Overview
overview
10Static
static
3Setup.exe
windows10-2004-x64
10Setup.exe
windows11-ltsc_2024-x64
10data/.yrk
windows10-2004-x64
3data/.yrk
windows11-ltsc_2024-x64
3data/cache...9.rpyb
windows10-2004-x64
3data/cache...9.rpyb
windows11-ltsc_2024-x64
8data/cache...s.rpyb
windows10-2004-x64
3data/cache...s.rpyb
windows11-ltsc_2024-x64
3lib/python...__.pyc
windows10-2004-x64
3lib/python...__.pyc
windows11-ltsc_2024-x64
3lib/python...32.pyc
windows10-2004-x64
3lib/python...32.pyc
windows11-ltsc_2024-x64
8lib/python...32.pyc
windows10-2004-x64
3lib/python...32.pyc
windows11-ltsc_2024-x64
3setup.py
ubuntu-18.04-amd64
3setup.py
debian-9-armhf
3setup.py
debian-9-mips
3setup.py
debian-9-mipsel
3Analysis
- max time kernel
150s - max time network
77s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/06/2026, 23:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
data/.yrk
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
data/.yrk
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
data/cache/bytecode-39.rpyb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
data/cache/bytecode-39.rpyb
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral7
Sample
data/cache/py3analysis.rpyb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
data/cache/py3analysis.rpyb
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
lib/python3.9/ordlookup/__init__.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
lib/python3.9/ordlookup/__init__.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
lib/python3.9/ordlookup/oleaut32.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
lib/python3.9/ordlookup/oleaut32.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral13
Sample
lib/python3.9/ordlookup/ws2_32.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
lib/python3.9/ordlookup/ws2_32.pyc
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
setup.py
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
setup.py
Resource
debian9-armhf-20260513-en
debian-9-armhf
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
setup.py
Resource
debian9-mipsbe-20260513-en
debian-9-mips
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
setup.py
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
2 signatures
150 seconds
General
- Target Setup.exe
- Size 102KB
- Sample260621-27f8msgx5z
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\data_grpc
-
inject_dll
%windir%\SysWOW64\input.dll
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/files/0x000700000001cb7b-406.dat family_hijackloader - Executes dropped EXE 1 IoCs
pid Process 4456 Y5bfiEWRh.exe - Loads dropped DLL 23 IoCs
pid Process 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 2344 GigaAna.exe 2944 Crisp.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2344 GigaAna.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4456 set thread context of 2344 4456 Y5bfiEWRh.exe 112 PID 4456 set thread context of 2944 4456 Y5bfiEWRh.exe 113 - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\Y5bfiEWRh.exe:Zone.Identifier Setup.exe -
pid Process 3572 powershell.exe 3848 powershell.exe 2956 powershell.exe 5816 powershell.exe 5804 powershell.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GigaAna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crisp.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Setup.exe - NTFS ADS 43 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\tp.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\WebView2Loader.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\zContext.dll:Zone.Identifier Setup.exe File created C:\ProgramData\data_grpc\msvcp_win.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\vcruntime140_1.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\libssl-3-zm.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\cmmbiz.dll:Zone.Identifier Setup.exe File created C:\ProgramData\data_grpc\tp.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\zContext.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\ZoomTask.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\libcrypto-3-zm.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\msvcp_win.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\zLooper.dll:Zone.Identifier Setup.exe File created C:\ProgramData\data_grpc\Cmmlib.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\WebView2Loader.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\zNetUtils.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\vcruntime140.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\Cmmlib.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\zNetUtils.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\Y5bfiEWRh.exe:Zone.Identifier Setup.exe File created C:\ProgramData\data_grpc\msvcp140.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\shader.bin\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\ucrtbase.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\libcurl.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\util.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\zUnifyWebView.dll:Zone.Identifier Setup.exe File created C:\ProgramData\data_grpc\libssl-3-zm.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\ucrtbase.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\zUnifyWebView.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\shader.bin:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\msvcp140.dll:Zone.Identifier Setup.exe File created C:\ProgramData\data_grpc\cluster_link.toml\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\vcruntime140.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\ZMDB.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\ZoomTask.dll:Zone.Identifier Setup.exe File created C:\ProgramData\data_grpc\libcrypto-3-zm.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\util.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\ZMDB.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\vcruntime140_1.dll:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\cluster_link.toml:Zone.Identifier Setup.exe File created C:\ProgramData\data_grpc\cmmbiz.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\libcurl.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe File created C:\ProgramData\data_grpc\zLooper.dll\:Zone.Identifier:$DATA Y5bfiEWRh.exe - Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2956 powershell.exe 2956 powershell.exe 5816 powershell.exe 5816 powershell.exe 5804 powershell.exe 5804 powershell.exe 3572 powershell.exe 3572 powershell.exe 3848 powershell.exe 3848 powershell.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe 2344 GigaAna.exe 2344 GigaAna.exe 2344 GigaAna.exe 2944 Crisp.exe 2944 Crisp.exe 2944 Crisp.exe 2944 Crisp.exe 2944 Crisp.exe 2944 Crisp.exe 2944 Crisp.exe 2944 Crisp.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4456 Y5bfiEWRh.exe 4456 Y5bfiEWRh.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2956 powershell.exe Token: SeIncreaseQuotaPrivilege 2956 powershell.exe Token: SeSecurityPrivilege 2956 powershell.exe Token: SeTakeOwnershipPrivilege 2956 powershell.exe Token: SeLoadDriverPrivilege 2956 powershell.exe Token: SeSystemProfilePrivilege 2956 powershell.exe Token: SeSystemtimePrivilege 2956 powershell.exe Token: SeProfSingleProcessPrivilege 2956 powershell.exe Token: SeIncBasePriorityPrivilege 2956 powershell.exe Token: SeCreatePagefilePrivilege 2956 powershell.exe Token: SeBackupPrivilege 2956 powershell.exe Token: SeRestorePrivilege 2956 powershell.exe Token: SeShutdownPrivilege 2956 powershell.exe Token: SeDebugPrivilege 2956 powershell.exe Token: SeSystemEnvironmentPrivilege 2956 powershell.exe Token: SeRemoteShutdownPrivilege 2956 powershell.exe Token: SeUndockPrivilege 2956 powershell.exe Token: SeManageVolumePrivilege 2956 powershell.exe Token: 33 2956 powershell.exe Token: 34 2956 powershell.exe Token: 35 2956 powershell.exe Token: 36 2956 powershell.exe Token: SeIncreaseQuotaPrivilege 2956 powershell.exe Token: SeSecurityPrivilege 2956 powershell.exe Token: SeTakeOwnershipPrivilege 2956 powershell.exe Token: SeLoadDriverPrivilege 2956 powershell.exe Token: SeSystemProfilePrivilege 2956 powershell.exe Token: SeSystemtimePrivilege 2956 powershell.exe Token: SeProfSingleProcessPrivilege 2956 powershell.exe Token: SeIncBasePriorityPrivilege 2956 powershell.exe Token: SeCreatePagefilePrivilege 2956 powershell.exe Token: SeBackupPrivilege 2956 powershell.exe Token: SeRestorePrivilege 2956 powershell.exe Token: SeShutdownPrivilege 2956 powershell.exe Token: SeDebugPrivilege 2956 powershell.exe Token: SeSystemEnvironmentPrivilege 2956 powershell.exe Token: SeRemoteShutdownPrivilege 2956 powershell.exe Token: SeUndockPrivilege 2956 powershell.exe Token: SeManageVolumePrivilege 2956 powershell.exe Token: 33 2956 powershell.exe Token: 34 2956 powershell.exe Token: 35 2956 powershell.exe Token: 36 2956 powershell.exe Token: SeDebugPrivilege 5816 powershell.exe Token: SeIncreaseQuotaPrivilege 5816 powershell.exe Token: SeSecurityPrivilege 5816 powershell.exe Token: SeTakeOwnershipPrivilege 5816 powershell.exe Token: SeLoadDriverPrivilege 5816 powershell.exe Token: SeSystemProfilePrivilege 5816 powershell.exe Token: SeSystemtimePrivilege 5816 powershell.exe Token: SeProfSingleProcessPrivilege 5816 powershell.exe Token: SeIncBasePriorityPrivilege 5816 powershell.exe Token: SeCreatePagefilePrivilege 5816 powershell.exe Token: SeBackupPrivilege 5816 powershell.exe Token: SeRestorePrivilege 5816 powershell.exe Token: SeShutdownPrivilege 5816 powershell.exe Token: SeDebugPrivilege 5816 powershell.exe Token: SeSystemEnvironmentPrivilege 5816 powershell.exe Token: SeRemoteShutdownPrivilege 5816 powershell.exe Token: SeUndockPrivilege 5816 powershell.exe Token: SeManageVolumePrivilege 5816 powershell.exe Token: 33 5816 powershell.exe Token: 34 5816 powershell.exe Token: 35 5816 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3188 Setup.exe 3188 Setup.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3188 wrote to memory of 5956 3188 Setup.exe 88 PID 3188 wrote to memory of 2560 3188 Setup.exe 90 PID 3188 wrote to memory of 4364 3188 Setup.exe 92 PID 3188 wrote to memory of 1280 3188 Setup.exe 94 PID 1280 wrote to memory of 2956 1280 cmd.exe 96 PID 3188 wrote to memory of 5180 3188 Setup.exe 98 PID 5180 wrote to memory of 5816 5180 cmd.exe 100 PID 3188 wrote to memory of 1264 3188 Setup.exe 101 PID 1264 wrote to memory of 5804 1264 cmd.exe 103 PID 3188 wrote to memory of 2684 3188 Setup.exe 104 PID 2684 wrote to memory of 3572 2684 cmd.exe 106 PID 3188 wrote to memory of 4176 3188 Setup.exe 107 PID 4176 wrote to memory of 3848 4176 cmd.exe 109 PID 3188 wrote to memory of 4456 3188 Setup.exe 110 PID 4456 wrote to memory of 2344 4456 Y5bfiEWRh.exe 112 PID 4456 wrote to memory of 2344 4456 Y5bfiEWRh.exe 112 PID 4456 wrote to memory of 2344 4456 Y5bfiEWRh.exe 112 PID 4456 wrote to memory of 2944 4456 Y5bfiEWRh.exe 113 PID 4456 wrote to memory of 2944 4456 Y5bfiEWRh.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:5956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:2560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:4364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-PSDrive C | Select-Object Used,Free"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""2⤵
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""2⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""2⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""2⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3848
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\Y5bfiEWRh.exeC:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\Y5bfiEWRh.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\ProgramData\GigaAna.exeC:\ProgramData\GigaAna.exe3⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2344
-
-
C:\Users\Admin\AppData\Roaming\data_grpc\Crisp.exeC:\Users\Admin\AppData\Roaming\data_grpc\Crisp.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\GigaAna.exe
- Size 998KB
- SHA256 d9fa3fda6755eb535c4de9572a88deaf5ba2035507dd581ae1a29f888ff5bb0e
- MD5 e49a77cf258b9aa20d4c499776935502
- SHA1 0e05361c2daf783ffa92054272aa528c696b4db5
- SHA512 971a2e78572a9aa0fa6f4cf33e8ac1a844891726da9345d6f0dc130caa42d3fab2229f32fdde8d0adfd3ccea80eee917053e69091a33affee45969860ddcd046
- SSDEEP 24576:zP0dnoZJZWP48I+6bl7MVamLQFLw2nw+pJbU5e2yZm:7KQAPI+6bl7MVLQFLwepJbuLem
- TLSH T1D2258E7269019071E95205B95639DB35EDB8C03B8365D6D3B3F894A80B134E13B3FEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a5bfc7d7a5986cbdaffb495b0d0d58530fba956bcba4cbba41688b9684c82e9e
- MD5 ec3c8a0a78fb42675d5accf68ffbd5f5
- SHA1 17ee3d1aa3956d82cdb42058aa709415639ec4ca
- SHA512 4073fe32debe4d87f7f3ca829e363ad2813c178553e32cd893f14d5deb42b19e45d8a7d76902bd97c04d600a9fdd52020a4b669103c8c27db4f534e2d78237d9
- TLSH T1A2318837F3DC8611CC9A003A10DDAC1036BAC7DB90DEDF9B6B80E255A53F699DE50150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 dcf0b6b9ceae7e42f33fa311e6f2f7e9cddcbc2f7cc99020cd1225cb5255f1d7
- MD5 ff716885cfab581801ade5f78056e885
- SHA1 c7a0f18e5f661d54157995429aa32a7cdb074214
- SHA512 10c5af78c7cf4792dfa7e48910dd89e6ce1ce1df483512cd9e2ac743ca9d7e2c9a95202a5816613b6ad1842fb8cbf50d225d466ea61b88e8548e1031e07f71eb
- TLSH T1A6217633F3DC8694C899013A10DDAC1032B7C7CB40DECF9B6B85D129A42F699CF61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 995278b017a17c081037c71e72044cffe2bee9e2d8337e0e4f2614da913d20af
- MD5 40d4f8f764c9cb4249fb0b8b23dcd45f
- SHA1 790f01bd9489afcfcec05fbff6392d27d236c6af
- SHA512 762a4c7bfa282dbde0a2ca122d544b9eaf996ae22e4a018d19000da263f734c1a1df4099e13912873a00a28153e68d77c9037f8799826c08d736adbc94e8ace1
- TLSH T1E9217633F3DC8694C899013A10DDAC1032BB87CB40DECF9B6B85D129A42F699CF61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 db37a78f2c5a8948510433f5d43c189500c418f610207f67a57ad3a450767f44
- MD5 2c6be8aefda2a15ac9511ca750fbd986
- SHA1 eb58684a7bb45138783c8e05fed92a82d8b86849
- SHA512 153926bf71b5af257d45e0cac3ad2ec091e21031efed8bb33a45ad4260ca58c1ca0d859078fe9e6f734654ab72e32d5968be88db6138be8e550eb070c945cf77
- TLSH T16B219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\34C816D.tmp
- Size 40B
- SHA256 fefed47f8cb1800cb0acc70d5e29d4dbe870d714ed0f6f83de1db1c017640195
- MD5 c878cb415cdbe272514e88244ab9081f
- SHA1 d449a03e2d821bf8e9ece4b68327de3704e6266a
- SHA512 7db012e55eb2db2c5c7b35c6478a7e69c8c4cc384fe382dd4ff894741ae019314b8820f2946ea9515ffbe5a5a1e2239eaec318e476e19d6d2ce13c03b54d83bb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\D216121.tmp
- Size 2.5MB
- SHA256 00621f55ee68df63be9f88c7772d84de5559bf5c716b23e8ea2c41f357593708
- MD5 65319c84319ff6026ee8f58434d12582
- SHA1 dbfb3454f4a0909c1a0555db62b08f8c40a08739
- SHA512 645c58ce4443aab5bc7aa3ba06df13590e5ddb3e822f6d4ee32cab665864b298e1e7719a0c8ca3c7062014b880a58913bbad923798df19a9192262b1202fce94
- SSDEEP 49152:17VzoSkf9Z+Wtybp9Y/X/fvVCoZlHKogsJb4NF879zndBp4JNpkKCovzZmMmiQP:1Bzo97+Wtee/XXNlnBgKdBuJblv9maQP
- TLSH T13EC5339DE1937340358C4AF3FBE8B0B4240EB8726967A726A2E754D7B43719072D2F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\D216121.tmp
- Size 2.5MB
- SHA256 6f301f7777e08e01e22194936ea9e0e683ae4a23283b8ea4da968cdb3dbcd7d4
- MD5 382318dacb5b40139599cbae9f82b417
- SHA1 f1ddd7855624e302a454dfeaf90b3e7f96b2182d
- SHA512 1fcaefabbe9ad620083589e8b20497cc72f72f0ed49c58d5826b3d9b82f84bd4ff4a06046850f613a5910b15b70a1101ebf12b83952f537baa4be5023f5bc866
- SSDEEP 49152:T7VzoSkf9Z+WPybp9Y/X/fvVCoZlHKogsJb4NF879zndBp4JNpkKCovzZmMmiQP:TBzo97+WPee/XXNlnBgKdBuJblv9maQP
- TLSH T1F8C5339DE1937340358C4AF3FBE8B4B4240DB8726967A726A2E754D7B43719072D2F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uge35gyh.ovj.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\Cmmlib.dll
- Size 3.1MB
- SHA256 d927d41c0dcc607ea0980263d451a91f7aad8c93dcd7fe3333ae5a690bc63d0f
- MD5 5d0f09c94242a93eea35a941e3ad7093
- SHA1 fc2932d32a3fa6f307b6e4d8a185fe394726fd58
- SHA512 ba3dc94f44d8873135a33b37312e3a6895f85fd862d0778a7c1fb74bad972fb01fbd67501b7a67bb2ffc046a69242d7eedd54e04367396600f7e331be6d4151c
- SSDEEP 49152:p2xxRI7VEEVjQdgXNzDQc58PBXULYujaHGmloHgevC:hPkOXQnDldevC
- TLSH T15BE56B17BB19881EC5AAE27CBC577E06EAB375455326B7EF028E0A521F977C0097C780
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\MSVCP140.dll
- Size 571KB
- SHA256 10ddff48d704c6007e4c2d53fb4856b5e5e79479503366236246a323aaa76e9d
- MD5 5cde3aed10412762e83b7fe43694a22b
- SHA1 4ffcdf063eafc901105836c27a634530ea614755
- SHA512 fcd7bc262e7bbcbbac9258e31b8d62efb2e601ac1fffac4c86819c8f2aed26fc19403d992a57d48ec92752b2a0a8b04e8204423d6077c7800ea4015f016faa23
- SSDEEP 12288:yNaAf3QHr+vzkNNpiBfxzL63R+3lD9Bh8888QQEKZm+jWodEEVKB:yN2+d3lPh8888QQEKZm+jWodEEYB
- TLSH T126C40823774901E0E195A3B8A1C78306D7F17C4A8322A3C792F6D66D2F5B7D5A73B290
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\VCRUNTIME140_1.dll
- Size 35KB
- SHA256 f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44
- MD5 ab03551e4ef279abed2d8c4b25f35bb8
- SHA1 09bc7e4e1a8d79ee23c0c9c26b1ea39de12a550e
- SHA512 0e7533b8d7e5019ffd1e73937c1627213711725e88c6d7321588f7fffe9e1b4ef5c38311548adbd2c0ee9b407135646593bf1498cbee92275f4e0a22ace78909
- SSDEEP 384:diWe6RE3c6lqst5nZvS05fJjPXR51RWmbzw+XfeDky85xHrwB2BWrYKW4dHRN7qp:at3csN7xPXdRdP/ve6HrEUSKZz
- TLSH T13AF24A9463784486E56B81B0C8939F2BFB39F5A1575093CF0B65825D2F63BC0E63E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\WebView2Loader.dll
- Size 155KB
- SHA256 2d64a312551930dc56612cf358fcfd23133c0596a88c3ec1c467c392ff00b493
- MD5 8bf1a4b944c523e597bba5176d371942
- SHA1 c583719d8daff563954d07f0fd5e3f7d4cc19d96
- SHA512 c5425af444df6e0d1d5fd3b8b40d34c3c04bbb1ef4b17bb9ab165df648b62bab141c317c42915d0785933e18a25906f4dc0358c337fa5c9047e7346ac7df5c52
- SSDEEP 3072:wtTkYsBtpEHQ5seRSciDgKXvlWzMNQG/iT4GmEtJceFqaxnSRTJ:wYB4HLiIgKXvlUdmEtJHFvnAN
- TLSH T10EF34B57B3E80077E17B8278C9A34946E776B8150750AAEF0764477A1F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\Y5bfiEWRh.exe
- Size 947KB
- SHA256 cf86eb395c8712f981608cd06427907baf6ef6328e204da940c9bdf08ea67b50
- MD5 69924889e17552b4009de1f1803923d0
- SHA1 100b8dfcc78d3d59bc83f63aff6a531566267f18
- SHA512 e708e6e57a3eca6f9d954d33335f797c829f831e713f7768bd648dd37ff4fcbd32f44d78d19edf00a44bf66bf4b7c57f9ba6b9fb7b78c303558077ef8033d212
- SSDEEP 12288:J8G4GhIxB6EoTTtcEEGSU4hZn5RNpCjzGX4pvYbZwYeNzWSfC1Xw+RMfC15Bbw5f:rfm6EoTTOEZQQuBRq
- TLSH T135256BC6634802A8D566E1B69A66EA12E777BDD6179187F71260B30F0F735EC0F39B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\ZMDB.dll
- Size 1.4MB
- SHA256 965465e0d9df2c20932c86a143e6a5e79858ad6ff7d7e56dabb35676d544fdac
- MD5 7cc88031b127b794f095b2bb9232f724
- SHA1 817c799cbe48481eec9f9e91b91b856516cb68a1
- SHA512 c80f417972b476773936d83b2157695102876331ef29fa6672182d481eecd76e8d24a54606a55cafdc57cbbd1e95f03f52481863160ff708e8d6dd13e5fb2a6a
- SSDEEP 24576:+NvEgpDKUU9hV349wNa8cxVIXV010H/DZvwq11OtrC1hV89ig4xPGf6q:+xEzV349wNaP51U/DZvwq11krUhVkigP
- TLSH T111658D5B73A841B9D5AFD2B8CA475A07E7B1B842136087DF11E08B9A6F537F11A3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\ZoomTask.dll
- Size 796KB
- SHA256 53691ff7ff875fc5ac2fd8a0912b416466a18c77da38a453f1f81e116c85afdb
- MD5 4de988c8da337f1e51690479e5eb20e5
- SHA1 3bcaaf3323a1e4eba59b59c5cf89fcc4efcca566
- SHA512 729a5f55fe0fac87343314430859a7dcc778263a9cf65856e6733191ff4f911d71fca142d285a2101b436341471e023a9ae703419f403f5a59d707cdd85d4754
- SSDEEP 24576:q/ZG9B0XTSU+HDqm41U3AcbVJgRFVuTuFu5u6ukutu0uvuhuNu9:q/rjShqHrMVJgRFVuTuFu5u6ukutu0us
- TLSH T167054B5B235C01A9D5AED2BA8A878907F7B278470361DBCB03A0975A1F977E01F7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\cluster_link.toml
- Size 17KB
- SHA256 4bf1b59b19d9a5cc6969e11ff42413b56b44f49db5eef957d63307a1c93e0c28
- MD5 2e30ae7d97e5a6879dfbc0b838c3765b
- SHA1 f8c82e95d19c2082e03b3c60f458e5e9777b521d
- SHA512 1635653a284c526948f95a0173ae8fd9010c0ed464917d02d956bffa98a276b7d230027c4ee0c139eab4bb97f4f8e1dcf73f4fad0553fb4a5576ac4bf719d141
- SSDEEP 384:LGUQ9pbc0p4MWHjH/EtfJ/kcN+MzOk1zGN+IV72yUgjP1vsuB:BIpb7p7AH8/scNDOF2ZgRvs4
- TLSH T106824DF62EAD3F8EC514A4B7AA149966BB21B77D1FBE10301CB8383974B30545B78A41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\cmmbiz.dll
- Size 1.1MB
- SHA256 dc7e20eb3f0055bbb89e0e3a252d75c847f4cbf9c0f8b6936ec141a07ce1fd80
- MD5 42d0ff521395b8ec948e714a71a6ba8b
- SHA1 99a57a7f4d3833340a40415cc9ed73d6d139c93a
- SHA512 9b81b3e918db0e78fd62ff2ef2e19aed26bf74cc3f44281f1ed2d81e4f99948d00633e93e1e6df53f1c2fc8c7d737dfb3ec94ada5f45cb81876601d24d099519
- SSDEEP 12288:yVDHhB/1ewpY247M+NqfmvrhUvWBXZGqMC7biwYxEf5qTJF:yFhB/1ewp2MzfmvrhUeMMbiwYxcK
- TLSH T1DD351A1B67A401BCD86AE17ACB9A5B43D5F27C064BA997F70B5085064F933B07E3B321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\libcrypto-3-zm.dll
- Size 5.6MB
- SHA256 b286eb3dcf22b6df034e7878ae099cd428bb896d07302d63aaebe16d38e721a5
- MD5 43f92e150073a789c7d78c81f66938c7
- SHA1 9a024e2e2fc9ff5ae5a2a7c6e467a0c52d9710c3
- SHA512 4b480b27f71638922a1ec8c7f0f69c96985ef0a25181b3394bd5b2c89bcac1bd4bdd6030ecd1cf250363da3ec9d337fe15bb96afed6c6c7f8a495482f7351635
- SSDEEP 98304:mM+DKVXeE2xqVrqnDPk+F1CPwDvt3uF0nCKj:mMUKVuE2xqVrqDsu1CPwDvt3uF0nCU
- TLSH T1C5466B2AE7A81189E4BAC13CC6534723D6B1F826577097CF15A196B90F33BD92B3D780
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\libcurl.dll
- Size 901KB
- SHA256 8a9afce7ec989c95f9867ba4f08c30e0c38bf06cddea9f9414cc13d3c10afea0
- MD5 58855c9a2859fd0f60fef08391ea5c13
- SHA1 cf13130bfd022e261be0d662f0833caa002190bb
- SHA512 81021583e4a3a1e715a4d6360c0529f349b95decb31a111ac4d44ed0fc8f80132e292648c9379cd801eda37359f38b106b0cad336e487fb01628e337a6152d89
- SSDEEP 12288:ePShAS06YnDBCYYVSq4VTXyeDW2WdFhtQ2:ePShq6MDA3VSq4p7DW/dh
- TLSH T108155B8A73A415A9D577C13CC683871BD6F2B442176093CF13A08BAA7F23BE6573A354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\libssl-3-zm.dll
- Size 1.3MB
- SHA256 92914d1426721811fb388a3be864dce01a703b40d994926adbb53d1131c2c35f
- MD5 dd6bb11b818d064cc3c2bddf96be409b
- SHA1 414e918cbb55a33682cc4619445d0e7be0681862
- SHA512 4373394679f4c11658295025f24bf96d54b9904b16e2f491fdaba8b8ebf357e6f4830cb7f8c182626d69d5301f555aa9d701d7692e222cf2dec97d4c91b76019
- SSDEEP 12288:IPA9ahzye+iXrzAEXEASSkFwgizj9PhqpJAh1zz77S:H9ahc4d0+kFwPnIJAh1zjS
- TLSH T13F556B5AE7B8115CE9B6C13C86574B17D2B2F4062370A7EF066186B90F23BD9273E784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\msvcp140.dll:Zone.Identifier
- Size 28B
- SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
- MD5 c0c0eb75aca089cf8c188e9fb51417d4
- SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
- SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\msvcp_win.dll
- Size 622KB
- SHA256 08f2fe38501a88a7d3c13976733c2ca08b5597c3328d51fa1f5f5d8474c33ecf
- MD5 26e256e40cdb3b9cfe599653c8708cb0
- SHA1 384b28625cf8d2e0d3ba8d0df93b1f8d94f281e1
- SHA512 4646b1c9633fc03e5ab6cb90c977cc3d778e73d8ade58d019c22ca11a3367b8faa3a18a4e2f4738a75df80a5a788f956a2a0c33dfd6b48272674d03899a9f5d2
- SSDEEP 12288:SuByC4QcAuILYRHeJSnQEKZm+jWodEEVLJSifhIl:mCzuhCyQEKZm+jWodEEJJSiWl
- TLSH T19FD41816BB1949B0D162A3B8A5C34702E3F2BC064771A3C742EBE16D1F677C56B3B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\shader.bin
- Size 2.0MB
- SHA256 472c5c7e1f34fe05d5c34dc58bb517224174fbd52ca0502b52e5cb4f17e812d1
- MD5 068348583b7a71495ae0ce27c6951c6d
- SHA1 1792a7df1af7cf92e87ded6a2ba44c5908084035
- SHA512 bd0732f34b3123e9b2f66259f0ec4155212cbb466d458210b32ee93b0e58250568a434c4e564ce46fc141f0e860e902e0851f9f08f2047dfc61be8f2b8397394
- SSDEEP 49152:zximRzktPUUssF6HmnT79gHs69sVVL3bnJKIfDgSM1d7OLPwQ00fEkz:cdMUDF6HmiPQtsI7NM1wTTPz
- TLSH T15EA53340EBCFA59DEA0E883C8FEE91816914F88FE55C4242159CCADAD49191D7CE0F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\tp.dll
- Size 1.7MB
- SHA256 065ca011f8246e716d18ddf82dc68ad8aa220c49ccc29d6a8b8fa080671405e7
- MD5 a0aaa9b2fc03203c3f60587dbd3cc779
- SHA1 67419c2e5528b909d4cc4d3c8cfdbac2c2f5d005
- SHA512 fac7b083aafb491e0da04c553e4f53a9f1149b974e889728d9baa0144a901ff0c3f1427a0d34ed4b673f6fbd05484e701625d09af42501e470451efde528014f
- SSDEEP 49152:qggXcENM2+8S8KAmWlNXOhmzWsNLKT9h+xSzx:ZzLh+xSzx
- TLSH T1DC856C4723488069D5ABD2BCDB4B994BF23570411B72A6DF03E1891A2F8B3F15FB9760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\ucrtbase.dll
- Size 1.1MB
- SHA256 d93ce42cd625510b2355de086bcd19e2c11307ccade7bad62b09c7f340a866ba
- MD5 24ebedc58aa4ff23043bf79b05d267d4
- SHA1 c2e7bd18e4091f2a7f7c933a5734b05dd971f24c
- SHA512 7f0563e814cc4aaf292683403888340bb5d95e6a7bdd35d81eebbd10bfb8e4e5130d0a626b8fb07ff3cafaae4a2698cf7103aabcae74e5d13449db482ec49bc9
- SSDEEP 24576:2RmADWOBBIHv0XESwR5H7iFZBmai0gFcszUmxvSZX0ypm7:WtI045H+ZB7fgDz7
- TLSH T1C835AE28B76C02AAC57BE17DC923550EF972380447709ACB03A74BB93E277E956B7311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\util.dll
- Size 466KB
- SHA256 2b122736be8059213719dae2bae972b81c5f56e717f6d3d13b4e49313c280789
- MD5 1ec58404414d88f24c65661022e9d210
- SHA1 34da690fe8192c58fe0ba0744bc4a8dfe80a9c7e
- SHA512 bd95de2eda6dc91a0334648b6b91c5c421d3087cb62e4a99b48538ebdce55e64ea32abb46bdf9d1ee7f614e097bdf51cf3634f4c6f786204a0be40b2d7091f39
- SSDEEP 6144:RNC2yfSV1W8JriBsDrxwo7rIW7HY6QuyjBSSyHuJvd8shdE6/3ta5zWo/y:+2/6qrXDrxw4RyEfuvPslWo/
- TLSH T14DA43C5FA34F0066DA62D2788987A406E3B374414B4297CB17B5CB6A3F533F4677B2A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\vcruntime140.dll
- Size 91KB
- SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
- MD5 7942be5474a095f673582997ae3054f1
- SHA1 e982f6ebc74d31153ba9738741a7eec03a9fa5e8
- SHA512 49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039
- SSDEEP 1536:bS6NH9M7vShoxXqYGZLAy10i5XNS83NT/sM9MYDiRecbbVKKoB98:bFRmxXqX0yvX7mHYWRecbb8l
- TLSH T1E7936C4AB2A452BBD16AC174C4F35A06E771B844873053CF03B54AAA4F6BFE15E3E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\zContext.dll
- Size 51KB
- SHA256 2e138cbc90e3fabd1de4189cdb12775d860f023781d4be383bc389caba7c9272
- MD5 da5f527513b9b40b6bedfd7686f5c899
- SHA1 a86347ff4aa446bfb6272a9a77b4d216d49a25c2
- SHA512 517448f6ce4db4fdb996f59fd301cc42dbc896d89488643986146400b2f17c51dd29c9ed38c07ab7d6713f328ef905bf6c450c14440dd66c943b0a361bf5fc72
- SSDEEP 768:2JzJEbmALNz6+jx6bqHK3R5qtaYy0w5ALfYy0l5ALFZ:WOb1pjx6Wq3fqtaWjWWZ
- TLSH T194338EC7556C4886EC179A35F8D25926E633B5924B21D2C72314C26B0F937C23BBE2E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\zLooper.dll
- Size 97KB
- SHA256 afcbadfa2704cd1e1cdf886ca60e4f573b9b15914daf7d3e8acd3e5854a435e4
- MD5 7b1b828c80c66994191f2ec81c425555
- SHA1 48ef324dd5bc379fd8e610d0990bd7b17ff314ae
- SHA512 77934cd67a803f4f3c665f90c99bfd52ae2372bca8e865775b971ba000e57809949695f7da884edda3fb23a1b92ee87f069eb2c19d1b76ca0479a98fdd9368f9
- SSDEEP 3072:0PgRgY68eeiAM2BlMCXEK/kU5E0XVfWpWj9:0PkQ81nUK/kU5E0X5gC
- TLSH T12BA35AAFB7980484D8B6D178E0C69A09F772B84143A297CF5261C35E4FB77C13EB9681
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\zNetUtils.dll
- Size 268KB
- SHA256 594161cbda00a7c6deda15f7b1fd4aaba83b184956cdd885bea2bf842225cd90
- MD5 3361f441f9b5913c9125b3804f5e0034
- SHA1 b719c160238a2b5fb5a0d9130a4c91257c6ee723
- SHA512 7d380b22ca71199641394fe91de6f6b622a499fffe5565742b513f9dafc2496977b13406797d867bec2423c966c91d2741cff43773d54cbc01cbeeed36f036d6
- SSDEEP 6144:UaSn5PN4zq2P5LB0ucTtbB1s89BCHvJ7KSTjNob:UB5PN4G2P5LBDcL9AZKq5G
- TLSH T1A7448D5B76581EB2EDA3D079D9C7890AE2B3B4410355CBEB0361CA6A0F637D1BB39350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-94356-6wgnMNE2yEmr\zUnifyWebView.dll
- Size 2.7MB
- SHA256 7ea1ed3798f2129f96f1a0869c65fc9ce68b00fe3a8a894e65b5b67ddc051018
- MD5 d5308311032a36addb881fbad7f54454
- SHA1 6d2b68ea3483c467848a88c9554c13651337b14a
- SHA512 635a384858a9b3f07976214b4a6c9f457b24f3385e37f5f2f3c80f4469d9a26193b288a060fc68e3978fe2abbf9536b95c8d2bd3fe06e1b9edfa35b048c44d24
- SSDEEP 49152:WclXEDdbrawCcaS+tVrATeagFXen4g2zzv5b2KTGMtUNZfjBde7+sS:RXE5WReEjTGl
- TLSH T1F2D55B0B32A841A4D47AD2BCCB8B5E46E7B274420325DAFF326D895A1F673E14F39711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
- Size 5B
- SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
- MD5 f4020e91252aafd4b18d8acd17f883db
- SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
- SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\data_grpc\Crisp.exe
- Size 334KB
- SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
- MD5 5f9f88c9a16b62dc38504549e93d3667
- SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
- SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
- SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
- TLSH T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
- MD5 SHA1 SHA512 SSDEEP TLSH