1c9f20f931143036616204493757aeb21354ce81adce5e4923fdb4ae738aec9e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261024-twddlszz4j
SHA256 1c9f20f931143036616204493757aeb21354ce81adce5e4923fdb4ae738aec9e
MD5 e42215faeac6df11741bb2e853faef56
SHA1 be50a926693e62a7efafc6e78bb0892186ea0b35
SHA512 eccfe59519b3e6044ddc90d1ecfd01b26264123e2c3ed99d8570ee47737fa144d1d385c746eea3fd8a10038a2c3168c4ea1bbf193593d445904af4b4fa501ad8
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsX5:q6chqTShW/hNbSiQfMJPLmrUls5
TLSH
T14997D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	nfHyc7.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\PV19oZ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	nfHyc7.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	LMK8Hk.exe

Executes dropped EXE 6 IoCs

pid	Process
4840	LMK8Hk.exe
5932	LMK8Hk.exe
5780	nfHyc7.exe
4556	nfHyc7.exe
4540	nfHyc7.exe
2684	1B17V.exe

Loads dropped DLL 6 IoCs

pid	Process
4840	LMK8Hk.exe
5932	LMK8Hk.exe
5780	nfHyc7.exe
4556	nfHyc7.exe
4540	nfHyc7.exe
2684	1B17V.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1540	icacls.exe
964	icacls.exe
2364	icacls.exe
5920	icacls.exe
4208	icacls.exe
560	icacls.exe
1556	icacls.exe
2884	icacls.exe
4764	icacls.exe
5100	icacls.exe
3488	icacls.exe
2096	icacls.exe
4672	icacls.exe
3772	icacls.exe
5564	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\PV19oZ\\LMK8Hk.exe\""	LMK8Hk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\nfHyc7\\nfHyc7.exe\""	nfHyc7.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2256	cmd.exe
5452	cmd.exe
1784	cmd.exe
4256	cmd.exe
1144	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	LMK8Hk.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\o3M924A\thumbs.db	nfHyc7.exe
File opened for modification	C:\Program Files (x86)\nfHyc7\image.png	LMK8Hk.exe
File opened for modification	C:\Program Files (x86)\nfHyc7\thumbs.db	LMK8Hk.exe
File created	C:\Program Files (x86)\o3M924A\XPSPLOG.dll	nfHyc7.exe
File created	C:\Program Files (x86)\nfHyc7\XPSPLOG.dll	LMK8Hk.exe
File created	C:\Program Files (x86)\nfHyc7\thumbs.db	LMK8Hk.exe
File opened for modification	C:\Program Files (x86)\nfHyc7\XPSPLOG.dll	LMK8Hk.exe
File created	C:\Program Files (x86)\o3M924A\image.png	nfHyc7.exe
File opened for modification	C:\Program Files (x86)\o3M924A\1B17V.exe	nfHyc7.exe
File opened for modification	C:\Program Files (x86)\o3M924A\XPSPLOG.dll	nfHyc7.exe
File created	C:\Program Files (x86)\nfHyc7\nfHyc7.exe	LMK8Hk.exe
File opened for modification	C:\Program Files (x86)\o3M924A	nfHyc7.exe
File opened for modification	C:\Program Files (x86)\o3M924A\image.png	nfHyc7.exe
File created	C:\Program Files (x86)\o3M924A\1B17V.exe	nfHyc7.exe
File opened for modification	C:\Program Files (x86)\nfHyc7	LMK8Hk.exe
File created	C:\Program Files (x86)\nfHyc7\image.png	LMK8Hk.exe
File opened for modification	C:\Program Files (x86)\nfHyc7\nfHyc7.exe	LMK8Hk.exe
File created	C:\Program Files (x86)\o3M924A\thumbs.db	nfHyc7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaveActive = "0"	nfHyc7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nfHyc7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\SCRNSAVE.EXE	nfHyc7.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
228	cmd.exe
64	cmd.exe
5704	cmd.exe
1432	cmd.exe
2592	cmd.exe
3048	cmd.exe
3172	cmd.exe
3236	cmd.exe
2584	cmd.exe
5148	cmd.exe
5160	cmd.exe
5016	cmd.exe
928	cmd.exe
5096	cmd.exe
1304	cmd.exe
1132	cmd.exe
456	cmd.exe
5992	cmd.exe
4356	cmd.exe
3608	cmd.exe
5384	cmd.exe
8	cmd.exe
3412	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	LMK8Hk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nfHyc7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nfHyc7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	LMK8Hk.exe

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nfHyc7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nfHyc7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1B17V.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nfHyc7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaveActive = "0"	nfHyc7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nfHyc7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	nfHyc7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\SCRNSAVE.EXE	nfHyc7.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
640	schtasks.exe
4976	schtasks.exe
3972	schtasks.exe
5032	schtasks.exe
5848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
3132	install.2.0.02.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe
4840	LMK8Hk.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2256	4840	LMK8Hk.exe	99
PID 4840 wrote to memory of 5452	4840	LMK8Hk.exe	103
PID 2256 wrote to memory of 5032	2256	cmd.exe	105
PID 2256 wrote to memory of 5908	2256	cmd.exe	107
PID 5452 wrote to memory of 5848	5452	cmd.exe	109
PID 2256 wrote to memory of 4948	2256	cmd.exe	111
PID 5452 wrote to memory of 368	5452	cmd.exe	112
PID 4840 wrote to memory of 1784	4840	LMK8Hk.exe	113
PID 5452 wrote to memory of 6036	5452	cmd.exe	116
PID 1784 wrote to memory of 640	1784	cmd.exe	118
PID 1784 wrote to memory of 240	1784	cmd.exe	119
PID 3172 wrote to memory of 3932	3172	cmd.exe	122
PID 4840 wrote to memory of 4256	4840	LMK8Hk.exe	123
PID 4840 wrote to memory of 1144	4840	LMK8Hk.exe	125
PID 1784 wrote to memory of 5184	1784	cmd.exe	127
PID 1144 wrote to memory of 4976	1144	cmd.exe	128
PID 4256 wrote to memory of 3972	4256	cmd.exe	129
PID 1144 wrote to memory of 3420	1144	cmd.exe	130
PID 4256 wrote to memory of 3508	4256	cmd.exe	131
PID 1144 wrote to memory of 4052	1144	cmd.exe	133
PID 4256 wrote to memory of 5088	4256	cmd.exe	134
PID 228 wrote to memory of 1508	228	cmd.exe	136
PID 3608 wrote to memory of 3700	3608	cmd.exe	137
PID 4840 wrote to memory of 5780	4840	LMK8Hk.exe	138
PID 5780 wrote to memory of 1304	5780	nfHyc7.exe	140
PID 5780 wrote to memory of 1132	5780	nfHyc7.exe	143
PID 5780 wrote to memory of 3236	5780	nfHyc7.exe	147
PID 5780 wrote to memory of 5384	5780	nfHyc7.exe	150
PID 5780 wrote to memory of 3412	5780	nfHyc7.exe	153
PID 5780 wrote to memory of 8	5780	nfHyc7.exe	155
PID 1132 wrote to memory of 3772	1132	cmd.exe	157
PID 5780 wrote to memory of 5096	5780	nfHyc7.exe	158
PID 5096 wrote to memory of 1556	5096	cmd.exe	160
PID 5780 wrote to memory of 3048	5780	nfHyc7.exe	161
PID 3048 wrote to memory of 4672	3048	cmd.exe	163
PID 5780 wrote to memory of 928	5780	nfHyc7.exe	164
PID 928 wrote to memory of 2884	928	cmd.exe	166
PID 5780 wrote to memory of 2592	5780	nfHyc7.exe	167
PID 2592 wrote to memory of 5920	2592	cmd.exe	169
PID 5780 wrote to memory of 5016	5780	nfHyc7.exe	170
PID 5016 wrote to memory of 5100	5016	cmd.exe	172
PID 5780 wrote to memory of 5160	5780	nfHyc7.exe	173
PID 5160 wrote to memory of 2096	5160	cmd.exe	175
PID 5780 wrote to memory of 5148	5780	nfHyc7.exe	176
PID 5148 wrote to memory of 4208	5148	cmd.exe	178
PID 5780 wrote to memory of 1432	5780	nfHyc7.exe	179
PID 1432 wrote to memory of 4764	1432	cmd.exe	181
PID 5780 wrote to memory of 4356	5780	nfHyc7.exe	182
PID 4356 wrote to memory of 5564	4356	cmd.exe	184
PID 5780 wrote to memory of 5992	5780	nfHyc7.exe	185
PID 5992 wrote to memory of 1540	5992	cmd.exe	187
PID 5780 wrote to memory of 5704	5780	nfHyc7.exe	188
PID 5704 wrote to memory of 560	5704	cmd.exe	190
PID 5780 wrote to memory of 456	5780	nfHyc7.exe	191
PID 456 wrote to memory of 2364	456	cmd.exe	193
PID 5780 wrote to memory of 2584	5780	nfHyc7.exe	194
PID 2584 wrote to memory of 964	2584	cmd.exe	196
PID 5780 wrote to memory of 64	5780	nfHyc7.exe	197
PID 64 wrote to memory of 3488	64	cmd.exe	199

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	nfHyc7.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3132

C:\Users\Public\PV19oZ\LMK8Hk.exe
C:\Users\Public\PV19oZ\LMK8Hk.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\PV19oZ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\PV19oZ\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:240
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4052
- C:\Program Files (x86)\nfHyc7\nfHyc7.exe
  "C:\Program Files (x86)\nfHyc7\nfHyc7.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5780
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3412
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:8
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4672
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\nfHyc7.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\nfHyc7.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\nfHyc7.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\nfHyc7.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\nfHyc7.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\nfHyc7.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2096
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:560
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:964
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nfHyc7\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nfHyc7\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3488

C:\Users\Public\PV19oZ\LMK8Hk.exe
"C:\Users\Public\PV19oZ\LMK8Hk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5932

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\PV19oZ" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\PV19oZ" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3932

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3376

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1508

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3700

C:\Program Files (x86)\nfHyc7\nfHyc7.exe
"C:\Program Files (x86)\nfHyc7\nfHyc7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4540

C:\Program Files (x86)\nfHyc7\nfHyc7.exe
"C:\Program Files (x86)\nfHyc7\nfHyc7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4556

C:\Program Files (x86)\o3M924A\1B17V.exe
"C:\Program Files (x86)\o3M924A\1B17V.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\nfHyc7\XPSPLOG.dll
Size 4.6MB
SHA256 40ba84faf4516d1d7cc86d67f61a8c720cf85202a3c2c961481d4ad091a1e8df
MD5 83daf925eda4860b1c4c1b82fe73144c
SHA1 67227c0eb6336b60f1900080df34293c29bb38e8
SHA512 665f9f75d817af386b3a99a87a11bb4849dd8b9d8761c445b36a2b0a18bcb8ec6b86335e6292e48d88fba2030d1824cfc61eaaf9dbaae248d698465c359a4e63
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyE:BMWKfU+BcUTHCCCfqCiUffnE
TLSH
T12D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\nfHyc7\image.png
Size 4.8MB
SHA256 c8df1e7adb92fbdd57136415e8a25a4a4dd2ad02fffca41642ebdad6ad40b8e0
MD5 b4c1248cf5e90d95fbbb1957693fdeee
SHA1 33ccf4cb30d1a085d6f031d03fa858f51a3bd16d
SHA512 482aa7ddea5e4d82b67f8555cdb25d4fbdf302bf5907b52f718af1105c35d00ba0a5597282399599943f0f1ed8cd3d709a859b06e918ab3a7717df29266ef1d2
SSDEEP 98304:m/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:mMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1A736334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfHyc7.exe

Path C:\Program Files (x86)\nfHyc7\nfHyc7.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\nfHyc7\thumbs.db
Size 358KB
SHA256 12687116518db04ffc4887a8fc686eccf2a5e1abd4ca5be7fdc73643c5a281f9
MD5 fcd02306a771df2950d037f8d4cabfaa
SHA1 cbd61a02ba29976fb551b632451d650541ad9cd0
SHA512 341d151bac45fb3dab0d0a3f605c26aa533e0b0ab2a460a1bfa5de5311791ccd83cf1a04568696638066a80fde7efe7b2ef389fff2bfde1b22f497e8a26c0579
SSDEEP 6144:jiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:28u69CghoQxoMTFQqtKFCz7mb/
TLSH
T12174F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\o3M924A\XPSPLOG.dll
Size 4.6MB
SHA256 192b91133d080ee2632c962672fe8672f338bd25d915228113a3c8694434fd52
MD5 0a28652daf41f94592e53314cbfe56e1
SHA1 716ea4019e71183da210aa5231a0e1647aacecf1
SHA512 0b11cee6c365619727207e65ec210b0e40874c46245f94eafbc6a6db738ca71a677cca0e78c70e0a29c9ae2b2a12ce892ce0d7cced802d20862fed396dfa37d0
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyw:BMWKfU+BcUTHCCCfqCiUffnw
TLSH
T14E263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\o3M924A\image.png
Size 4.8MB
SHA256 98a159605e6e206b88b0328e2125a9311818aeaf1f05d43c9a8daacca27bd428
MD5 235f288df9ef5c2d6a261110d4be67ec
SHA1 c127224256031db62a4e403c306dd5629b7d0385
SHA512 d791b5cb77c7f25c0de092519ce55db0413cfb60516f6ee3e767e09c399f238591f9b495c94dc610b2054c742482921834bc759ed70493b9c2c223f3d5a668b4
SSDEEP 98304://kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:/MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T11336334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 1536b2dc03501b4e6d1b9ea7b2714772fd68095cf038537ebdb7abfd26d72177
MD5 471967270f0025b2e8622092bc02937d
SHA1 0ec1a9602f8d1a9c61e8073ec28ad8c4b9c8e825
SHA512 7f2e69d198576f591cebff94c74787da6dec133255187ff91acc3fa3c50aa1899ea3bffdf1cff85717fcdcca54461c05da69da72360666958e60c69a1ba44074
TLSH
T1DC3177BF5F6975868F394E4115CDB2226DE5D1806CDF509A6111C8549F043616F8A908
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a0916b55774b1b3bf4b2b6513b70a4f8e66074ebb5d09a5e235b49cfe7163a85
MD5 02ff145f13bb8ef4435105531d2002be
SHA1 4f7bfc657d96181af6bd38a9984d5b44d717d8b1
SHA512 47f66f0743451c2286794ac5c3bb294801cbededdac06066a29436a7b74a492d2a834198f5c351345400e081fbe348f0237fcebc0dab031220146a606c4b4012
TLSH
T1F631F8924E35105ACF0C1B3652D0D93FACF496249CFC0841753DC2BE49157B75FC2844
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 a2f9de05bcb7767ae0e6bb55f483e07a34da04a3c29a0a85cafa99e99ead75a3
MD5 bb4f8c78c49dc0e385742086afa11807
SHA1 4b7289ebf5fce7db10de47557ff944aceb2d4b3a
SHA512 96496778549e33bb650201cb4ecb4dafe8788fa4250dc567d8ecad6194fe80e2edce8e81fc2f8d2174662018cff1def43d47e449c46830212bbe6477fd4e6a2e
TLSH
T1BAF09E184EFC412DF132D93CC6C5365A2D2AF601150A459412F40F095687E423E11175
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 6ad740701efd8a08736e45cc11d5086ad03180254beaa9cd25b962beb2456eab
MD5 fcda3090beb0db549efc3fd05547210b
SHA1 c1c177532146efcbf2a3dd0c1108267c7bec0684
SHA512 e98fdc794d0ea1a5bd982e52ea4e8ab0734331fe6ccab1725b59f7377ffa826b00ab9ee2d866d0231dc56bf234467d1a7158eef42b182340deaa448afd370c32
TLSH
T1E8F0A33595DD011FF13BD2F486C77EB15566D522300691EB0EB503046E63E015CC137D
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

LMK8Hk.exe

Path C:\Users\Public\PV19oZ\LMK8Hk.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\PV19oZ\UxEnhance64.dll
Size 3.1MB
SHA256 056719fe1f5e23f5ed18718dacdc2b993a78c8f273e931289a518eae49d1c430
MD5 dd7e2e4de68ff5407cbd3c5113a365da
SHA1 4e12d191194754400a50c62bddf7b904f3e095c0
SHA512 27442199361cd85603fbaca38ab3a541eefe899d6c5bac345b6644a14ee164eef833343255159fc681f407726d395afe5d9ed6b1257f4ab4e398a631c32b3196
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+H:P9m29xx3Tiqt06ox6+z2rNNrKoH
TLSH
T1B3E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\PV19oZ\adoresd.dat
Size 4.8MB
SHA256 cec394f3fa9f4cbb03a3bff3cde7d3578cb5a45362e8e33aa844838d3ffc05b5
MD5 66ab46216a2530b98617e3571d7be996
SHA1 30980e5d2951c7e42ea900f74953741ba61fdb0c
SHA512 7db8f569b245ffa49cba812778b8032712b057ef63a824c07e1a40b82c3e6e5c5368c4957c6781f08bbf3514ef131c44e33fb141ad0a82d2be2955ecbfd9a739
SSDEEP 98304:iWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:iWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1A73633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\PV19oZ\msadox.tb
Size 8KB
SHA256 01351e605db44e629e40b2bb20acc1c57233b57558b6db6d5b9a9256e38e9adc
MD5 3c988f69ed2e62b64ac6b6967781e71e
SHA1 ed8ac35be0912eb19c0327e47fc72c88957ec7f2
SHA512 a406943632b563098ddeef9f62971f4c2177bb4c2f77e6a1452f3c0eafc72d4ca91cac2caaeb9cfe6dbe47faceff6fbaa168992ba53135b3a696e61d632e9f53
SSDEEP 192:eqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:esZqZOXQ3uqvR2Kfzp
TLSH
T194029E05D7A20DC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/2684-749-0x0000000073CB0000-0x00000000743FA000-memory.dmp

Download

memory/2684-761-0x0000000003070000-0x000000000384D000-memory.dmp

Download

memory/2684-760-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/2684-748-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2684-764-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2684-757-0x0000000003070000-0x000000000384D000-memory.dmp

Download

memory/3132-504-0x00007FFA08340000-0x00007FFA08350000-memory.dmp

Download

memory/3132-525-0x00007FFA08340000-0x00007FFA08350000-memory.dmp

Download

memory/3132-524-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/3132-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/3132-2-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/3132-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/4540-722-0x00000000751A0000-0x00000000758EA000-memory.dmp

Download

memory/4540-743-0x0000000001740000-0x0000000001741000-memory.dmp

Download

memory/4540-721-0x0000000001400000-0x0000000001401000-memory.dmp

Download

memory/4540-729-0x0000000003BE0000-0x00000000043BD000-memory.dmp

Download

memory/4540-744-0x0000000003BE0000-0x00000000043BD000-memory.dmp

Download

memory/4540-747-0x0000000001400000-0x0000000001401000-memory.dmp

Download

memory/4556-725-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/4556-731-0x0000000003210000-0x00000000039ED000-memory.dmp

Download

memory/4556-726-0x00000000751A0000-0x00000000758EA000-memory.dmp

Download

memory/4556-759-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/4556-754-0x0000000003210000-0x00000000039ED000-memory.dmp

Download

memory/4556-753-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download

memory/4840-550-0x000001F9A1AC0000-0x000001F9A2397000-memory.dmp

Download

memory/4840-561-0x000001F9A24B0000-0x000001F9A253A000-memory.dmp

Download

memory/4840-555-0x000001F9A1AC0000-0x000001F9A2397000-memory.dmp

Download

memory/4840-556-0x000001F9A1AC0000-0x000001F9A2397000-memory.dmp

Download

memory/4840-530-0x00007FFA13570000-0x00007FFA13572000-memory.dmp

Download

memory/4840-564-0x000001F9A24B0000-0x000001F9A253A000-memory.dmp

Download

memory/4840-563-0x000001F9A24B0000-0x000001F9A253A000-memory.dmp

Download

memory/4840-562-0x000001F9A24B0000-0x000001F9A253A000-memory.dmp

Download

memory/4840-531-0x00007FF9F6C90000-0x00007FF9F71AE000-memory.dmp

Download

memory/4840-538-0x00007FFA13580000-0x00007FFA13582000-memory.dmp

Download

memory/4840-536-0x000001F9A1AC0000-0x000001F9A2397000-memory.dmp

Download

memory/4840-560-0x000001F9A23D0000-0x000001F9A241E000-memory.dmp

Download

memory/4840-545-0x000001F9A1AC0000-0x000001F9A2397000-memory.dmp

Download

memory/4840-546-0x000001F9A1AC0000-0x000001F9A2397000-memory.dmp

Download

memory/4840-539-0x000001F9A1AC0000-0x000001F9A2397000-memory.dmp

Download

memory/4840-544-0x000001F9A1AC0000-0x000001F9A2397000-memory.dmp

Download

memory/4840-543-0x000001F9A1AC0000-0x000001F9A2397000-memory.dmp

Download

memory/5780-716-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/5780-715-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/5780-689-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/5780-690-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5780-687-0x0000000003EC0000-0x0000000003ED4000-memory.dmp

Download

memory/5780-677-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/5780-674-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/5780-741-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/5780-672-0x00000000015D0000-0x00000000015D1000-memory.dmp

Download

memory/5780-670-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/5780-666-0x00000000751A0000-0x00000000758EA000-memory.dmp

Download

memory/5780-665-0x0000000001010000-0x0000000001011000-memory.dmp

Download

memory/5932-589-0x0000025E8C030000-0x0000025E8C907000-memory.dmp

Download

memory/5932-577-0x00007FF9F6C90000-0x00007FF9F71AE000-memory.dmp

Download

memory/5932-580-0x0000025E8C030000-0x0000025E8C907000-memory.dmp

Download

memory/5932-590-0x0000025E8C030000-0x0000025E8C907000-memory.dmp

Download

memory/5932-593-0x00007FFA13570000-0x00007FFA13572000-memory.dmp

Download

memory/5932-591-0x0000025E8C030000-0x0000025E8C907000-memory.dmp

Download

memory/5932-584-0x00007FFA13580000-0x00007FFA13582000-memory.dmp

Download

memory/5932-585-0x0000025E8C030000-0x0000025E8C907000-memory.dmp

Download

memory/5932-592-0x0000025E8C030000-0x0000025E8C907000-memory.dmp

Download