Overview
overview
10Static
static
3SketchUp_P...51.zip
windows10-2004-x64
1SketchUp_P...51.zip
windows11-ltsc_2024-x64
1Setup.exe
windows10-2004-x64
10Setup.exe
windows11-ltsc_2024-x64
10data/.7if
windows10-2004-x64
3data/.7if
windows11-ltsc_2024-x64
8data/WP2fEFGOt6Bc.bs
windows10-2004-x64
3data/WP2fEFGOt6Bc.bs
windows11-ltsc_2024-x64
3data/cache...9.rpyb
windows10-2004-x64
3data/cache...9.rpyb
windows11-ltsc_2024-x64
8data/cache...s.rpyb
windows10-2004-x64
3data/cache...s.rpyb
windows11-ltsc_2024-x64
8data/cache...s.rpyb
windows10-2004-x64
3data/cache...s.rpyb
windows11-ltsc_2024-x64
3data/cache...rs.txt
windows10-2004-x64
1data/cache...rs.txt
windows11-ltsc_2024-x64
1data/gui/b...om.png
windows10-2004-x64
1data/gui/b...om.png
windows11-ltsc_2024-x64
1data/gui/bar/left.png
windows10-2004-x64
1data/gui/bar/left.png
windows11-ltsc_2024-x64
1data/gui/b...ht.png
windows10-2004-x64
1data/gui/b...ht.png
windows11-ltsc_2024-x64
1data/gui/bar/top.png
windows10-2004-x64
1data/gui/bar/top.png
windows11-ltsc_2024-x64
1data/gui/bubble.png
windows10-2004-x64
1data/gui/bubble.png
windows11-ltsc_2024-x64
8data/gui/b...nd.png
windows10-2004-x64
1data/gui/b...nd.png
windows11-ltsc_2024-x64
8data/gui/b...nd.png
windows10-2004-x64
1data/gui/b...nd.png
windows11-ltsc_2024-x64
1data/gui/b...nd.png
windows10-2004-x64
1data/gui/b...nd.png
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SketchUp_Pro_2026_v26.2.243_Full_Español_Archive_free_472451.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SketchUp_Pro_2026_v26.2.243_Full_Español_Archive_free_472451.zip
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral5
Sample
data/.7if
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
data/.7if
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral7
Sample
data/WP2fEFGOt6Bc.bs
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
data/WP2fEFGOt6Bc.bs
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
data/cache/bytecode-39.rpyb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
data/cache/bytecode-39.rpyb
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral11
Sample
data/cache/py3analysis.rpyb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
data/cache/py3analysis.rpyb
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral13
Sample
data/cache/screens.rpyb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
data/cache/screens.rpyb
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
data/cache/shaders.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
data/cache/shaders.txt
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
data/gui/bar/bottom.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
data/gui/bar/bottom.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
data/gui/bar/left.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
data/gui/bar/left.png
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
data/gui/bar/right.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
data/gui/bar/right.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
data/gui/bar/top.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
data/gui/bar/top.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
data/gui/bubble.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
data/gui/bubble.png
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral27
Sample
data/gui/button/check_foreground.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
data/gui/button/check_foreground.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral29
Sample
data/gui/button/check_selected_foreground.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
data/gui/button/check_selected_foreground.png
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
data/gui/button/choice_hover_background.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
data/gui/button/choice_hover_background.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Setup.exe
- Size 102KB
- Sample260620-tm7absfy7m
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\Osz
-
inject_dll
%windir%\SysWOW64\input.dll
xor.hex
Extracted
Family
-
remus_stealer
C2
-
http://hemitx.shop:5743
-
http://carogra.biz:4219
-
http://myrtler.biz:9549
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Family: Remus
Remus is a stealer written in C++.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral3/files/0x0007000000024ab6-369.dat family_hijackloader - Detects Remus stealer 2 IoCs
resource yara_rule behavioral3/memory/2296-411-0x00007FF78FF50000-0x00007FF78FFA6000-memory.dmp family_remus_stealer behavioral3/memory/2296-413-0x00007FF78FF50000-0x00007FF78FFA6000-memory.dmp family_remus_stealer - Executes dropped EXE 1 IoCs
pid Process 3824 x0O0lIQJ6.exe - Loads dropped DLL 12 IoCs
pid Process 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 2296 NeuroHandl128.exe 2564 Crisp.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3824 set thread context of 2296 3824 x0O0lIQJ6.exe 117 PID 3824 set thread context of 2564 3824 x0O0lIQJ6.exe 120 - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\x0O0lIQJ6.exe:Zone.Identifier Setup.exe -
pid Process 2292 powershell.exe 4540 powershell.exe 1044 powershell.exe 1664 powershell.exe 4016 powershell.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x0O0lIQJ6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crisp.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Setup.exe - NTFS ADS 25 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\ucrtbase.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\XMaxUtil.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\FeatureSwitch.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\PPUtilLib.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\msvcp_win.dll:Zone.Identifier Setup.exe File created C:\ProgramData\Osz\mfc100enu.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\PPUtilLib.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\msvcr100.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\context64.log:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\mfc100u.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\adapter.lock:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\msvcp100.dll:Zone.Identifier Setup.exe File created C:\ProgramData\Osz\adapter.lock\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\FeatureSwitch.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\mfc100u.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\mfc100enu.dll:Zone.Identifier Setup.exe File created C:\ProgramData\Osz\msvcp100.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\msvcr100.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\ucrtbase.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\XMaxUtil.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\context64.log\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\BCGCBPRO1100u100.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\x0O0lIQJ6.exe:Zone.Identifier Setup.exe File created C:\ProgramData\Osz\BCGCBPRO1100u100.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\msvcp_win.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1044 powershell.exe 1044 powershell.exe 1664 powershell.exe 1664 powershell.exe 4016 powershell.exe 4016 powershell.exe 2292 powershell.exe 2292 powershell.exe 4540 powershell.exe 4540 powershell.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe 2564 Crisp.exe 2564 Crisp.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3824 x0O0lIQJ6.exe 3824 x0O0lIQJ6.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1044 powershell.exe Token: SeIncreaseQuotaPrivilege 1044 powershell.exe Token: SeSecurityPrivilege 1044 powershell.exe Token: SeTakeOwnershipPrivilege 1044 powershell.exe Token: SeLoadDriverPrivilege 1044 powershell.exe Token: SeSystemProfilePrivilege 1044 powershell.exe Token: SeSystemtimePrivilege 1044 powershell.exe Token: SeProfSingleProcessPrivilege 1044 powershell.exe Token: SeIncBasePriorityPrivilege 1044 powershell.exe Token: SeCreatePagefilePrivilege 1044 powershell.exe Token: SeBackupPrivilege 1044 powershell.exe Token: SeRestorePrivilege 1044 powershell.exe Token: SeShutdownPrivilege 1044 powershell.exe Token: SeDebugPrivilege 1044 powershell.exe Token: SeSystemEnvironmentPrivilege 1044 powershell.exe Token: SeRemoteShutdownPrivilege 1044 powershell.exe Token: SeUndockPrivilege 1044 powershell.exe Token: SeManageVolumePrivilege 1044 powershell.exe Token: 33 1044 powershell.exe Token: 34 1044 powershell.exe Token: 35 1044 powershell.exe Token: 36 1044 powershell.exe Token: SeIncreaseQuotaPrivilege 1044 powershell.exe Token: SeSecurityPrivilege 1044 powershell.exe Token: SeTakeOwnershipPrivilege 1044 powershell.exe Token: SeLoadDriverPrivilege 1044 powershell.exe Token: SeSystemProfilePrivilege 1044 powershell.exe Token: SeSystemtimePrivilege 1044 powershell.exe Token: SeProfSingleProcessPrivilege 1044 powershell.exe Token: SeIncBasePriorityPrivilege 1044 powershell.exe Token: SeCreatePagefilePrivilege 1044 powershell.exe Token: SeBackupPrivilege 1044 powershell.exe Token: SeRestorePrivilege 1044 powershell.exe Token: SeShutdownPrivilege 1044 powershell.exe Token: SeDebugPrivilege 1044 powershell.exe Token: SeSystemEnvironmentPrivilege 1044 powershell.exe Token: SeRemoteShutdownPrivilege 1044 powershell.exe Token: SeUndockPrivilege 1044 powershell.exe Token: SeManageVolumePrivilege 1044 powershell.exe Token: 33 1044 powershell.exe Token: 34 1044 powershell.exe Token: 35 1044 powershell.exe Token: 36 1044 powershell.exe Token: SeDebugPrivilege 1664 powershell.exe Token: SeIncreaseQuotaPrivilege 1664 powershell.exe Token: SeSecurityPrivilege 1664 powershell.exe Token: SeTakeOwnershipPrivilege 1664 powershell.exe Token: SeLoadDriverPrivilege 1664 powershell.exe Token: SeSystemProfilePrivilege 1664 powershell.exe Token: SeSystemtimePrivilege 1664 powershell.exe Token: SeProfSingleProcessPrivilege 1664 powershell.exe Token: SeIncBasePriorityPrivilege 1664 powershell.exe Token: SeCreatePagefilePrivilege 1664 powershell.exe Token: SeBackupPrivilege 1664 powershell.exe Token: SeRestorePrivilege 1664 powershell.exe Token: SeShutdownPrivilege 1664 powershell.exe Token: SeDebugPrivilege 1664 powershell.exe Token: SeSystemEnvironmentPrivilege 1664 powershell.exe Token: SeRemoteShutdownPrivilege 1664 powershell.exe Token: SeUndockPrivilege 1664 powershell.exe Token: SeManageVolumePrivilege 1664 powershell.exe Token: 33 1664 powershell.exe Token: 34 1664 powershell.exe Token: 35 1664 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4820 Setup.exe 4820 Setup.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4820 wrote to memory of 5032 4820 Setup.exe 87 PID 4820 wrote to memory of 4540 4820 Setup.exe 89 PID 4820 wrote to memory of 384 4820 Setup.exe 91 PID 4820 wrote to memory of 1888 4820 Setup.exe 93 PID 1888 wrote to memory of 1044 1888 cmd.exe 95 PID 4820 wrote to memory of 4300 4820 Setup.exe 97 PID 4300 wrote to memory of 1664 4300 cmd.exe 99 PID 4820 wrote to memory of 2084 4820 Setup.exe 100 PID 2084 wrote to memory of 4016 2084 cmd.exe 102 PID 4820 wrote to memory of 3908 4820 Setup.exe 103 PID 3908 wrote to memory of 2292 3908 cmd.exe 105 PID 4820 wrote to memory of 372 4820 Setup.exe 106 PID 372 wrote to memory of 4540 372 cmd.exe 108 PID 4820 wrote to memory of 3824 4820 Setup.exe 112 PID 3824 wrote to memory of 2296 3824 x0O0lIQJ6.exe 117 PID 3824 wrote to memory of 2296 3824 x0O0lIQJ6.exe 117 PID 3824 wrote to memory of 2296 3824 x0O0lIQJ6.exe 117 PID 3824 wrote to memory of 2564 3824 x0O0lIQJ6.exe 120 PID 3824 wrote to memory of 2564 3824 x0O0lIQJ6.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:5032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:4540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""2⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-PSDrive C | Select-Object Used,Free"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""2⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""2⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""2⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""2⤵
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4540
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\x0O0lIQJ6.exeC:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\x0O0lIQJ6.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\ProgramData\NeuroHandl128.exeC:\ProgramData\NeuroHandl128.exe3⤵
- Loads dropped DLL
PID:2296
-
-
C:\Users\Admin\AppData\Roaming\Osz\Crisp.exeC:\Users\Admin\AppData\Roaming\Osz\Crisp.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2564
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NeuroHandl128.exe
- Size 511KB
- SHA256 f7c666dbcb9c1c9ac1204cf62ca3efa5c3eaf3e7dd08ea9258eaee490a9bd050
- MD5 65d17cce4863d028f81456f711c03bd9
- SHA1 e53337ab536f4c4c915a5ce706a0a82803b6903f
- SHA512 47bac25b2c4c7f015d3702d66c2c84248a975b9f5e9f2f912bdfad9c648c512d2ea3c2248a6840dc098cc0abe9a52276fd55f29ca4eac4f7b7b9bf68bf547820
- SSDEEP 6144:KUbqVIrt8zwHRePB4ck/XlSCl0iA7+67R9etDMSwMd7wvc5:K2r7xGadSdt+67RktISwM+k
- TLSH T158B45B42B36C3DF9D067D139C9724692E971BC155720E70E03BD676A1F23362BE2AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 4KB
- SHA256 15d5db2d709306df16fb0ebf06aec3ef91af94ad8e40f66cb6466d0f37edcb50
- MD5 92f60af406d2b80d372ba1a490ea18d4
- SHA1 40607747a3551da0aa1fd80ae5e7bf0375f1fe32
- SHA512 8a7a9a072d42c60c84c64322c3f01b7264d904ebd16bcf9e6cfc8d6ce5e39db00f8ecfe864fcaf09fff50deade44516c5ec7fdaa632218b3da232809f754a1bf
- SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fBPOIzoZcm0vmlvWPfsNySI:iqdYqGAjdx4qKkq3qktznEuZq6cIzooB
- TLSH T1EB81CD323375B0D4C8667F072A2819D063AF4396EA94AF4CB25C621ED92751BDB122F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c006d4c7406b4ab237764d27d79ce8218dfeb3dfefd81a03351cf11ca69f34bb
- MD5 7c9f9f916aa1277cc86ed5d6b192f880
- SHA1 9e2671df657967a4c2203bd20dde4012ace1bc9c
- SHA512 e3173902b739848a5ad5675bf7c79a600ec60181b7177da3bf1008b1d5fabf0da6ea0fb73fbdc3b54ca1415480ab8ee770b2387aaf7bdaf4f7bbbf464c0f3678
- TLSH T1EA316627B3DC8822CCC9253B209C9C1176A682C7819EDF9F6F80D225957FAD9CB61594
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a3318e1b2dda9e7faf7466fbaf520a12e4eb6151ac658a1e911e44ddddd1c70e
- MD5 94d53772428b28381789f2eecfac929d
- SHA1 a87a4e656feafd0d93cfb3bcd9ae30aef7ce2c43
- SHA512 ddfa779d3e14ba2f2bc849690c7c1cf6477afa5c0db7acca8b4db8c02ae7202f39f3985db037c98ca1714520568effc01a98f6428999f13613721709d74ca23b
- TLSH T156216527B39CD8A1CC85253A209CAC5572A683CB80DECF8F6AC0C224A56FA98CB71150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4617aca60de6e4127de1fdca73f36a60703822c2ea38a9f521377d4f49394edd
- MD5 7278fa708769a543014267e4613f927c
- SHA1 d18017fe0dcb3ef814e69cc1ce20857ee25dd3b7
- SHA512 147ca121aa72f2a11f3ae22667ee433ac095be3e7d0ad71aa9a1f5fee1838e361f359b58854908a9d942de7162f7c136d51f6a5c9b6b9a1bdd94586ffe921cc6
- TLSH T137216527B39CD9A1DC95253A209CAC1172B783CB809ECF8F6AC0D224A17FA94CB61590
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 31bd5a28190599cf85382a7a9a438e8cf8dd7897181d9fd270827ea4fb4545ba
- MD5 371e7ee6c059cbe909fb920a5fbdc79b
- SHA1 748b6dd17f5fe32b309ff9910e84c77a3f6a8092
- SHA512 036e660355198776e712c6159c378abb32a2b8fb7335c43bbd80124affc35caa6caabec6f83c9cb7901983efcbf2d658aa68526e62c67ec7eb1460d87ef97f9c
- TLSH T1D7216527B39CD9A1CC95253A209CAC1172B783C7809ECF8F6AC0D224A57FAD8CB61590
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\A799EAC.tmp
- Size 1.6MB
- SHA256 f02d0cc93bc65f43c8f5d55c61cc89c2048f981e13df167426fccb2229de8cc4
- MD5 cc6ee6b9131d657e83c04bded7747ef2
- SHA1 710118ca295d06dd666abc62a11d60cd49d7ef18
- SHA512 a15687f19b9bc93c146b6c1fb4ed2043f43f779359c58d88e38140c877c4a75a614b308649caae438911283a90e04eee9ac9a3fe5f4fd1b3b72e557e40b64f91
- SSDEEP 49152:z3+wMuu1QzA4kFDkCUI2uikTEWU8Tx7tAF1p:KIiQk9UETEf/p
- TLSH T1B1753371F8BF1174C179F1DC60B58568265A3B6C0D8E9A911FBEDF48B201AF8C16BAD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\A799EAC.tmp
- Size 1.6MB
- SHA256 ce11533759ec2f7d834c61a7bd68655812443f64db4185c3f35bca8d48085df9
- MD5 2a89f16ac222b3edf23ae3f413627a79
- SHA1 b3ceafaca99d09612211e2520bef7e889ea30035
- SHA512 6a016de18370e0ca82331a19ebcce337162651fb3164393cc51292773ca5a4ec0cefb3a4bcaae383ab179f40812f22d549498357dc22b1314ac2a7a170ceb561
- SSDEEP 49152:2m+wMuu1QJA4kFDkCUI2uikTEWU8Tx7tAF1p:oIiQG9UETEf/p
- TLSH T11D753371F8BF1174C179F1DC60B58568265A3B6C0D8E9A911FBEDF48B201AF8C16BAD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\E36C5DD.tmp
- Size 40B
- SHA256 fa3f31b12426dfe32cd72f97a4c92e6d180fb0308fc406ea664c417d901e3afd
- MD5 87136e40a027570c631cfe054870fc99
- SHA1 27e938ef6c992c3dfb813dcf6f8af0155f1a4ee5
- SHA512 fb261b6bad47311d0004240015bfed3e2ede73b4db139f1c32389af6eec7101877df114d4754e97e2b38368b7a4a30b3a2bf3c11f9446b72dd73c0751ed3e2c8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0csm5ywn.ixo.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\BCGCBPRO1100u100.dll
- Size 4.7MB
- SHA256 ecaeff0febfebc05c5ba5696c6dcfdea151b335ffe40179b078460db7ccae989
- MD5 215703d309f57146dd09d8837f17f79c
- SHA1 70fd864002f76da0a8e6fddca19deed03a93d693
- SHA512 372cd89b6dae8ee10bfe6846643e70dee3bebded0e946f7c3db8d796e9814c92a51e1124fdd017d0b4deccd52ca2a61c5c664c88c8da27a057315294ec3caa27
- SSDEEP 49152:P6X4Si1b8x7tHI/q5tJy1Y8e+9Jjvjnz89YmsOG805JJODHtgxDyQS01z9Cs4:PY4Si1AIy5HyO8e+nv/esn5C70
- TLSH T141367C30BE7C0279C5DF95B69E3E366F4D5EAD50072842C75168385AB870AD23633E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\FeatureSwitch.dll
- Size 51KB
- SHA256 5f77da103105b72081a6c77a834f23e5c8c70b98834e57f883e733e6e63b6438
- MD5 560f231205e16cd3b8fa9ae1668b0070
- SHA1 c96cc4e280947be30af8ed03703f92e131434895
- SHA512 f91773987cb8d3d518094cd4eeca127a97ba5a7207b83dc08d9bc33da67ade074461b54fe414843fc9723a7a39ef29ddfca4582e8587a7edb6bf9f38cab7b4bf
- SSDEEP 768:TiyyUPQ30UWxfPugpf4YYA/Q1K6h0santEDpm4xeZ5vyOv+QVAVF7su:eAshLA/9m+6Ov7+F7Z
- TLSH T1F3333A0576958033E3A75A382AB4D2B58D7FB8422BF1509F2BA509BD4FB17C1D938336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\PPUtilLib.dll
- Size 283KB
- SHA256 aa4e0509b93a8ae6f4203aebb57e51e4a886bfc92f5650d3941aa97f0924bb54
- MD5 f6832bd8caba758d758109ef5b31db78
- SHA1 157af71e96a98af67441c6b48b67b37d0c2a9719
- SHA512 6b750ce919eb83bc218017aaba5c7976e14d580b40ac20bf8986ed699ba2f91321c26783aeb5ca212c6f582ec2a1e26333af454925e3c7b26a46f05d4ea46ea6
- SSDEEP 6144:R6MpA+1jGatz2uIO8fGZT/TCg1mOZjv+9q0/G:hA+Y+z2LAbCAv+5/G
- TLSH T1DC547D6077658C37EAFE02349DBF6A1B952CAC510774C1CBA3589EAE68321C35A34787
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\XMaxUtil.dll
- Size 69KB
- SHA256 71cfbd96321cc8f7573ad840e73a02d2bf4d17133d4512e5945c7f54939df22e
- MD5 60089793557b8c4fa5fe872f801f05e2
- SHA1 34fd451a3934eabbf967333ec21779bdfe5fa34c
- SHA512 13e49eb011c1acc477ec903a714c5be1a5bbe3631adbe3507af9c87387769fe0c0ddab00d23f8cd8acacadf38aae4eef1d7707a1bc840a18f356fe93ebd40670
- SSDEEP 1536:iC7rwJtwGQj8CIwhUpRSa83kgnJMhCbV5OwpwwJvLMMwoRV7dZ:iCxcj83kMMIbV5OwpwwJv4MdZ
- TLSH T1DE632B52BF599423E6F60171A9BC6B9A342DB1225FE900DB53171F4D0CB0AD3BE78B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\XMaxUtil.dll:Zone.Identifier
- Size 28B
- SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
- MD5 c0c0eb75aca089cf8c188e9fb51417d4
- SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
- SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\adapter.lock
- Size 10KB
- SHA256 894d238cab4a0d4e54ae2f5398995e2ae65311accdeb9c296ce31967e390da47
- MD5 e90d9c2c6a949714636ca0a3a44f08ba
- SHA1 c026a8500744b1378c9862424274702848da5d6a
- SHA512 37788fa2886b78911a5b27bfb11ee8d3d87f2010b29c1278e1008694a97fc510b995662c5331cccbc1cb9eb086c2486751a1d6ec3ea66549dbfc890506890cab
- SSDEEP 192:N1GtX7PJ63lfxZWCm6D5SpjHBO79/ZI24T+Bgec4cO9Jnw1FlY0HFzy:2V7h63lpZWw5SlmQ24TxMJn8lY01y
- TLSH T19E226D355BC20BC26C7DBD624AE4B180EE60E0257FED138DB6CC5E19BE10486A5D2E93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\context64.log
- Size 1.3MB
- SHA256 e8170cef30395345374a9f700061a9bfed1c1791b3a50b4b989368c546f78317
- MD5 b1c05aa797bf3235ea167591692a736f
- SHA1 3f502bf38bc5fe1dbbebf18c23efa89ea2bf9b65
- SHA512 1bbebfb94d03d848b8617314a21b6fa1af8c3607890815a7f50604c74b80df26b9419a0daf40b865413fa5fc6fc7c7c108478bd5f81430ca3adb1219b719a9df
- SSDEEP 24576:QmCWgukinB1KWlWKQyTuR4vfWWhaOJBWezezEa7kg2s53+ZBS1arA3aklZWFRaV8:QUznnB1KDyTuRifW+aODzewab2NxeakA
- TLSH T1375523A8E1FD5CD2F147D875E95938BDC29A611C6BD0C8C89FE608289636D210F11FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\mfc100enu.dll
- Size 53KB
- SHA256 6fec7c478f790d0edcc4f0efb2594a64878ac8fc8878b03f3611311c920e29be
- MD5 f908fe45f8fe9e0d4cbe65f9ff5df6da
- SHA1 55bdf4ad2db61b8cd0b37011906b74a5505b3746
- SHA512 5f02643bc0f79129e2f48349d8594bbbaaceed50146b82ad880e27b6a512f263fcd69f2ad8e956bb147790f05afe64729de4a699261019ab509e89be863f3063
- SSDEEP 768:BgIdijcuEhCgyYo6B1CLPLNq5f/nWHBNheOU2fd5SMi2jXHUQ:SI0ifyYo6B8PLNYf/nWHNTdr9rHUQ
- TLSH T1AA33736263FD8605F5F77F752EB556605E36BCA2AD38CA0E1640A14E0972F40DEA0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\mfc100u.dll
- Size 4.2MB
- SHA256 24bb6838defd491df5460a88bed2d70b903a2156c49fb63e214e2c77251eca71
- MD5 f32077df74efd435a1dcdf415e189df1
- SHA1 2771393d56ff167275bf03170377c43c28ee14e1
- SHA512 fb708e0949854998fb80635138c80ac05d77dca3089d3e5974663ddf2376d6a03535dae1a068514c3b58bc06c8e4078b37cfb6bc90f080f7f31fefc972a34850
- SSDEEP 98304:jsWbb5oF0MUVVsK3vOGH+1TSlUE7vrffTTnm7ulf67NACOub7FLOAkGkzdnEVomK:jx5x3Ii6F7FLOyomFHKnPA+
- TLSH T1E5268D217EC941B5CDD721B0069DB679932EECE4273006D351953BEBE8383C16D39AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\msvcp100.dll
- Size 411KB
- SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
- MD5 e3c817f7fe44cc870ecdbcbc3ea36132
- SHA1 2ada702a0c143a7ae39b7de16a4b5cc994d2548b
- SHA512 4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
- SSDEEP 12288:zNb8zxr1aWPaHX7dGP57rhUgiW6QR7t5qv3Ooc8UHkC2ejGH:zNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eKH
- TLSH T10E9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\msvcp_win.dll
- Size 493KB
- SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
- MD5 7762c51ea02eb943183d597ea0ee5530
- SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
- SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
- SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
- TLSH T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\msvcr100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- TLSH T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\ucrtbase.dll
- Size 1.1MB
- SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
- MD5 c4a25dce665733663284750666684703
- SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
- SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
- SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
- TLSH T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-58935-gEggW8h6P7uO\x0O0lIQJ6.exe
- Size 46KB
- SHA256 abaf5d8010714f2d00911bcf9f0613f193d5edbdde529b1da566efa3f7cf7a6e
- MD5 8ba20b5d312fa8454e388bc599c71f97
- SHA1 6e2ec76516997931634f729764c87e5e3bd2e609
- SHA512 f300e8438a8e728d104b9714b8be77567a8c406e50bae2ccd885801087faec1635357f07bace2f977b16bda9deac9ca60405fd6ce2f75958d2d5cba900d2f0ef
- SSDEEP 768:KrBUeNUjGD9zufHmAX/2KZQA3bMYGk9Qr+LtfqWHkhPNOqjYHVZLE57sy:KUuU3brQutflH+lOEYHV47x
- TLSH T1202309173BD5D022F9A355706DB99B9EC83FB9605BDA01DFB3400E2D18B07C19A302AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Osz\Crisp.exe
- Size 334KB
- SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
- MD5 5f9f88c9a16b62dc38504549e93d3667
- SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
- SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
- SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
- TLSH T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
- Size 5B
- SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
- MD5 f4020e91252aafd4b18d8acd17f883db
- SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
- SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
- MD5 SHA1 SHA512