f41b616173dd7f9611680ac821ff75348b6cb741b6644d9ddefedf5a15b52238

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/10/2026, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.04.exe
Size 30.5MB
Sample261025-crpgmsts2n
SHA256 f41b616173dd7f9611680ac821ff75348b6cb741b6644d9ddefedf5a15b52238
MD5 642d877d72f6c2484bf6efdfa59909da
SHA1 9d89e64437e2737f7eb4b58a0f7d3583133d9642
SHA512 6a38a6f8f12e438a2c641ba12af60478a2017afb583f565656e0098a32060548fe90a2ac7f1d6e032375fafa610a5e2933d361087794b3aa1d0463c4d6a68b33
SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYb:TC/p+HuPOc4m
TLSH
T18367181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\oCCzOo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	wz0ggS.exe

Executes dropped EXE 2 IoCs

pid	Process
3920	wz0ggS.exe
2444	wz0ggS.exe

Loads dropped DLL 2 IoCs

pid	Process
3920	wz0ggS.exe
2444	wz0ggS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\oCCzOo\\wz0ggS.exe\""	wz0ggS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\oCCzOo\\wz0ggS.exe\""	wz0ggS.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4380	cmd.exe
1600	cmd.exe
2648	cmd.exe
4220	cmd.exe
2480	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	wz0ggS.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	wz0ggS.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\XNGaHa	wz0ggS.exe
File created	C:\Program Files (x86)\XNGaHa\XNGaHa.exe	wz0ggS.exe
File created	C:\Program Files (x86)\XNGaHa\XPSPLOG.dll	wz0ggS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
548	cmd.exe
3320	cmd.exe
4424	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.04.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wz0ggS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wz0ggS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.04.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1588	schtasks.exe
4716	schtasks.exe
3824	schtasks.exe
4788	schtasks.exe
2204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
1992	install.2.0.04.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe
3920	wz0ggS.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2480	3920	wz0ggS.exe	95
PID 2480 wrote to memory of 1588	2480	cmd.exe	97
PID 2480 wrote to memory of 4760	2480	cmd.exe	98
PID 2480 wrote to memory of 1908	2480	cmd.exe	101
PID 3320 wrote to memory of 1360	3320	cmd.exe	104
PID 3920 wrote to memory of 4380	3920	wz0ggS.exe	106
PID 4380 wrote to memory of 4716	4380	cmd.exe	109
PID 4380 wrote to memory of 2368	4380	cmd.exe	110
PID 4380 wrote to memory of 1956	4380	cmd.exe	112
PID 3920 wrote to memory of 1600	3920	wz0ggS.exe	113
PID 1600 wrote to memory of 3824	1600	cmd.exe	115
PID 3920 wrote to memory of 2648	3920	wz0ggS.exe	116
PID 1600 wrote to memory of 2292	1600	cmd.exe	118
PID 2648 wrote to memory of 4788	2648	cmd.exe	121
PID 3920 wrote to memory of 4220	3920	wz0ggS.exe	123
PID 1600 wrote to memory of 5116	1600	cmd.exe	125
PID 2648 wrote to memory of 180	2648	cmd.exe	126
PID 4220 wrote to memory of 2204	4220	cmd.exe	127
PID 2648 wrote to memory of 3060	2648	cmd.exe	128
PID 4220 wrote to memory of 4676	4220	cmd.exe	129
PID 4424 wrote to memory of 4700	4424	cmd.exe	130
PID 548 wrote to memory of 4000	548	cmd.exe	131
PID 4220 wrote to memory of 4576	4220	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1992

C:\Users\Public\oCCzOo\wz0ggS.exe
C:\Users\Public\oCCzOo\wz0ggS.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\oCCzOo\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\oCCzOo\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1588
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2292
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4676
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4576

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\oCCzOo" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\oCCzOo" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1360

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1692

C:\Users\Public\oCCzOo\wz0ggS.exe
"C:\Users\Public\oCCzOo\wz0ggS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2444

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4700

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 2759a25294e8cd34c576fbeff6257985345913cd1bfc7c6c6767e84c70c56a23
MD5 431eed23fe7b53c89ba95fe34472990a
SHA1 fecfcaae9e17acd4ed7aa9c592e7ce5961d5c4f3
SHA512 67355f87bbe632d6b1ba96e31ad5dc559e323473f5bb8d896280e9d0a8433a2a420af823f3b5951e3e2d91c2dd9afa81117a345d51bb6a5b7249fd6d725b3b59
TLSH
T11C31B9BB5F6C7D86EF7A4D8919CAE6311CE5A1907CC5458A1115C0989F4C3F16E0F90D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 2f3da888be0cfe139642e2f889ad1d9506afc1dafb7f75d23bb8287dc1716cca
MD5 148901b187510d9febd99bd9a0405878
SHA1 63086d8bd2dfd5554a35af9ad1a4d8239a52d11b
SHA512 3c25428166ea5868c34690dc43d53294a1336fc3a1209ec3f7487c5eda9dff2946d58c6bb71924e4a03dd9d0fe29227448f8af4bf6a976e2fd1686a835efd684
TLSH
T1FD31B697CF392002EF0C9F7452D1D62B6CF5A1255CE84C41662FD19A8A497B34F85046
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 13caa2eca0449fb518b18ac5332f4123cb5cd24b0439881a97fd44f8fd38f1e2
MD5 4fb38b7a884dc3776ad56b77b0f80409
SHA1 e2810d47288f1d0a3e85578c548d66056eb9cde6
SHA512 c5b72e5fd2dacc0b514136677381aa047c58dcd3d56e204dde84949bdffb30abd0b87f265c29741c710d86a04bc8cf6ad7a7ddaf737ae347356698323fba5f8b
TLSH
T12DF05C249DF8C13DF133D93C8EEA75590E7BFA06140745EC06B58709B692F042D565BE
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 ffff38c055fc6d4699b8aff4c72d8acc5d835d7eece39e8170963d72132cb362
MD5 2720d3f44a285c1a171063acf8da9dc6
SHA1 53a35f8a42188fad0668578be7c117ba1267f8b8
SHA512 ecb6db99984299a3bab56a9974205bd59794d75ecfe4545d26653c5389997979771798fbe7bdfeb8b616c1b2639caf76db40e49da34dbea9add6cab36e163eac
TLSH
T122F0DC2891D8502FF077C2F88AC27670A23AD5331407E9BE0EE603442FA2F011C026AD
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\oCCzOo\UxEnhance64.dll
Size 3.1MB
SHA256 3414f07ab7e3a399d573f8ab7570f1a411dce439e9a74bda79d1ea0ed84d38e0
MD5 4c9b1f8b38f7c41c030c649372c7d701
SHA1 e2a1be5739affd427c7ce00885403d44c117982f
SHA512 e023b9eb40bc1296a198578ae701f7a51aa8b35d49899943e5ad46b0c8e8816e073899e1c3c918e3b959e589a4598ac23bfd9de0549def6c7890a78118b4a183
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+o:P9m29xx3Tiqt06ox6+z2rNNrKoo
TLSH
T1B7E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\oCCzOo\adoresd.dat
Size 4.8MB
SHA256 10797519f976cbc8c6119ec41d50635ab0a5b74920a1cc0cec904bfa950767bb
MD5 9c42c81d7092bb8be4ca32d731f8dd34
SHA1 a53e8c0b4a2e4e2537a6226e40cc8280f69015d4
SHA512 bfa22331ee85b81d8cb1476a8f2d38b0f778c9853ce3bbfff6566aba1987bc2340dc7d53969d6a11a7fae20cd56a9310f3796748d35c2f2b0c2025bf7c88c54b
SSDEEP 98304:3Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:3Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1EB3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\oCCzOo\msadox.tb
Size 8KB
SHA256 e002134b01a7ad6ade0f19497b036d69de75de151645177cd618d5fa46d60398
MD5 6cf6179a048ed79ec35b3bb95ae599ff
SHA1 a44ed989a42d7a8966b8f0fcd8277b1630e2488e
SHA512 769c2711d38d110dba840803213957e49e724d3f0252a06f1f859515e5a726ab6876cb4f7cc6dc43ba7dee9257a0aa800d485a8ca7e49e771d112b1548448606
SSDEEP 192:eqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:esZqZOXQ3uqvR2Kfzp
TLSH
T1B3029E06D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wz0ggS.exe

Path C:\Users\Public\oCCzOo\wz0ggS.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiPolicy.p7b

Path C:\Windows\System32\CodeIntegrity\SiPolicy.p7b
Size 24KB
SHA256 b3f17065ed63b17ffef175f2979907d8eef69a76ba4cbd1d9785035a0b1f0a10
MD5 c99441a9b83d3866d88abfdf45894d3d
SHA1 3e32a4131855a8296b6238294a03d8eabcad6f9c
SHA512 c13bb76ef20055b5e923272c4cd976e93e5f21c5b7f8664e5d60a4918e92d0ab4abd3efa63a549b52536986fc3434a9ef1f808be76a12f47e43fdd9e58f275f6
SSDEEP 48:GwIn0NHUVyHU1yHUccy3GwaAvdV6dVwNdVojdVKdVqdmded9dod1d9Ud0dOdbd81:Any8yU88yldGVDP4NMC2/22M/0rw
TLSH
T11CB2C6803BEEC559F3B3DA71AFB6C6AA903AFC91AD11531F71C9735E1432800D529B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1992-504-0x00007FFC8A6B0000-0x00007FFC8A6C0000-memory.dmp

Download

memory/1992-0-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/1992-525-0x00007FFC8A6B0000-0x00007FFC8A6C0000-memory.dmp

Download

memory/1992-524-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/1992-2-0x0000000000430000-0x000000000043C000-memory.dmp

Download

memory/1992-1-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/2444-592-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-599-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-619-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-617-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-606-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-610-0x0000015015F90000-0x000001501601A000-memory.dmp

Download

memory/2444-611-0x0000015015F90000-0x000001501601A000-memory.dmp

Download

memory/2444-612-0x0000015015F90000-0x000001501601A000-memory.dmp

Download

memory/2444-609-0x0000015015F90000-0x000001501601A000-memory.dmp

Download

memory/2444-593-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-594-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-591-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-586-0x00007FFC994C0000-0x00007FFC994C2000-memory.dmp

Download

memory/2444-587-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-580-0x00000150169D0000-0x00000150172A7000-memory.dmp

Download

memory/2444-577-0x00007FFC7B090000-0x00007FFC7B5AE000-memory.dmp

Download

memory/3920-596-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download

memory/3920-563-0x0000015A48DB0000-0x0000015A48E3A000-memory.dmp

Download

memory/3920-543-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download

memory/3920-538-0x00007FFC994C0000-0x00007FFC994C2000-memory.dmp

Download

memory/3920-555-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download

memory/3920-531-0x00007FFC7B090000-0x00007FFC7B5AE000-memory.dmp

Download

memory/3920-560-0x0000015A48CD0000-0x0000015A48D1E000-memory.dmp

Download

memory/3920-561-0x0000015A48DB0000-0x0000015A48E3A000-memory.dmp

Download

memory/3920-539-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download

memory/3920-536-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download

memory/3920-544-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download

memory/3920-564-0x0000015A48DB0000-0x0000015A48E3A000-memory.dmp

Download

memory/3920-530-0x00007FFC994B0000-0x00007FFC994B2000-memory.dmp

Download

memory/3920-562-0x0000015A48DB0000-0x0000015A48E3A000-memory.dmp

Download

memory/3920-556-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download

memory/3920-550-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download

memory/3920-546-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download

memory/3920-545-0x0000015A48010000-0x0000015A488E7000-memory.dmp

Download