.exe
Token: SeManageVolumePrivilege	6028	powershell.exe
Token: 33	6028	powershell.exe
Token: 34	6028	powershell.exe
Token: 35	6028	powershell.exe
Token: 36	6028	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 6028	4340	PhdZVx.exe	92
PID 4340 wrote to memory of 1808	4340	PhdZVx.exe	94
PID 1808 wrote to memory of 3128	1808	cmd.exe	96
PID 1808 wrote to memory of 1292	1808	cmd.exe	98
PID 1808 wrote to memory of 4844	1808	cmd.exe	101
PID 4340 wrote to memory of 2840	4340	PhdZVx.exe	102
PID 4340 wrote to memory of 5168	4340	PhdZVx.exe	105
PID 2840 wrote to memory of 2744	2840	cmd.exe	108
PID 5168 wrote to memory of 2828	5168	cmd.exe	109
PID 2840 wrote to memory of 3388	2840	cmd.exe	110
PID 5168 wrote to memory of 2136	5168	cmd.exe	112
PID 4340 wrote to memory of 4388	4340	PhdZVx.exe	113
PID 5168 wrote to memory of 1204	5168	cmd.exe	115
PID 2840 wrote to memory of 2832	2840	cmd.exe	116
PID 4388 wrote to memory of 3804	4388	cmd.exe	117
PID 4388 wrote to memory of 4752	4388	cmd.exe	120
PID 4340 wrote to memory of 4868	4340	PhdZVx.exe	122
PID 4388 wrote to memory of 2572	4388	cmd.exe	124
PID 4868 wrote to memory of 2604	4868	cmd.exe	125
PID 4868 wrote to memory of 6004	4868	cmd.exe	126
PID 4868 wrote to memory of 4448	4868	cmd.exe	130
PID 4972 wrote to memory of 3244	4972	cmd.exe	132
PID 5972 wrote to memory of 4976	5972	cmd.exe	133
PID 1404 wrote to memory of 4964	1404	cmd.exe	134
PID 2728 wrote to memory of 1224	2728	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2980

C:\Users\Public\Qdm4nm\PhdZVx.exe
"C:\Users\Public\Qdm4nm\PhdZVx.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Qdm4nm\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Qdm4nm\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1292
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3804
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6004
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4448

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Qdm4nm" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Qdm4nm" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1224

C:\Users\Public\Qdm4nm\PhdZVx.exe
"C:\Users\Public\Qdm4nm\PhdZVx.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5604

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4964

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4976

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 8be574b189a40cd482cc5eb65c71645f10a410148a8addf08de435d196276a76
MD5 97de2a09228dab58e546f1e76d0b1e2b
SHA1 acf102b8c99be254a8c0c3094e1c7ad549c73a3b
SHA512 fb7fa82a0226243ee2bed8b03a697906c099df05ef4ed52f38f4c0b9501ff34e3c1548f116a42f8819e4e5fea27e2ed7ae5e67e502e825b6d41c5d463fc1ecb0
TLSH
T1B431EBBB6F2DBE424F3D8E9016C9F1226CF5D1806EC7409E6115C8A95F043722F5E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 140ddad6346ab9e2215d6852a87a1674567d4881fab6f2e5c3507fb9cfc7f18c
MD5 16b768681a89a0a2da1365ff7d2f3d0a
SHA1 6e995c36f45c228538e70da8c8476a724c3bd328
SHA512 c1e1f4a2edc2e35fd119e93e517d7a89388440e5af067dbca3ac6a19c87a86976ea80b94051aa7a04cee50cc46c680a383858b0869b72a11e3e6bd5d5dfd6865
TLSH
T1F031F8A39E795053EB0C2FA966D1C6373CF0B674ADE44845763EC2AF8605B77AF85008
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 93c0fdfcc26f88546d37c7c5841bcb06a11f4e871f811cf4ba28f63029b2c67f
MD5 c447a4721439ed3d2145221c93749d54
SHA1 cd5930d1c892db1f9d018caa70ba30ded389a9b2
SHA512 67ae77c4d74f1006df0777a0bc24b0b5fd3a535f4620286a8568a8b5f27e52567f9f544027a51702175889d721efba63f0379e736f85d1f854653f276284d475
TLSH
T105F0271899BC412EF132DA3D86D97A9B0E7EF717240689A406E84709A246D823C627B5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 9593655a70e3aa4de21f1da76423b97895a87f83b8af046e3279e872a15e6925
MD5 18c8634d0b694622a32288578fbe8b06
SHA1 b8e11832c432bd7447393e30e7b8e5d9e4ba369d
SHA512 fdf85a719bb0c2b1c120fa0415649c3df8d9ab21d34e274f7b1e8bb9d139d22b156487d879aff16821beab68800dfe2f609622d835385769ac7b2dc1eab26843
TLSH
T1E1F05C3D56EE001BF17BD1B8CBC27D735F6AEA633006737A0DE907445E92C416C912A9
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nxswic43.h2f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nxswic43.h2f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PhdZVx.exe

Path C:\Users\Public\Qdm4nm\PhdZVx.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Qdm4nm\UxEnhance64.dll
Size 3.1MB
SHA256 26321a1aebd82ff30d4d03359f740ebf622f29b90d6eb79f64ef3c64855adb38
MD5 6533302a96f05aa83566f8a9ffe717ec
SHA1 653a14da293fffdb3d54590f09092c3d4a6396ac
SHA512 766b2363dc16c72b14990c900847107d09d69eda5e46dc3d30af994b8fd25ccb2421154fef17fe1b5026691340717b40e356675cef3008259227c6e9e6866da5
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+I:P9m29xx3Tiqt06ox6+z2rNNrKoI
TLSH
T182E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Qdm4nm\adoresd.dat
Size 4.8MB
SHA256 2b6e4a54745696185d7c41127249c9e7418865ee7fd16a040425618f497369ed
MD5 363fbd96dff1d1409c9582270edab9e3
SHA1 35f25f5345ecefebf306a62cc1dec15911fc987e
SHA512 abf3fc6e0210fa26e8b4b8f9e1771385942edb646161c1a2674adb618df32cc66158cdb8600a12a1e6f769b6b3e9976f56453aec5839e5ebc86c03caa542c050
SSDEEP 98304:zWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:zWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1123633AB2FC2F55F5583315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Qdm4nm\msadox.tb
Size 8KB
SHA256 82db8d80b495ca61c068c19d78b4b8f5d06f1456cd1ab854c11a322e51d7e3c2
MD5 454d0638c750fe9a9e9441d877adfe5d
SHA1 ee55458488f2a812e4d20f68d2e44ea80ebd4e2b
SHA512 047701419ebaca3f8f4cec2e250fdf6de33f7a7a5e6f9718937329fad5eb536e62377d1c4e0814fbde8ac977786bffc1e3efb15b6c91243c119582f250f4986d
SSDEEP 192:xqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:xsZqZOXQ3uqvR2Kfzp
TLSH
T198029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-591-0x00000215A2310000-0x00000215A2BE7000-memory.dmp

Download

memory/1536-590-0x00000215A2310000-0x00000215A2BE7000-memory.dmp

Download

memory/1536-578-0x00000215A2310000-0x00000215A2BE7000-memory.dmp

Download

memory/1536-592-0x00000215A2310000-0x00000215A2BE7000-memory.dmp

Download

memory/1536-593-0x00000215A2310000-0x00000215A2BE7000-memory.dmp

Download

memory/1536-594-0x00007FFA0C150000-0x00007FFA0C152000-memory.dmp

Download

memory/1536-585-0x00007FFA0C160000-0x00007FFA0C162000-memory.dmp

Download

memory/1536-586-0x00000215A2310000-0x00000215A2BE7000-memory.dmp

Download

memory/1536-575-0x00007FF9E9480000-0x00007FF9E999E000-memory.dmp

Download

memory/4160-2-0x0000000002730000-0x000000000273C000-memory.dmp

Download

memory/4160-1-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/4160-504-0x00007FFA01C40000-0x00007FFA01C52000-memory.dmp

Download

memory/4160-527-0x00007FFA01C40000-0x00007FFA01C52000-memory.dmp

Download

memory/4160-526-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/4160-0-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/4340-548-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-549-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-567-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-568-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-562-0x000001E4D34F0000-0x000001E4D357A000-memory.dmp

Download

memory/4340-564-0x000001E4D34F0000-0x000001E4D357A000-memory.dmp

Download

memory/4340-565-0x000001E4D34F0000-0x000001E4D357A000-memory.dmp

Download

memory/4340-559-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-563-0x000001E4D34F0000-0x000001E4D357A000-memory.dmp

Download

memory/4340-553-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-534-0x00007FF9E9480000-0x00007FF9E999E000-memory.dmp

Download

memory/4340-561-0x000001E4D3410000-0x000001E4D345E000-memory.dmp

Download

memory/4340-547-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-546-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-542-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-541-0x00007FFA0C160000-0x00007FFA0C162000-memory.dmp

Download

memory/4340-539-0x000001E4D27F0000-0x000001E4D30C7000-memory.dmp

Download

memory/4340-533-0x00007FFA0C150000-0x00007FFA0C152000-memory.dmp

Download

memory/6028-601-0x00000237E1880000-0x00000237E18A2000-memory.dmp

Download

memory/6028-614-0x00000237E1B30000-0x00000237E1B4E000-memory.dmp

Download

memory/6028-615-0x00000237E1B50000-0x00000237E1C02000-memory.dmp

Download

memory/6028-618-0x00000237E1C10000-0x00000237E1C1A000-memory.dmp

Download