8435b7cfedf40f3b3414a8d91e89e9f4a7136fcb555bfe7c4dbbdb9537aed705

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
K816Bdrive20240829.exe
Size 5.1MB
Sample260605-ms4casez4k
SHA256 8435b7cfedf40f3b3414a8d91e89e9f4a7136fcb555bfe7c4dbbdb9537aed705
MD5 398b21e49a6fd82481d911ef84975d58
SHA1 7a42fe51414fb950a7b8926ad6892a1f93a5f0ed
SHA512 7f5664c08fe6f25face11815671296bc891d867690cc9766866d6bfa9e36778dc680a7bd51b8aff95e3d5d81bec228c1471d62c797b5bf3e3d1cadae66c2aa48
SSDEEP 98304:5ZHKpZbCBeZtIzTm7leny96mihEVBBZFnDDKVYzCtOZaC9v7+/UJulkgZnWI1:5lKLaHm7lekMhEVBxDKVYf9v7+/UVI1
TLSH
T1D2463301A3D384F5F92B4F7A49329118DD137D296FF268993CB9F20E563E2D91AB0B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4708	K816Bdrive20240829.tmp
400	Gaming Mouse 3.0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\K816B\skins\is-AIT1V.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-S3TS0.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\config\font\is-9BL59.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-VLT60.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-VSHG1.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-IO9NG.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-QP3PU.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\0_INI_CN\is-AV2SB.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-83THQ.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-CNQVC.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-K3I4O.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-88GFU.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-TGRS2.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-22CSK.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-F03H3.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-P33NE.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\0_INI_CN\macro\is-E9SLK.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\1_INI_EN\macroReset\is-2JMRK.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\config\is-730TG.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\is-DHQ33.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-RMP38.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\Gun\is-OFU74.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-I0HI7.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-0RJ78.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-JRPF5.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-PI0D3.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-6PI9S.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\0_INI_CN\is-AU5F6.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\0_INI_CN\is-IC6HB.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\0_INI_CN\is-J6E17.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\0_INI_CN\macro\is-C6ES1.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-7BJ78.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-AIGS5.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-CK7K1.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-79R5G.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\config\is-P8OAT.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-H3D0T.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-8PGF7.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-3SOA0.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\is-JUCVR.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-IRDAS.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\1_INI_EN\macroReset\is-HEIHS.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\Gun\is-CIKTN.tmp	K816Bdrive20240829.tmp
File opened for modification	C:\Program Files (x86)\K816B\unins000.dat	K816Bdrive20240829.tmp
File opened for modification	C:\Program Files (x86)\K816B\setup.ini	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-LBPH1.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-49TMV.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-B5SF0.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-NHT8N.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\1_INI_EN\is-QGPO1.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\1_INI_EN\is-3RBK6.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-H13CD.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-V8AE2.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-LK8UJ.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\0_INI_CN\is-PBC2M.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-FORBG.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\MacMenu\is-8QB6G.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-0SAP3.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-UKQDT.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-ANOJU.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-7SU5B.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\is-658QN.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\0_INI_CN\is-B3SQ4.tmp	K816Bdrive20240829.tmp
File created	C:\Program Files (x86)\K816B\skins\1_INI_EN\is-OAL6Q.tmp	K816Bdrive20240829.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	K816Bdrive20240829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	K816Bdrive20240829.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaming Mouse 3.0.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4520-0-0x0000000000400000-0x0000000000438000-memory.dmp	innosetup
behavioral2/memory/4520-7-0x0000000000400000-0x0000000000438000-memory.dmp	innosetup
behavioral2/memory/4520-683-0x0000000000400000-0x0000000000438000-memory.dmp	innosetup

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Mouse\MouseSensitivity = "10"	Gaming Mouse 3.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Desktop\WheelScrollLines = "6"	Gaming Mouse 3.0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4708	K816Bdrive20240829.tmp
4708	K816Bdrive20240829.tmp

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4708	K816Bdrive20240829.tmp
400	Gaming Mouse 3.0.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
400	Gaming Mouse 3.0.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
400	Gaming Mouse 3.0.exe
400	Gaming Mouse 3.0.exe
400	Gaming Mouse 3.0.exe
400	Gaming Mouse 3.0.exe
400	Gaming Mouse 3.0.exe
400	Gaming Mouse 3.0.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4708	4520	K816Bdrive20240829.exe	80
PID 4708 wrote to memory of 400	4708	K816Bdrive20240829.tmp	82

C:\Users\Admin\AppData\Local\Temp\K816Bdrive20240829.exe
"C:\Users\Admin\AppData\Local\Temp\K816Bdrive20240829.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Local\Temp\is-DQSFR.tmp\K816Bdrive20240829.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DQSFR.tmp\K816Bdrive20240829.tmp" /SL5="$60258,4906145,188928,C:\Users\Admin\AppData\Local\Temp\K816Bdrive20240829.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Program Files (x86)\K816B\Gaming Mouse 3.0.exe
    "C:\Program Files (x86)\K816B\Gaming Mouse 3.0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gaming Mouse 3.0.exe

Path C:\Program Files (x86)\K816B\Gaming Mouse 3.0.exe
Size 2.6MB
SHA256 77661d84db0a2a6826793a6bb758c694583b3421138904118dde703f9aac2762
MD5 f203314fdb66af13b89c5a3414f0d629
SHA1 c565abf74357ae9c98ca925a00639b3f966e30bb
SHA512 b378d71188bc3af5affc768030602248364c0dd1b1e93b93bb0a45b972a6f23496ebf778ed73281a2ffe958976733d3affd1165c1f4abb67f280a69c78a3aa3d
SSDEEP 49152:2LYDex4TDg8vId8z5ddOEgBwcgXCscwWwMjB0ePEWbmUfyEujtM7/HBFhIeyBbzl:2oex4e10ePEWbRyTjtM7/hFhByBbzFrj
TLSH
T172D59C2077829236C47B4630481CF779F16DBC38072968D733D4AE69AD362DA893767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-HSVK1.tmp

Path C:\Program Files (x86)\K816B\skins\0_INI_CN\macroReset\is-HSVK1.tmp
Size 30KB
SHA256 e04e2133774ac24e41ed146dbce85d8a3f582b0f6168d1e1f9680772f6a9aed7
MD5 e17981e49cb3e4b0a760b106a774b2b0
SHA1 a4383370cadf2d5438ada752d4c7d0f29ae266bf
SHA512 a399664a697ad1fc7b7f6ea2972d2d1482dcd8be295f511fd2b25831d0691dd6c91b479d157f5bb0cc57dd70e8eb300599a2c51dfbb9ea6364af17a80fb29a66
SSDEEP 24:H7MOwW0gU1Uc6rB0JJ3weD8euM+cFT0fu6mjkmEi60gNMJ0eufuHdyi:HdHs/Wi
TLSH
T1EBE22D7450CF105AF04AE9903BBCFCB541B2388B9ECB4B4407BE54409FA8E6A7F94C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-IQV3S.tmp

Path C:\Program Files (x86)\K816B\skins\0_INI_CN\macroReset\is-IQV3S.tmp
Size 322B
SHA256 4699b785b81db9bafa82ade98d7e440c9ece797ba6dbf4d7ef10c0a1133879fd
MD5 055b2983a338881a9b21c5bc9329a640
SHA1 46c286a0263dd50814707b1a4adce50390a6f747
SHA512 83486ee5397a08202ebc313c85088870d295dee8ba90eddca4fedb2673e10076e3578c7fc91e939aeeebfd543a50819868eb4f9b9433c09873775a79389af80d
TLSH
T1E3E0C92BC684111A3712AA40E2C843F9B76AA0C6A16E4D96C2D60FD726D148222CF4EF
MD5 SHA1 SHA512 TLSH

Submit Download

is-JQRV4.tmp

Path C:\Program Files (x86)\K816B\skins\0_INI_CN\macroReset\is-JQRV4.tmp
Size 61KB
SHA256 0a453fc039b83fe93b617767a5d6a5e517136bbcdd614c6cfee55ddce4c85b63
MD5 01b08309d830a8b6d6a18d1e9b8f076a
SHA1 ee5e69e192098032a1356cfc4c8fe5e46c5ab234
SHA512 78b2ba921c6609f177e55023c0f2b2f771a7cd450418cf9c45b9a437df55cd22674b11c97b05f92c4d62d1e4645d59e18d80850c66ac97989fb94bc13e2a715d
SSDEEP 24:HxLiH0lRQH0tVH0vpH07AY0jKmecbY0Alck8zY0eqjGTzY0InAe:HxLnipt4Rx+
TLSH
T16C534B7090CF0184F10BEDA02BBDBC3001B238C7EDCB680543AD29025FE5FA62E85C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-R66IC.tmp

Path C:\Program Files (x86)\K816B\skins\0_INI_CN\macroReset\is-R66IC.tmp
Size 61KB
SHA256 fc01f4ce1ff86cf228403f07307b0654c570839c1274b0af115fb89262348a08
MD5 1890b359af0d209e29ecdd80237c4360
SHA1 c64ecf0b33dbd2de8a552d8a62db97af83c8144e
SHA512 dbb2e90a0f20a23bd12a071fa1969cc0ed7abfc02130e583f87098adb7fb15c0c6d2efb2e2f494e18b17ac43e376bb8b59101ef74620413ababbe9c003a84dcc
SSDEEP 24:HsZ60cyQhP60cfa60cJR6Sc6yiY06y26mt65/wL:HJvC/wL
TLSH
T12B53717191DE0094F186E8001DECFD7401B375D3E7DF4DA017AD99458FACDA69F89A84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LanguageText.ini

Path C:\Program Files (x86)\K816B\skins\1_INI_EN\LanguageText.ini
Size 6KB
SHA256 37197c41cafd7b19f822f3485162bfbaa7338fcaa172b94ed7f6625d87f197eb
MD5 710939e7383a0aab831825284b907ba0
SHA1 f51531b4a695d469a61f45c733ebf7f164f57c5f
SHA512 c8f8b5c20d499675c5d25d3e1a3d9006a89ee872914de62f0fef50898ec0a691a7381b69f6f59ed1ec2d8ff5c5ce01a0466c908613e6a356ab12f7f3fb0885dc
SSDEEP 96:DUzFtDwKb5/irrrU9fLoaedAWCnps3zNkSArHPzNRUlE/WSJtf0wTTDrAogr:QzFZwvYJTIA/x6EW8Drtgr
TLSH
T130D13417E7F81C2DB6BABB94D9B245305B3B795A5A3CDA6C00C1044E27F1D40A9227FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-FJJEB.tmp

Path C:\Program Files (x86)\K816B\skins\1_INI_EN\is-FJJEB.tmp
Size 60KB
SHA256 f6a5abe654bc8b0502acfeecfb2cccd8c5f22f56a502001fa8b1aa5a9f960b58
MD5 b46c8a661bbdc3d42a04f3c4b7f2983f
SHA1 8f837057b9c11037fd8523073116b9b1152fb65b
SHA512 96ee037e21fd19619e0ed2c86986c396f356a740024c0f0f3456cad93e9c93bf3fff9ef40caca21f3dfb5d0d2146780c953ea51b3102bf83b09626782a9ffe5f
SSDEEP 24:XkcB8HkcJgkcUk4ytzjj/VcU/uawtQmasBcUp7SZk3clwNtQohFcL6TtQi9BkcJ0:X2HqEk/Xe/xBsvUDnGxAUDE01
TLSH
T141538CB454DE00A5F14FE8843ABCFC7901A638E7DECE4B00037CA6018FB4DA26E89D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-QGPO1.tmp

Path C:\Program Files (x86)\K816B\skins\1_INI_EN\is-QGPO1.tmp
Size 546B
SHA256 9726fba5cb81e7c81b472473ac4fdeb283937fe3121bb0b4b382e583f90e9335
MD5 4e66bc7db32772491cb1f1b33da12a88
SHA1 d28cecc4bd2a57678e27e7b3bbb7764e9c20062b
SHA512 3c2b546b135deaa885ca3772b49e0b9300bfd54f63292f4abde34366d4b11d4b08b8593e55149e460d8128d96a90bbc970e23a8e1c4ee23ffb7e5730a3169b46
TLSH
T158F08230D5FC742A7232F5209EEEC6799709759B925EDD2C40A3534F62C04415F9367E
MD5 SHA1 SHA512 TLSH

Submit Download

is-HEIHS.tmp

Path C:\Program Files (x86)\K816B\skins\1_INI_EN\macroReset\is-HEIHS.tmp
Size 298B
SHA256 a11e0def5d591e97071fd4dfb14274bfd29aaf0c313b3ff53af665f08f2b9b39
MD5 92d13787d6f66c5907cedbb250a8c1ad
SHA1 9102fc85eb9a01ec8ff5c8732007bd0c16531706
SHA512 e9b677f40d8df1fa703f9099754754b10541d83ec502d1b04290ba6c9c1814a872999f8da55c6003b70ee47e09ce740ed59099ddcc3e844cb616709b83b03f1b
TLSH
T1F2E0122B4684111933116A40F2C843F5B76A90C9915F0456C1D24FC726D1002228F0FF
MD5 SHA1 SHA512 TLSH

Submit Download

skin_advance.ini

Path C:\Program Files (x86)\K816B\skins\1_INI_EN\skin_advance.ini
Size 3KB
SHA256 0d8c100557817937ddc18b89c993fcf596e861370797e5e610d11b6732c43fdf
MD5 2bb094a90a04c7d62f2b738663ce704e
SHA1 3043fdb8ecc3fe724e1e32e1256ba78adf44c1a4
SHA512 5754aac5762bdef508c54a5e77a79c6060e9dc9cb19d29ca168c2ff5f4799aeb709c71a75931bf91770835ccd1fdb3ead9082c4649a1082f43d75e49d9578517
TLSH
T10171E03AE4FDB53792A7E068CF96D026F78466A3A30DEA4D80DB134541C184379935BF
MD5 SHA1 SHA512 TLSH

Submit Download

skin_color.ini

Path C:\Program Files (x86)\K816B\skins\1_INI_EN\skin_color.ini
Size 5KB
SHA256 c35edfd4a7fd866c422070d53296307180ffbfcaa1de732f20f60ed8e21ec304
MD5 17d2c48ab06240a82067340216a607ec
SHA1 b66965889e20ace6bbb32d115e37b760bef47ae1
SHA512 0722095270c46af3fc739315aa9895cbaeda59cd583d900d01a85c76b1109dd88f17782d78a18d54e85babf43c5c7ffec4cb3365fd7a72fbc0ee8be1db9c938c
SSDEEP 96:rd9Lc7SDpvbTI78owHya43oDFuEIOdWFL:vByH3eUEBdWFL
TLSH
T1CDC1FC3AD5F8B12BE3A7E4B5CFCAD525E75992F7A64DA90E90C7034281C140271938BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin_mac.ini

Path C:\Program Files (x86)\K816B\skins\1_INI_EN\skin_mac.ini
Size 2KB
SHA256 24ba828d45179e44ce853551436b94b4f3042cd8040988a18b8d9a7e6b32543a
MD5 febc2661c1c706ae8f48b0143b511db3
SHA1 ba89ea7d2e55e07d0985e4aa6e5539f9f646cd98
SHA512 45a28d0a6e3f72c9aebf840e4c28abf0e634fbc2862df79df2eb0960f54ab1cc187eccb2c427b712c875080206c51ebc3e1584b391908403ea9df2c1f5aaff58
TLSH
T19541933EE4FC712AD2B7F069CFD5D632E7166696916CE91D40D2038781C180279936BF
MD5 SHA1 SHA512 TLSH

Submit Download

skin_main.ini

Path C:\Program Files (x86)\K816B\skins\1_INI_EN\skin_main.ini
Size 5KB
SHA256 d2a47fa4b1dacf7ae08695bffc1027cf3284e0a26032ede958bdac7ba529e81e
MD5 0e60de83efccc45e3548d47c2cd33957
SHA1 390766d6196b8e1890974c8d98d52fbae93025cb
SHA512 0a5fa9a43f9d531d51abc440dc4d0cacf594000b434dbd98f5722f9093c874160e4432fffc75a78f473a5f437509b196636b780ec799bd22bb09f580dd3b9fa0
SSDEEP 48:rQZ2Yg0d6wAQjDyRwiiisv46R51j1oVPlyzKk3L1SIpQ6QAn9VUlxbesaD2qXS48:rNwNCR/i/3KrI9rD1XSokgqU/6qmX
TLSH
T1E6B1AD3BF9FCA01B9263F598CFDA9137A7126627A21CED6D40D2038656C18412593BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MacG_over.jpg

Path C:\Program Files (x86)\K816B\skins\MacMenu\MacG_over.jpg
Size 19KB
SHA256 331347ee3fb9255afcc1a254767305c7b0eeff435e956613b847534bc1d32635
MD5 1611240b301e36598f66fcbeb79fa21f
SHA1 37da9b4ca4dadd698f925b1476f967da7c6c87da
SHA512 ac3ec5cf41daaba5708e0017367a4415a2ddb1e0df5ee579ae739155aca90d815ddb9e3267652dafb56be23bbeecb8e238c5ec7d5433308d8cc5dd291bddee97
SSDEEP 384:KR71N5Pit71NN/nkcXtdqhhhhhhAfSFFedkhN:KRpN5PCpNN/DruQFSN
TLSH
T1A3922A1EA71BAD05F9E9513AD0A9EFC52230FF0E1B83531B358C3245B7716E168AE543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-VCV46.tmp

Path C:\Program Files (x86)\K816B\skins\MacMenu\is-VCV46.tmp
Size 11KB
SHA256 7bf371ac693c84883ef4976dccc42a1b2bc6df89a1b8b1d382034c4ca44fd353
MD5 e326efbf55d672fadd04a538ff5bbdcc
SHA1 436f1978ef686cb9e457c9f41339941e0f3e1187
SHA512 0203e2c2a634eea8a54f58ec7bedf91584e3e3acba47b5557df8b6d8178b63a5421900034537796fd77af95c81c17f49b979938e0216ce5900a2f3976b330e1d
SSDEEP 192:1j95l59hK528y4l13ql59hKXskn5EXcxBlGtB/iaLGiv:V39dPio9u/n5EXcPqYe3v
TLSH
T1E4422821F3978DA2F9D0A135A4A3C69767028F48B3136216B94C3807BBB57F14E6D247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-9BL59.tmp

Path C:\Program Files (x86)\K816B\skins\config\font\is-9BL59.tmp
Size 154KB
SHA256 16466ef65064e6f3885a6d2806b8949ac1ac38b524dd0cf8fc96565eb4cc28e8
MD5 5673da52c98bb6cb33ada5aaf649703e
SHA1 a18dcbf99c8d2325c2fbf22a64e8cc28a0cf4d3b
SHA512 9728536f1e67069b4c44effc3245d81f61fb79c811a4bd2d3879f57eb220e475dfee0639dbecbe03f411aa8f1e2e84fc38a966ba38982b0b35e2b2a98549583a
SSDEEP 3072:CPfJU8fbEc6MjbUzk0pewfMi4dbARp/cZX/ogD8:CPx4k00wEOcc
TLSH
T177F34A17B343AF52CE656D7802B5C3E26A5DFC2A27379A57E0BFBB2499030E51C124E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-0L1T6.tmp

Path C:\Program Files (x86)\K816B\skins\config\is-0L1T6.tmp
Size 8KB
SHA256 613463d5e87cb061e001ba7b1ccd6495250cecfbe143db5e5c2bf3041d31d4c1
MD5 847b380ec55daf153cd5fcd4bf2f087c
SHA1 7e15cccc4fc575eb3f1b94666cd0a2d4c6ea92eb
SHA512 618eaad162fc5d7d554052ffda2b2468d95e683237bba96cd45f7dc16d965f62add98b24a2cba9d26b6b63b2b54907f85585a4f9cd93fd73eed44e7a92e9813b
SSDEEP 96:HgB48VVx/9kZS+d8Z6IgkmUzxhekov2vGpkEJNgv2mfyS+dIrjm:b6V9ES+d49DB+2+S+dr
TLSH
T18E02BF667E8B518E1155C383BFBD9690A0ECE013ECBE225466A7D5A82F5C0F4C3CE6C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-P8OAT.tmp

Path C:\Program Files (x86)\K816B\skins\config\is-P8OAT.tmp
Size 43KB
SHA256 3dac2542ef2df0fdd59fdf296bdd0c7751ecda0aa57a08839817ea303552914f
MD5 ed48dfcdf4f9d4c262302062547cc712
SHA1 5ad9938e0e852700013a5dd24e1d7e08441e2305
SHA512 1c0ec635e37223eb865cd8f7f18b913e319a9d4882ee43de7181250da6c4a9751ad24cf803857a5a92ace045aa024790303371a276ab0c86504ed471fa4a1cee
SSDEEP 24:HAYplVCYpzf5NXcY0cUkZ8AVW/WYpTdqc6QwNXcY0cUsT5z9c5MYkV3YpoSwYpuU:HJnXakZm/bZSXa6zeALU
TLSH
T1EF138CB020DA0459F14BDC5035ACFCA602B279E7E8DBA50003BC6A514FE4FA52F4C948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-JBE6V.tmp

Path C:\Program Files (x86)\K816B\skins\is-JBE6V.tmp
Size 19KB
SHA256 53a7d423b30c4c30ae5994c558d1b69acbdd4ab9dbf185e1b7d3d87984a5b113
MD5 aad3b6c3519f0a96f45c44df7694c776
SHA1 f38dde54b60aa11c6915a802e80f93bfa6bc82cc
SHA512 c6913e08b5f74eb1af6fe89a3f85353f1a55bf220e7571718689f6c3412b9d19bf94074e8995f4711e12b1bb92f4276816acca33e75e1405be88abeeaa6f184b
SSDEEP 384:aJYNg7UMyPioYNg7UMIsngHSxSj7eYNg7Yu:aJYyYPPDYyYZs7Yy1
TLSH
T111924C64FBA3DE23FAF0D634A4E1D7C2B3A2AB28D7A37641345C690577A43C18D4E146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main_down.jpg

Path C:\Program Files (x86)\K816B\skins\main_down.jpg
Size 290KB
SHA256 6bb4858c7a13939ab5743fb89842c6a1e24eda0fb2ed3c8e9da67065b4386b59
MD5 6fdf0a9a6d27633e109adbe0771ab3c1
SHA1 45203d0789a56fa0aa78147c5cd42123d5fada1f
SHA512 3d30bc7f46451dd145fb7dfd94bf24414ed336ca454c4f57d86f5de31f2d9aab63bce21dc02a13450bbefe651e2b8fdb4396dbf407b362b698f7064b16c06af5
SSDEEP 6144:X5ayNVpTDEQHgdWLOfwO96kbnLNHKVyspHT1OW8HG5u7eavtHP8NTqbUiIG/:1iWLrkbLNqVyspzEWcG56eaFv8NTqbUQ
TLSH
T1E45423A73B3E7D12CA085A5E162932A79E5ADC24D8A3E45BA749B48DD033DD1CF5C0F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main_mask.jpg

Path C:\Program Files (x86)\K816B\skins\main_mask.jpg
Size 9KB
SHA256 2cb33ba0263b20b4979d9624a203eda7a3776bd0ab8b7aaf258c312f2726e3b8
MD5 3dda7f2fcda64bc878bfb21fa2344e01
SHA1 8bc4e89256458b3d7e12ee495ba9a131c8e95787
SHA512 8d68e94c3a27501dc05b58a8cc1614129e7ba002011ce6cce2876bb742ff8adfde48a4fe161497643c60b0872d1be5c879e87ac34921341aa7e152dcfd752875
SSDEEP 24:4oK1he91Wwjx82lY2T3ouV/6byJ3VlPg8GAiPoYnl/v:WqQNn2xdjJ3HLZizl3
TLSH
T1C222121AB5A23C50D4E9EC7514E3C12B1A2F5650F4D7E592A4CAC06779A00F2CD2F1CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main_normal.jpg

Path C:\Program Files (x86)\K816B\skins\main_normal.jpg
Size 259KB
SHA256 16fd04b19f19b64ca71d07f4073a91b6958890317db1a07b0bc486d62934edca
MD5 18715ed2b67ce4d0e42037cef0451068
SHA1 aba3e5fbdc0d7c8db9e3e0e4c15fd7d9952b1235
SHA512 0d6159f8e505c74b1561f847eeaa37e532f7fbd17777ad575b4de6f1ff9076d8212c5ed0d89dca04ad0edabf59a52cca181bc42d6ebfe6b4d6c0d5e9b33dea5e
SSDEEP 6144:c0Lk9Zy7PQX/Pi6GDwiHzuxr/lSiW2LiNgJ7rxPBSnVyDfsL:94Tp/66gwyzs9tLiNgLBKSsL
TLSH
T1304423B8956AF5A1AD90240D2838152802F2DDE94FFF4779B8D5F8BD37F80E4285A6C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main_over.jpg

Path C:\Program Files (x86)\K816B\skins\main_over.jpg
Size 277KB
SHA256 156bc34675e089bfc8dc9e9edf455468f3ae20fab3bcfd952d06809f8e3cd2c3
MD5 cbcb56644195b0840b5120b017ef602e
SHA1 6ac998f12310097ed7ddc2a28bfb2530e815b6c2
SHA512 ed008fd633c9bfe63fa3c2bea60ea9ba700e5f963aa42fde3e1e5850cf63b55d0a686cec9ffb59b61bc0e574290f1040df5b9d62d209ac5644a48122d2e399d9
SSDEEP 6144:GTE/gvZw18w8E6BEjtB5CuPDMs/idMClUUcDMlJQfgKSuKVEHdoFE9:GwgvZwLuBCtKiMs/iuClUdDMlJQfgluv
TLSH
T1FA54237BF137FC4462ED763800CBA0F80741D5A57DBE7699B5B6885FB8B20104689B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warning2_mask.jpg

Path C:\Program Files (x86)\K816B\skins\warning2_mask.jpg
Size 60KB
SHA256 60c9ec315fa345167f0ad5318bea458accd6c5e6f72f21455ce8b215ad2b0405
MD5 1b39da03caf83934ba0891a33945f808
SHA1 255a36fcaac439d5bd5d0b381676d9afbdb081ac
SHA512 2b6ca0463429397654df394b276f7381fb752bb6336386148d0c80060d1273142cb1f35518addbe5883cac3b1222147ef4d7ab43ae9eb90f7faab35016cd017f
SSDEEP 192:lNkUA28y4lmxrNkbCHe/TkvknliK9p3pKb///////////I:0UtPiFbOe/TkcnlH9ps8
TLSH
T16F5357161E39AB16EC9008284BA8A7FF511D3D1E55F61709288CDC6F7622EEB64CFE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warning2_normal.jpg

Path C:\Program Files (x86)\K816B\skins\warning2_normal.jpg
Size 106KB
SHA256 a41971c1a9f47edaccbd8f318cf190f6d08c12651577157c4259bae5d1fae70d
MD5 943357a1c42832fbfa0cc2e02d6c1ecd
SHA1 9d5e07b72523c2788c420ffe06017a2e838edb61
SHA512 69c3962dc6672ba3846d8f025d693ef05c36821796b478c31b9488cdb81ec3d379eeb075cff6647291ca3ad7def0bd699dd77cd4b71277c5162653994d0aeae6
SSDEEP 3072:ZxFxFbab0/2YQINNuSQzapae0TS9DpmSyOFMF:ZLFtaSLcSrFk
TLSH
T1F6B3349588B0BF16FA615C1853A06EAE101D293F0BE4030C786DDF8B7753DDA70AF996
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warning2_over.jpg

Path C:\Program Files (x86)\K816B\skins\warning2_over.jpg
Size 52KB
SHA256 ccf7a76a722f94dd774a464dd92cc8165ef869e373d14c878f368eb5a0587dc5
MD5 3235255e15ac5bc25160150711c0b9a0
SHA1 b259a8babe84259de4cf1aac7309fdc668c68003
SHA512 6ab68800c2a58a4dea2f41711208f1cc89879159db5721ecfd592dee0777ddc44056787c44c3bf2244f01f4391e2ec2e39c57e0f84a68e52f3bc948c4de4b384
SSDEEP 1536:Ve4c+YvVKtU1b9ommS22s9viqtZUKtVYd:VIZxh9ommVD06Vw
TLSH
T1D133BF49FC755A681E8C6D2C2F1E96400120D2FAC2B4EA6E74FF5DE6C7F141FA268349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

K816Bdrive20240829.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DQSFR.tmp\K816Bdrive20240829.tmp
Size 1.2MB
SHA256 4d8f4aa226bcd81c7e5e9961d684321d22f5d7e0a0213682df8bbef3c374c718
MD5 75b177a7719a3bd56735b1547ccbc686
SHA1 ebf49577203d2a83dc91eb134a8832f7fa40cd0b
SHA512 237a9efeabbfdbc92432c732b282ee35f4de5e7137a26dff9782b330c17109a34012e7d9fe01f0968750c5136d141a7da179966fb9c483ee35d4760f21d32947
SSDEEP 24576:atdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5CTx9np:SqTytRFk6ek1ET
TLSH
T1AA454B22A3D28433D5731F759C6BC2949C367E202EA4E54A7EF99E0C1E39B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4520-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4520-7-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4520-683-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4708-8-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4708-9-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/4708-660-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4708-11-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4708-5-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/4708-680-0x0000000000400000-0x000000000053D000-memory.dmp

Download