Overview
overview
10Static
static
3SketchUp_P...51.zip
windows10-2004-x64
1SketchUp_P...51.zip
windows11-ltsc_2024-x64
1Setup.exe
windows10-2004-x64
10Setup.exe
windows11-ltsc_2024-x64
10data/.7if
windows10-2004-x64
3data/.7if
windows11-ltsc_2024-x64
8data/WP2fEFGOt6Bc.bs
windows10-2004-x64
3data/WP2fEFGOt6Bc.bs
windows11-ltsc_2024-x64
3data/cache...9.rpyb
windows10-2004-x64
3data/cache...9.rpyb
windows11-ltsc_2024-x64
8data/cache...s.rpyb
windows10-2004-x64
3data/cache...s.rpyb
windows11-ltsc_2024-x64
8data/cache...s.rpyb
windows10-2004-x64
3data/cache...s.rpyb
windows11-ltsc_2024-x64
3data/cache...rs.txt
windows10-2004-x64
1data/cache...rs.txt
windows11-ltsc_2024-x64
1data/gui/b...om.png
windows10-2004-x64
1data/gui/b...om.png
windows11-ltsc_2024-x64
1data/gui/bar/left.png
windows10-2004-x64
1data/gui/bar/left.png
windows11-ltsc_2024-x64
1data/gui/b...ht.png
windows10-2004-x64
1data/gui/b...ht.png
windows11-ltsc_2024-x64
1data/gui/bar/top.png
windows10-2004-x64
1data/gui/bar/top.png
windows11-ltsc_2024-x64
1data/gui/bubble.png
windows10-2004-x64
1data/gui/bubble.png
windows11-ltsc_2024-x64
8data/gui/b...nd.png
windows10-2004-x64
1data/gui/b...nd.png
windows11-ltsc_2024-x64
8data/gui/b...nd.png
windows10-2004-x64
1data/gui/b...nd.png
windows11-ltsc_2024-x64
1data/gui/b...nd.png
windows10-2004-x64
1data/gui/b...nd.png
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/06/2026, 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SketchUp_Pro_2026_v26.2.243_Full_Español_Archive_free_472451.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SketchUp_Pro_2026_v26.2.243_Full_Español_Archive_free_472451.zip
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral5
Sample
data/.7if
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
data/.7if
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral7
Sample
data/WP2fEFGOt6Bc.bs
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
data/WP2fEFGOt6Bc.bs
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
data/cache/bytecode-39.rpyb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
data/cache/bytecode-39.rpyb
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral11
Sample
data/cache/py3analysis.rpyb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
data/cache/py3analysis.rpyb
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral13
Sample
data/cache/screens.rpyb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
data/cache/screens.rpyb
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
data/cache/shaders.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
data/cache/shaders.txt
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
data/gui/bar/bottom.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
data/gui/bar/bottom.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
data/gui/bar/left.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
data/gui/bar/left.png
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
data/gui/bar/right.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
data/gui/bar/right.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
data/gui/bar/top.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
data/gui/bar/top.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
data/gui/bubble.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
data/gui/bubble.png
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral27
Sample
data/gui/button/check_foreground.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
data/gui/button/check_foreground.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral29
Sample
data/gui/button/check_selected_foreground.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
data/gui/button/check_selected_foreground.png
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
data/gui/button/choice_hover_background.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
data/gui/button/choice_hover_background.png
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Setup.exe
- Size 102KB
- Sample260620-tm7absfy7m
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\Osz
-
inject_dll
%windir%\SysWOW64\input.dll
xor.hex
Extracted
Family
-
remus_stealer
C2
-
http://hemitx.shop:5743
-
http://carogra.biz:4219
-
http://myrtler.biz:9549
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Family: Remus
Remus is a stealer written in C++.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral4/files/0x000700000001cbf4-368.dat family_hijackloader - Detects Remus stealer 2 IoCs
resource yara_rule behavioral4/memory/3488-387-0x00007FF693360000-0x00007FF6933B6000-memory.dmp family_remus_stealer behavioral4/memory/3488-388-0x00007FF693360000-0x00007FF6933B6000-memory.dmp family_remus_stealer - Executes dropped EXE 1 IoCs
pid Process 2296 x0O0lIQJ6.exe - Loads dropped DLL 15 IoCs
pid Process 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 3488 NeuroHandl128.exe 2240 Crisp.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2296 set thread context of 3488 2296 x0O0lIQJ6.exe 112 PID 2296 set thread context of 2240 2296 x0O0lIQJ6.exe 113 - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\x0O0lIQJ6.exe:Zone.Identifier Setup.exe -
pid Process 1860 powershell.exe 4788 powershell.exe 2480 powershell.exe 3588 powershell.exe 3396 powershell.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x0O0lIQJ6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crisp.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters Setup.exe - NTFS ADS 25 IoCs
description ioc Process File created C:\ProgramData\Osz\BCGCBPRO1100u100.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\context64.log\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\mfc100u.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\adapter.lock:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\msvcp100.dll:Zone.Identifier Setup.exe File created C:\ProgramData\Osz\FeatureSwitch.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\msvcp_win.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\msvcr100.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\PPUtilLib.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\ucrtbase.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\context64.log:Zone.Identifier Setup.exe File created C:\ProgramData\Osz\adapter.lock\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\mfc100u.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\ucrtbase.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\XMaxUtil.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\msvcr100.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\BCGCBPRO1100u100.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\XMaxUtil.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\mfc100enu.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\FeatureSwitch.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\x0O0lIQJ6.exe:Zone.Identifier Setup.exe File created C:\ProgramData\Osz\mfc100enu.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\ProgramData\Osz\msvcp100.dll\:Zone.Identifier:$DATA x0O0lIQJ6.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\PPUtilLib.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\msvcp_win.dll:Zone.Identifier Setup.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1860 powershell.exe 1860 powershell.exe 4788 powershell.exe 4788 powershell.exe 2480 powershell.exe 2480 powershell.exe 3588 powershell.exe 3588 powershell.exe 3396 powershell.exe 3396 powershell.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe 2240 Crisp.exe 2240 Crisp.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2296 x0O0lIQJ6.exe 2296 x0O0lIQJ6.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1860 powershell.exe Token: SeIncreaseQuotaPrivilege 1860 powershell.exe Token: SeSecurityPrivilege 1860 powershell.exe Token: SeTakeOwnershipPrivilege 1860 powershell.exe Token: SeLoadDriverPrivilege 1860 powershell.exe Token: SeSystemProfilePrivilege 1860 powershell.exe Token: SeSystemtimePrivilege 1860 powershell.exe Token: SeProfSingleProcessPrivilege 1860 powershell.exe Token: SeIncBasePriorityPrivilege 1860 powershell.exe Token: SeCreatePagefilePrivilege 1860 powershell.exe Token: SeBackupPrivilege 1860 powershell.exe Token: SeRestorePrivilege 1860 powershell.exe Token: SeShutdownPrivilege 1860 powershell.exe Token: SeDebugPrivilege 1860 powershell.exe Token: SeSystemEnvironmentPrivilege 1860 powershell.exe Token: SeRemoteShutdownPrivilege 1860 powershell.exe Token: SeUndockPrivilege 1860 powershell.exe Token: SeManageVolumePrivilege 1860 powershell.exe Token: 33 1860 powershell.exe Token: 34 1860 powershell.exe Token: 35 1860 powershell.exe Token: 36 1860 powershell.exe Token: SeIncreaseQuotaPrivilege 1860 powershell.exe Token: SeSecurityPrivilege 1860 powershell.exe Token: SeTakeOwnershipPrivilege 1860 powershell.exe Token: SeLoadDriverPrivilege 1860 powershell.exe Token: SeSystemProfilePrivilege 1860 powershell.exe Token: SeSystemtimePrivilege 1860 powershell.exe Token: SeProfSingleProcessPrivilege 1860 powershell.exe Token: SeIncBasePriorityPrivilege 1860 powershell.exe Token: SeCreatePagefilePrivilege 1860 powershell.exe Token: SeBackupPrivilege 1860 powershell.exe Token: SeRestorePrivilege 1860 powershell.exe Token: SeShutdownPrivilege 1860 powershell.exe Token: SeDebugPrivilege 1860 powershell.exe Token: SeSystemEnvironmentPrivilege 1860 powershell.exe Token: SeRemoteShutdownPrivilege 1860 powershell.exe Token: SeUndockPrivilege 1860 powershell.exe Token: SeManageVolumePrivilege 1860 powershell.exe Token: 33 1860 powershell.exe Token: 34 1860 powershell.exe Token: 35 1860 powershell.exe Token: 36 1860 powershell.exe Token: SeDebugPrivilege 4788 powershell.exe Token: SeIncreaseQuotaPrivilege 4788 powershell.exe Token: SeSecurityPrivilege 4788 powershell.exe Token: SeTakeOwnershipPrivilege 4788 powershell.exe Token: SeLoadDriverPrivilege 4788 powershell.exe Token: SeSystemProfilePrivilege 4788 powershell.exe Token: SeSystemtimePrivilege 4788 powershell.exe Token: SeProfSingleProcessPrivilege 4788 powershell.exe Token: SeIncBasePriorityPrivilege 4788 powershell.exe Token: SeCreatePagefilePrivilege 4788 powershell.exe Token: SeBackupPrivilege 4788 powershell.exe Token: SeRestorePrivilege 4788 powershell.exe Token: SeShutdownPrivilege 4788 powershell.exe Token: SeDebugPrivilege 4788 powershell.exe Token: SeSystemEnvironmentPrivilege 4788 powershell.exe Token: SeRemoteShutdownPrivilege 4788 powershell.exe Token: SeUndockPrivilege 4788 powershell.exe Token: SeManageVolumePrivilege 4788 powershell.exe Token: 33 4788 powershell.exe Token: 34 4788 powershell.exe Token: 35 4788 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3004 Setup.exe 3004 Setup.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3004 wrote to memory of 4528 3004 Setup.exe 88 PID 3004 wrote to memory of 4680 3004 Setup.exe 90 PID 3004 wrote to memory of 2544 3004 Setup.exe 92 PID 3004 wrote to memory of 3848 3004 Setup.exe 94 PID 3848 wrote to memory of 1860 3848 cmd.exe 96 PID 3004 wrote to memory of 3036 3004 Setup.exe 98 PID 3036 wrote to memory of 4788 3036 cmd.exe 100 PID 3004 wrote to memory of 5664 3004 Setup.exe 101 PID 5664 wrote to memory of 2480 5664 cmd.exe 103 PID 3004 wrote to memory of 1208 3004 Setup.exe 104 PID 1208 wrote to memory of 3588 1208 cmd.exe 106 PID 3004 wrote to memory of 3868 3004 Setup.exe 107 PID 3868 wrote to memory of 3396 3868 cmd.exe 109 PID 3004 wrote to memory of 2296 3004 Setup.exe 110 PID 2296 wrote to memory of 3488 2296 x0O0lIQJ6.exe 112 PID 2296 wrote to memory of 3488 2296 x0O0lIQJ6.exe 112 PID 2296 wrote to memory of 3488 2296 x0O0lIQJ6.exe 112 PID 2296 wrote to memory of 2240 2296 x0O0lIQJ6.exe 113 PID 2296 wrote to memory of 2240 2296 x0O0lIQJ6.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:4528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:2544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""2⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-PSDrive C | Select-Object Used,Free"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""2⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""2⤵
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""2⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""2⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3396
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\x0O0lIQJ6.exeC:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\x0O0lIQJ6.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\ProgramData\NeuroHandl128.exeC:\ProgramData\NeuroHandl128.exe3⤵
- Loads dropped DLL
PID:3488
-
-
C:\Users\Admin\AppData\Roaming\Osz\Crisp.exeC:\Users\Admin\AppData\Roaming\Osz\Crisp.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NeuroHandl128.exe
- Size 511KB
- SHA256 f7c666dbcb9c1c9ac1204cf62ca3efa5c3eaf3e7dd08ea9258eaee490a9bd050
- MD5 65d17cce4863d028f81456f711c03bd9
- SHA1 e53337ab536f4c4c915a5ce706a0a82803b6903f
- SHA512 47bac25b2c4c7f015d3702d66c2c84248a975b9f5e9f2f912bdfad9c648c512d2ea3c2248a6840dc098cc0abe9a52276fd55f29ca4eac4f7b7b9bf68bf547820
- SSDEEP 6144:KUbqVIrt8zwHRePB4ck/XlSCl0iA7+67R9etDMSwMd7wvc5:K2r7xGadSdt+67RktISwM+k
- TLSH T158B45B42B36C3DF9D067D139C9724692E971BC155720E70E03BD676A1F23362BE2AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a5bfc7d7a5986cbdaffb495b0d0d58530fba956bcba4cbba41688b9684c82e9e
- MD5 ec3c8a0a78fb42675d5accf68ffbd5f5
- SHA1 17ee3d1aa3956d82cdb42058aa709415639ec4ca
- SHA512 4073fe32debe4d87f7f3ca829e363ad2813c178553e32cd893f14d5deb42b19e45d8a7d76902bd97c04d600a9fdd52020a4b669103c8c27db4f534e2d78237d9
- TLSH T1A2318837F3DC8611CC9A003A10DDAC1036BAC7DB90DEDF9B6B80E255A53F699DE50150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 71c796dd5d31e08120b4904a3cd4fe0162353fc9edabcf0049d7d231cb64aef4
- MD5 4778b8dcd913fe790586699e5063c2a2
- SHA1 a9b58a51bf46144975d7087957d218567b52b234
- SHA512 972c988ec4ce83b4b4bbcc580ac92fb06ccd260f5ed7a689fc88c48f5dc9bd2db958cd5b772c248bb4c5c3ee474ef9500b3053e8c2b30d8ad49228eae479eec8
- TLSH T143217633B3DC8214D899403A10DDAC1036B687CB40DECF9B6B81E159A42F299CF60060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0c7dbbef51939902889ddeb7a4ce4ffb75c05529422eff86339d0075d92c19bb
- MD5 1fcb73ba2b557bc9d4fe103bc0964eb2
- SHA1 f806ac09025c4302dc60343beaa43cbc30de1369
- SHA512 69a85115f24e3b6ae562f36fa301977a0db7f674195c239c894349c1fc721f16d4be3b541c205777438ec8d54140c128d4c0d21c1c2e1e4005647890981c07bc
- TLSH T19F214637B3DD8614D8A9403A10DDAD1036B687DB40DECF5B6B85E159A42F699CF61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 96534b091fd9c181788e16b9978ac40b30b51e65bbca5a2e376886cc84f38a05
- MD5 f53b4e2fae86e0472eb1c45a18ce1f01
- SHA1 eb15e11ffa56c80f2eb0fb68597ad38de3487da1
- SHA512 5f91784ad13a766dd223bf7b45a051a9013234564b73aa2d0b457dd123ce8f13c86dceecc9112afa5053ccf2e7e357a185fef390263b7ef0e0553f08bfe5de5c
- TLSH T1F0219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1A3AC55.tmp
- Size 40B
- SHA256 e230edd3e8e923195fe4dfaf7819a4e9baa618c30cb52bc02aa000c846a4c1e1
- MD5 e16b2062c1040332f49f0a2c4803380e
- SHA1 b8a0cd032484846160c6dfb0a74beffba724dd64
- SHA512 dac89bc1419d1b5ff7181fd8e701ad5b167357af6536fe67c28587dff5bb14fa666120affc444b9bcff27d01966ac4636e3b877febf4ca394541fb7ee752cb4b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\DA18255.tmp
- Size 1.6MB
- SHA256 979ce23feb50a20a4f451d9c9bb01cc56207ebd6eadd260f8fff7c37b0a9d955
- MD5 297ce5e58a3cd3b652ddb5124f1af75e
- SHA1 764b9119daa2a45b5847432cb496c7f63f75a768
- SHA512 1e26115fa24810f9423d9ffc778fd7476df9d8faa678e63dbef7b7d10aac3db0f95e16f138ca038df226540d859b3a289d796605ebdbe283fd8d33331d7abfad
- SSDEEP 49152:tPbCC85oqHIApl0LtWUMXnXCk9MrDtuvu75n4qJ9NO:tPuC85h4tVYnSdrD8vulHJ2
- TLSH T17E75331A059126C8158EA5C03625C1FF0F83E83136AE643DC5F7D967EF7A6D248ACD8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DA18255.tmp
- Size 1.6MB
- SHA256 d88bb4e3e0661412b59e953d924a9f86b71971b4bc183a28fd9da7c6aad868ed
- MD5 4dbea844b11ef7a7114f03d88fe3a62c
- SHA1 53f9b4e8f7c4175e40c6f2790d6af640c4a4ffc3
- SHA512 dc32089aa743b5b3a34ae30c6687a797988a61598ac8f22259e059a2c7287f23e9af8501fdbc324bf7ca4cfde95a03f0ec5b508dedb9a92629be3d5ee0954ced
- SSDEEP 49152:DPbCC85oqHIApr0LtWUMXnXCk9MrDtuvu75n4qJ9NO:DPuC85hutVYnSdrD8vulHJ2
- TLSH T19875331A05D125C8158EA5C03625C1FB0F83E83136AE643DC5F7D967EF7A6D248ACD8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ly3j1qo.q3j.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\BCGCBPRO1100u100.dll
- Size 4.7MB
- SHA256 ecaeff0febfebc05c5ba5696c6dcfdea151b335ffe40179b078460db7ccae989
- MD5 215703d309f57146dd09d8837f17f79c
- SHA1 70fd864002f76da0a8e6fddca19deed03a93d693
- SHA512 372cd89b6dae8ee10bfe6846643e70dee3bebded0e946f7c3db8d796e9814c92a51e1124fdd017d0b4deccd52ca2a61c5c664c88c8da27a057315294ec3caa27
- SSDEEP 49152:P6X4Si1b8x7tHI/q5tJy1Y8e+9Jjvjnz89YmsOG805JJODHtgxDyQS01z9Cs4:PY4Si1AIy5HyO8e+nv/esn5C70
- TLSH T141367C30BE7C0279C5DF95B69E3E366F4D5EAD50072842C75168385AB870AD23633E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\FeatureSwitch.dll
- Size 51KB
- SHA256 5f77da103105b72081a6c77a834f23e5c8c70b98834e57f883e733e6e63b6438
- MD5 560f231205e16cd3b8fa9ae1668b0070
- SHA1 c96cc4e280947be30af8ed03703f92e131434895
- SHA512 f91773987cb8d3d518094cd4eeca127a97ba5a7207b83dc08d9bc33da67ade074461b54fe414843fc9723a7a39ef29ddfca4582e8587a7edb6bf9f38cab7b4bf
- SSDEEP 768:TiyyUPQ30UWxfPugpf4YYA/Q1K6h0santEDpm4xeZ5vyOv+QVAVF7su:eAshLA/9m+6Ov7+F7Z
- TLSH T1F3333A0576958033E3A75A382AB4D2B58D7FB8422BF1509F2BA509BD4FB17C1D938336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\MFC100ENU.DLL
- Size 53KB
- SHA256 6fec7c478f790d0edcc4f0efb2594a64878ac8fc8878b03f3611311c920e29be
- MD5 f908fe45f8fe9e0d4cbe65f9ff5df6da
- SHA1 55bdf4ad2db61b8cd0b37011906b74a5505b3746
- SHA512 5f02643bc0f79129e2f48349d8594bbbaaceed50146b82ad880e27b6a512f263fcd69f2ad8e956bb147790f05afe64729de4a699261019ab509e89be863f3063
- SSDEEP 768:BgIdijcuEhCgyYo6B1CLPLNq5f/nWHBNheOU2fd5SMi2jXHUQ:SI0ifyYo6B8PLNYf/nWHNTdr9rHUQ
- TLSH T1AA33736263FD8605F5F77F752EB556605E36BCA2AD38CA0E1640A14E0972F40DEA0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\MSVCR100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- TLSH T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\PPUtilLib.dll
- Size 283KB
- SHA256 aa4e0509b93a8ae6f4203aebb57e51e4a886bfc92f5650d3941aa97f0924bb54
- MD5 f6832bd8caba758d758109ef5b31db78
- SHA1 157af71e96a98af67441c6b48b67b37d0c2a9719
- SHA512 6b750ce919eb83bc218017aaba5c7976e14d580b40ac20bf8986ed699ba2f91321c26783aeb5ca212c6f582ec2a1e26333af454925e3c7b26a46f05d4ea46ea6
- SSDEEP 6144:R6MpA+1jGatz2uIO8fGZT/TCg1mOZjv+9q0/G:hA+Y+z2LAbCAv+5/G
- TLSH T1DC547D6077658C37EAFE02349DBF6A1B952CAC510774C1CBA3589EAE68321C35A34787
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\XMAXUTIL.dll
- Size 69KB
- SHA256 71cfbd96321cc8f7573ad840e73a02d2bf4d17133d4512e5945c7f54939df22e
- MD5 60089793557b8c4fa5fe872f801f05e2
- SHA1 34fd451a3934eabbf967333ec21779bdfe5fa34c
- SHA512 13e49eb011c1acc477ec903a714c5be1a5bbe3631adbe3507af9c87387769fe0c0ddab00d23f8cd8acacadf38aae4eef1d7707a1bc840a18f356fe93ebd40670
- SSDEEP 1536:iC7rwJtwGQj8CIwhUpRSa83kgnJMhCbV5OwpwwJvLMMwoRV7dZ:iCxcj83kMMIbV5OwpwwJv4MdZ
- TLSH T1DE632B52BF599423E6F60171A9BC6B9A342DB1225FE900DB53171F4D0CB0AD3BE78B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\XMaxUtil.dll:Zone.Identifier
- Size 28B
- SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
- MD5 c0c0eb75aca089cf8c188e9fb51417d4
- SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
- SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\adapter.lock
- Size 10KB
- SHA256 894d238cab4a0d4e54ae2f5398995e2ae65311accdeb9c296ce31967e390da47
- MD5 e90d9c2c6a949714636ca0a3a44f08ba
- SHA1 c026a8500744b1378c9862424274702848da5d6a
- SHA512 37788fa2886b78911a5b27bfb11ee8d3d87f2010b29c1278e1008694a97fc510b995662c5331cccbc1cb9eb086c2486751a1d6ec3ea66549dbfc890506890cab
- SSDEEP 192:N1GtX7PJ63lfxZWCm6D5SpjHBO79/ZI24T+Bgec4cO9Jnw1FlY0HFzy:2V7h63lpZWw5SlmQ24TxMJn8lY01y
- TLSH T19E226D355BC20BC26C7DBD624AE4B180EE60E0257FED138DB6CC5E19BE10486A5D2E93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\context64.log
- Size 1.3MB
- SHA256 e8170cef30395345374a9f700061a9bfed1c1791b3a50b4b989368c546f78317
- MD5 b1c05aa797bf3235ea167591692a736f
- SHA1 3f502bf38bc5fe1dbbebf18c23efa89ea2bf9b65
- SHA512 1bbebfb94d03d848b8617314a21b6fa1af8c3607890815a7f50604c74b80df26b9419a0daf40b865413fa5fc6fc7c7c108478bd5f81430ca3adb1219b719a9df
- SSDEEP 24576:QmCWgukinB1KWlWKQyTuR4vfWWhaOJBWezezEa7kg2s53+ZBS1arA3aklZWFRaV8:QUznnB1KDyTuRifW+aODzewab2NxeakA
- TLSH T1375523A8E1FD5CD2F147D875E95938BDC29A611C6BD0C8C89FE608289636D210F11FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\mfc100u.dll
- Size 4.2MB
- SHA256 24bb6838defd491df5460a88bed2d70b903a2156c49fb63e214e2c77251eca71
- MD5 f32077df74efd435a1dcdf415e189df1
- SHA1 2771393d56ff167275bf03170377c43c28ee14e1
- SHA512 fb708e0949854998fb80635138c80ac05d77dca3089d3e5974663ddf2376d6a03535dae1a068514c3b58bc06c8e4078b37cfb6bc90f080f7f31fefc972a34850
- SSDEEP 98304:jsWbb5oF0MUVVsK3vOGH+1TSlUE7vrffTTnm7ulf67NACOub7FLOAkGkzdnEVomK:jx5x3Ii6F7FLOyomFHKnPA+
- TLSH T1E5268D217EC941B5CDD721B0069DB679932EECE4273006D351953BEBE8383C16D39AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\msvcp100.dll
- Size 411KB
- SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
- MD5 e3c817f7fe44cc870ecdbcbc3ea36132
- SHA1 2ada702a0c143a7ae39b7de16a4b5cc994d2548b
- SHA512 4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
- SSDEEP 12288:zNb8zxr1aWPaHX7dGP57rhUgiW6QR7t5qv3Ooc8UHkC2ejGH:zNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eKH
- TLSH T10E9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\msvcp_win.dll
- Size 493KB
- SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
- MD5 7762c51ea02eb943183d597ea0ee5530
- SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
- SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
- SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
- TLSH T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\ucrtbase.dll
- Size 1.1MB
- SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
- MD5 c4a25dce665733663284750666684703
- SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
- SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
- SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
- TLSH T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-98782-2fAyVUkgwBlZ\x0O0lIQJ6.exe
- Size 46KB
- SHA256 abaf5d8010714f2d00911bcf9f0613f193d5edbdde529b1da566efa3f7cf7a6e
- MD5 8ba20b5d312fa8454e388bc599c71f97
- SHA1 6e2ec76516997931634f729764c87e5e3bd2e609
- SHA512 f300e8438a8e728d104b9714b8be77567a8c406e50bae2ccd885801087faec1635357f07bace2f977b16bda9deac9ca60405fd6ce2f75958d2d5cba900d2f0ef
- SSDEEP 768:KrBUeNUjGD9zufHmAX/2KZQA3bMYGk9Qr+LtfqWHkhPNOqjYHVZLE57sy:KUuU3brQutflH+lOEYHV47x
- TLSH T1202309173BD5D022F9A355706DB99B9EC83FB9605BDA01DFB3400E2D18B07C19A302AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Osz\Crisp.exe
- Size 334KB
- SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
- MD5 5f9f88c9a16b62dc38504549e93d3667
- SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
- SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
- SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
- TLSH T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
- Size 5B
- SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
- MD5 f4020e91252aafd4b18d8acd17f883db
- SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
- SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
- MD5 SHA1 SHA512