Analysis
- max time kernel
133s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/06/2026, 15:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Clash.Verge_2.5.1_x64-setup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
Clash.Verge_2.5.1_x64-setup.msi
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target Clash.Verge_2.5.1_x64-setup.msi
- Size 66.2MB
- Sample260623-slxh3adz21
- SHA256 b20c4775ddd13ae28302dd31a4248abdf96b7e92cf70c6e02b0a534a2c76da8e
- MD5 30da0588a63368c86f2d98885ae33860
- SHA1 d5d9839cd321018b4a0c1ac0670e195b9f3b2b96
- SHA512 7636b7805465330a65c3f6743496f2d54b58d876f98022d1a3ff08fd3f0025939086b53636905b71111b72a11b26a143c5dc13b7e27193c9a2599753a2b70b6b
- SSDEEP 1572864:FRIJx/xzKqEvlacMJp+mF9k2CEfPB4jCfmO/Ef/3owuf23Nhvxr47Xb:4x/xmqEdanp11Jf2jCfmO/Ef/3owbNhE
- TLSH T18FE73331B1767898E65F63BFA0A89FC88030BDE1B31BD5AB63783FA149B054651B1D43
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 2 IoCs
resource yara_rule behavioral2/files/0x000c00000001c61e-79.dat family_donutloader behavioral2/files/0x000c00000001c600-164.dat family_donutloader - Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4540 powershell.exe 2584 powershell.exe 3652 powershell.exe 4876 powershell.exe 3120 powershell.exe 5176 powershell.exe 1756 powershell.exe 768 powershell.exe 4912 powershell.exe 4992 powershell.exe - Loads dropped DLL 10 IoCs
pid Process 5752 MsiExec.exe 5752 MsiExec.exe 5752 MsiExec.exe 5752 MsiExec.exe 5752 MsiExec.exe 5752 MsiExec.exe 3156 MsiExec.exe 3156 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe - Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 5508 MsiExec.exe 8 5508 MsiExec.exe 9 5508 MsiExec.exe 10 5508 MsiExec.exe 11 5508 MsiExec.exe 12 5508 MsiExec.exe 13 5508 MsiExec.exe 14 5508 MsiExec.exe 15 5508 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5508 set thread context of 5876 5508 MsiExec.exe 117 - Drops file in Program Files directory 30 IoCs
description ioc Process File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app-update.yml msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\emjio.tmp msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\aboutIcon.png msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\better-sqlite3\build\Release\test_extension.node msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\resource.png msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\sxx982j9s1.xml msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\mac_utils.node msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\win_utils.node msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\aboutIcon.png msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\elevate.exe msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\better-sqlite3\build\Release\test_extension.node msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\emjio.tmp msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\@jasonscheirer\native-progress-bar\build\Release\progress_bar.node msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\win_utils.node msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\Goob.dll msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\sxx982j9s1.xml msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\@jasonscheirer\native-progress-bar\build\Release\progress_bar.node msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\Goob.dll msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\cf-prefs\build\Release\cf-prefs.node msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\elevate.exe msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\j.xml msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\j.xml msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\resource.png msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\mac_utils.node msiexec.exe File created C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\cf-prefs\build\Release\cf-prefs.node msiexec.exe File opened for modification C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app-update.yml msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\e5965a6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7025.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF8709A021266DA037.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{FCE9F474-BF5A-465A-8A25-552DBC2937BB} msiexec.exe File opened for modification C:\Windows\Installer\MSI7557.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7C0F.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF7114D67128CD3C51.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5965a6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI7259.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF7623CA6E39346D47.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF4844B8BFD7C0CE78.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 764 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000bfeea8649d5c36970000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801bfeea8640000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101bfeea864000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3bfeea86400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6bfeea86400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 5772 msiexec.exe 5772 msiexec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 4876 powershell.exe 4876 powershell.exe 4992 powershell.exe 4992 powershell.exe 3120 powershell.exe 3120 powershell.exe 4992 powershell.exe 5176 powershell.exe 5176 powershell.exe 3120 powershell.exe 4876 powershell.exe 4540 powershell.exe 4540 powershell.exe 5176 powershell.exe 4540 powershell.exe 2584 powershell.exe 2584 powershell.exe 1756 powershell.exe 768 powershell.exe 1756 powershell.exe 768 powershell.exe 3652 powershell.exe 3652 powershell.exe 2584 powershell.exe 1756 powershell.exe 3652 powershell.exe 4912 powershell.exe 4912 powershell.exe 4912 powershell.exe 768 powershell.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5876 xwizard.exe 5876 xwizard.exe 5876 xwizard.exe 5876 xwizard.exe 5876 xwizard.exe 5876 xwizard.exe 5876 xwizard.exe 5876 xwizard.exe 5876 xwizard.exe 5876 xwizard.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 764 msiexec.exe Token: SeIncreaseQuotaPrivilege 764 msiexec.exe Token: SeSecurityPrivilege 5772 msiexec.exe Token: SeCreateTokenPrivilege 764 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 764 msiexec.exe Token: SeLockMemoryPrivilege 764 msiexec.exe Token: SeIncreaseQuotaPrivilege 764 msiexec.exe Token: SeMachineAccountPrivilege 764 msiexec.exe Token: SeTcbPrivilege 764 msiexec.exe Token: SeSecurityPrivilege 764 msiexec.exe Token: SeTakeOwnershipPrivilege 764 msiexec.exe Token: SeLoadDriverPrivilege 764 msiexec.exe Token: SeSystemProfilePrivilege 764 msiexec.exe Token: SeSystemtimePrivilege 764 msiexec.exe Token: SeProfSingleProcessPrivilege 764 msiexec.exe Token: SeIncBasePriorityPrivilege 764 msiexec.exe Token: SeCreatePagefilePrivilege 764 msiexec.exe Token: SeCreatePermanentPrivilege 764 msiexec.exe Token: SeBackupPrivilege 764 msiexec.exe Token: SeRestorePrivilege 764 msiexec.exe Token: SeShutdownPrivilege 764 msiexec.exe Token: SeDebugPrivilege 764 msiexec.exe Token: SeAuditPrivilege 764 msiexec.exe Token: SeSystemEnvironmentPrivilege 764 msiexec.exe Token: SeChangeNotifyPrivilege 764 msiexec.exe Token: SeRemoteShutdownPrivilege 764 msiexec.exe Token: SeUndockPrivilege 764 msiexec.exe Token: SeSyncAgentPrivilege 764 msiexec.exe Token: SeEnableDelegationPrivilege 764 msiexec.exe Token: SeManageVolumePrivilege 764 msiexec.exe Token: SeImpersonatePrivilege 764 msiexec.exe Token: SeCreateGlobalPrivilege 764 msiexec.exe Token: SeCreateTokenPrivilege 764 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 764 msiexec.exe Token: SeLockMemoryPrivilege 764 msiexec.exe Token: SeIncreaseQuotaPrivilege 764 msiexec.exe Token: SeMachineAccountPrivilege 764 msiexec.exe Token: SeTcbPrivilege 764 msiexec.exe Token: SeSecurityPrivilege 764 msiexec.exe Token: SeTakeOwnershipPrivilege 764 msiexec.exe Token: SeLoadDriverPrivilege 764 msiexec.exe Token: SeSystemProfilePrivilege 764 msiexec.exe Token: SeSystemtimePrivilege 764 msiexec.exe Token: SeProfSingleProcessPrivilege 764 msiexec.exe Token: SeIncBasePriorityPrivilege 764 msiexec.exe Token: SeCreatePagefilePrivilege 764 msiexec.exe Token: SeCreatePermanentPrivilege 764 msiexec.exe Token: SeBackupPrivilege 764 msiexec.exe Token: SeRestorePrivilege 764 msiexec.exe Token: SeShutdownPrivilege 764 msiexec.exe Token: SeDebugPrivilege 764 msiexec.exe Token: SeAuditPrivilege 764 msiexec.exe Token: SeSystemEnvironmentPrivilege 764 msiexec.exe Token: SeChangeNotifyPrivilege 764 msiexec.exe Token: SeRemoteShutdownPrivilege 764 msiexec.exe Token: SeUndockPrivilege 764 msiexec.exe Token: SeSyncAgentPrivilege 764 msiexec.exe Token: SeEnableDelegationPrivilege 764 msiexec.exe Token: SeManageVolumePrivilege 764 msiexec.exe Token: SeImpersonatePrivilege 764 msiexec.exe Token: SeCreateGlobalPrivilege 764 msiexec.exe Token: SeCreateTokenPrivilege 764 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 764 msiexec.exe Token: SeLockMemoryPrivilege 764 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 764 msiexec.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 764 msiexec.exe 5772 msiexec.exe 5752 MsiExec.exe 3156 MsiExec.exe 5508 MsiExec.exe 5876 xwizard.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 5772 wrote to memory of 5752 5772 msiexec.exe 90 PID 5772 wrote to memory of 6016 5772 msiexec.exe 95 PID 5772 wrote to memory of 3156 5772 msiexec.exe 97 PID 5772 wrote to memory of 5508 5772 msiexec.exe 98 PID 5508 wrote to memory of 4876 5508 MsiExec.exe 100 PID 5508 wrote to memory of 4992 5508 MsiExec.exe 102 PID 5508 wrote to memory of 3120 5508 MsiExec.exe 104 PID 5508 wrote to memory of 5176 5508 MsiExec.exe 106 PID 5508 wrote to memory of 4540 5508 MsiExec.exe 108 PID 4992 wrote to memory of 2584 4992 powershell.exe 110 PID 4876 wrote to memory of 1756 4876 powershell.exe 111 PID 5176 wrote to memory of 3652 5176 powershell.exe 113 PID 3120 wrote to memory of 768 3120 powershell.exe 112 PID 4540 wrote to memory of 4912 4540 powershell.exe 114 PID 5508 wrote to memory of 5876 5508 MsiExec.exe 117 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Clash.Verge_2.5.1_x64-setup.msi1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:764
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AE27432010130FF3EC246C33E71DFC2E C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5752
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:6016
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B5F6ED1D8E8FFDDBF77784C7C40E11F32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3156
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A82937D39B552DE7E23A7C182092CCA62⤵
- Loads dropped DLL
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1756
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2584
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Windows\System324⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:768
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'xwizard.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess xwizard.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3652
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'wuauclt.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess wuauclt.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
-
C:\windows\system32\xwizard.exeC:\windows\system32\xwizard.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5876
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5965a7.rbs
- Size 30KB
- SHA256 db43ebfc6c6c1c1d8fcce6a1780264d480b831ed234c5318c95d923fc440203f
- MD5 97d76738c03821d147b711786f998d15
- SHA1 8e542a010089458b5531ce803750abd907871a1a
- SHA512 c5fc6f167ce5efd199450f5fe39026e174a3fe5b4f1d5c45e1e7777b70c0d0de0c359a6acd87da57032d46304677a6e99ae6d0fd7730b99be79ae824cc748126
- SSDEEP 768:Fp4t0uzMUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5y:z4t0uzVXVoSnrfyjf5brQ0rPxK
- TLSH T1F4D27D47A26046C2E117863377958E12E577BA8483D04BDF1AD8C67A1ED3FD12ABC709
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\aboutIcon.png
- Size 1KB
- SHA256 3bdf39f14da6dcbcd836ef6b343f3363e7c1bb841df11e4f4339acdba0ea3cf2
- MD5 7d89d1fce3f39185fc81a72e6965722b
- SHA1 0947a15b591553e933cce3e335d6fa6a4f5842aa
- SHA512 b3985f3e3cf8e2050cbabcd6c19205ab1d84c2afed0fb60d35535d9e3ba68fc6597844256f48f606d463f589abcd5147ec22a1362db0f46a7cf56c6bd4caa0b7
- TLSH T10221D8828DCE3F6B8903D96517D1048950ADB28F6F7E1A51A780DCF6B3A387601948FD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app-update.yml
- Size 157B
- SHA256 b85c3562f1972cc6c8d5622200f37b07b9b8b80a9faf63103b2554eb5d6f8524
- MD5 0d100381da4d184f55088821b532b77a
- SHA1 93c526e5b8096b517ead68246b0d2cd6e4c5b3bc
- SHA512 2b7d9abe8cbe579b1a9c0ebccbd5e2d49698fef621e67bce36c40fee8b043e213e4201ff0f3fce7548f679d00b3786b2055983f4eb4c98cc4fb34f5e21aa95a0
- TLSH T11EC08CA9C300C06013231971AA23DA20E6ABEAE7C1C540AAE2CA80888122422A65B58C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar
- Size 8.3MB
- SHA256 4055c6b910380de1d3126c45fabf170c2927d1dff32e5507394f37d2f7988229
- MD5 b560a0cbf14d0f89846b5932e57b1706
- SHA1 1dd7c7d6b5b3ca29bff0080add2b2a3bec4c5c41
- SHA512 542b002997a313902898d4f2a422d51975de6719e4376ad14e24e4781f13f8a616279fd2012fa660d2baf4fa5b6b5cff200ce8ab43dc4cca527fe76dba58b6c1
- SSDEEP 49152:x2p8pbPyRVvWb6lbbaWkt6y4wV/Vpml2Em06lxSEXIkTcOOeS7EEMUWlIyiLZK8S:lDBe+Bv
- TLSH T1E4966B6E3E81B5310773A2A2817FA106F3791C1B589CD490B3CDE5A82F844AE9177F79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\@jasonscheirer\native-progress-bar\build\Release\progress_bar.node
- Size 457KB
- SHA256 c763309360265048d8d11c9997664136da68f490c9b67f20e506f2cfffc01568
- MD5 4c5f31427cff66c5f150f19cbc1fe9f2
- SHA1 be4bc060502e775389c8a7225e0be5c475178a3f
- SHA512 65c75d0ccd231a14bb3870fda27729fc74fe2ccbee680d5dd84928f98b869a67d453521bcea374da3f1aac6d07aa13df85ec0bd3a11516865fa59c4b4b3f6a4b
- SSDEEP 6144:H9GEXPDpt7KSZt5b9xCy7POnCn584fRzdrKG4/VarjsyC:H9H9ZtB9gI7RBmFbZ
- TLSH T182A48E19A76841B9F1A7D174C9534907EBB1784A1370E7CF43E0DABA2F637A0563E322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\mac_utils.node
- Size 116KB
- SHA256 d92136166be2103db478674e6c5981c46c09c8822b7aba392ed7226c9d91cdda
- MD5 1ccba6f0effa618ec88ed2496aa1310f
- SHA1 c9ba7183053888ba56ad91eb7b5657920dc51bc7
- SHA512 8c3b8aca65bb5bb9b7bfe60b03b71cb508b45e51bb0b3f72a3cfecc6f3147039b83293f9c4b9a62f7de79381dc1b03770eae6bd0fc0071b7c88e88c98c8a0d49
- SSDEEP 3072:PJcu6rRcm078R5vQJwMQJNFVNJxVNVNDdW8Hbf+qD5qTOd:G7Rdn5Q+MQNHa65qOd
- TLSH T1E6C36D9B62B900BBE5B38674C8A74E45E775F86207608BEF03A4425D1F233D18E39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\win_utils.node
- Size 379KB
- SHA256 c6d841ebfe6701bc2006ebc4656aed4fcda9d0d50801183b0442bc8e8f42be5e
- MD5 0ee9a99b97c33382ef7c199571663868
- SHA1 da654889044dc156a78792dc3544ec867ba9733b
- SHA512 058b7ac51e5218ea1c7ca05d08b47cd47323d3b1ab56a0ce72909c79e58cef93d8d3145a4b7e180cf691635cc099bdfaeb1f9d9590da353adb7808943b467348
- SSDEEP 6144:aeEFLGIGFeA0POtaNxIbeGfHLAaMzKYPtarr81q0QB2W3L:ae1eA4OgPIXfFMzxtaP
- TLSH T1CD847D1AE6A405B5D1A7C578C9734903EB717C8A07709BDF23A14A9A1F33FE09A3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
- Size 1.8MB
- SHA256 9594ab007033706286097f07a40ba16ab6b84b576114b8cf3b518115a85e178e
- MD5 c50b8698894d602ad22f1f4cac783b62
- SHA1 de529ab0fad74e116c691c56d7bde0b1427868bb
- SHA512 b22d874ef7cecdaec2991a4b183a1a4723581e0672779257a0e3a4ee143885a736d6e219d81193dd5860b85971224c2df08aceb6b2d8a941cf4d00ec6f84a305
- SSDEEP 49152:OR1qcrC9lX0E3FIwvjl/6qoWEGKgBiJ/00abedXv2OCh:OPqcrC9SE3FIwv16LG
- TLSH T145958C4BB3B400BDC1A7C0B9851B1A0BE776B40517749BDB1590CAA96F63FE217BE324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\better-sqlite3\build\Release\test_extension.node
- Size 116KB
- SHA256 3d49d9dce23fa6d03f4d0fe45678b8b3c7fadc3eedbd6d748637c1fa2c13e150
- MD5 20b9b5b4ff9cf06ca3def6d016eb16cd
- SHA1 edac51c9296d92e62824c1140015bb4638e054aa
- SHA512 0d2191a4eef417e9c339c0b903dc8412e4f9fe08e23630a8d9aaa5cb2952f4ea776c78c9280af100988aa2a17ddec2c39a269490e86beee04caae3aaacde6305
- SSDEEP 3072:u1XvZ+CiNs0hufIkLCaTJNFVNJxVNVNDdW8HbPUjnQ:YjUslHLNTNHEQ
- TLSH T172C36C9762B500BBE1A38634C8A74E46E775F56217608BEF03A4429D1F237D18E3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\app.asar.unpacked\node_modules\cf-prefs\build\Release\cf-prefs.node
- Size 116KB
- SHA256 a269f733e5e787e26191ce09098acbb9d5125e36b3d575349fbbdbb77d3d3943
- MD5 59f1a05282b20d5b16b0bd346349e966
- SHA1 47696839372aa6a45ea1c5dabeacf874c80a26bc
- SHA512 e28df5f85a746110a8d809258c1473709045611b7aa9a5ce15009e44c9f1a953ea0b706edf2f29907a05d1b8deba68425a8f0c0d5efd8b94c02f38a9711953e5
- SSDEEP 3072:2Jsu6rRcm078R5vQJwMjJNFVNJxVNVNDdW8HbvbQDQsh:77Rdn5Q+MjNHv8QQ
- TLSH T1B9C37D9762B500BBE5B78634C8A74E45E775F96207608BEF03A4429D2F237D18E39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\elevate.exe
- Size 120KB
- SHA256 f24215b176aa907f56c3ef3c9fce06fbddeafc1e56cca7042e202b30b30598eb
- MD5 9f02aad6c5c664672094d1dfb240d0bf
- SHA1 606d579b773220922d87cfb5dc340c8d6bf794d4
- SHA512 667ed1cbde697cd2a70c1a393c3baa28c947d2fd05bcfa3bc64278f6f8c6e193ac62aa637752bdd05f8f61ab3bd9e3d93cbfa3e4fbbd2564539fbd06c4b7ab16
- SSDEEP 3072:MpbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlh7:QPrwRhte1XsE1ld
- TLSH T157C38D0174C0C472E9732A3555B4CAA19E7DFEB11E749EAB2398127A4F602C0DB29F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\emjio.tmp
- Size 401KB
- SHA256 900e3cb21fa7518e1a2fdaae9e8ab96bc90f3ebec4a99f903808c77157ebe3d7
- MD5 bc47ed4d52bbfb4ce23cd7db45fc6127
- SHA1 d547baf57d0563cb0f961df58d45fe65ba2fbc43
- SHA512 a0764c92cb80290ca2e6a35f0ab0f12b4770c0d9d6e48f67b292d41a3e75118589116e4c22cff48b417c032fa8a480abc646bc812f69ce620221baf77ea0e341
- SSDEEP 12288:6YdP8SXv0bbBytx/FAkzYonITYDgYoOkS:9dP83stxGkzxniegXOX
- TLSH T1629423E3E1788AAB87309439FD7CAE32CEFE355F5C5732B91540500B36D9C90A61B6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\j.xml
- Size 179KB
- SHA256 ec9e50947af0ae9ce8daf7d517b5eb9f7a9ac2f2706cea8888c372ba800deae3
- MD5 faf29e7f890b8f77f9064b9d3e067c34
- SHA1 8480be9dc83c9acff354066e5d94e3159eb89e06
- SHA512 31a22dfec572207ac0c16277baa72a45b53ba1e85af6ba5861dd71d7212079377e2fd995bae543a20577a765beb30feaed4c3451b8dfe64bf8af7922534d573f
- SSDEEP 3072:rSfiqikCiSqafDE/nqx1rLIbRmc5gCSaFvXdBpNbIREONX53dUZcJu9/yjgc:wiMafY/nqx1Idm4ZzPlNbIywX5m+u9q7
- TLSH T1520412F3A574C6AB8E58C011E9AEA337EA57348F273F92CF0E19C2857AB290535141D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\resource.png
- Size 587KB
- SHA256 ebcfa124e0bb40aed45a213dd9dce030a8c9bf26076161d86776704a4eefd505
- MD5 1791b0274647badf84f15715c998edbf
- SHA1 cc9ac51d4588957b8bb969b33b690ca8d7da587c
- SHA512 08207e941e41a5fe91d9609e55490d4386adf2b09c992f8910a9c185813e8ee690b1a615020b6e4e513398f5581d08535cdc1e2ff1a70a06e805ff6e5e3670b2
- SSDEEP 12288:IaHOSguNoPFRYYockFkhSMgq9RIj/xHeKOicyfdAtv+ic:IXtJPkqhx9RoheKOFyFaTc
- TLSH T1F5D4234E939184943EE4D1E9B1DCB3A4424615BF9F8DC28DC021E702EB65F539BE36E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Clash.Verge_2.5.1\Clash.Verge_2.5.1\sxx982j9s1.xml
- Size 14.4MB
- SHA256 0ce58807af5583524880488027151578aebca9b379b673f5d1b0edec93847094
- MD5 1fefe40eb4e6e7f04f46dd7ff6048c34
- SHA1 2a98860b9e7c57e569e75f3713dd49f978e44dd6
- SHA512 51855ea9b10408250daa61f45088c74ddf450954a2267372eaf4a49368d21d97fac21cfaa67d73f19f6bd2f59a32dec70ae630a45251925e22aade2f7ca82b38
- SSDEEP 393216:C/+ZB97MLNPkVp4Llk3ltuRytvNBFSXucknFQrvTtq+7/TcFZWQDc:CmZB+L5GIultuRgllqrvTtq+H4w
- TLSH T1B6E633B7F90238C8B1C2B2821B00DE69B758E72FCC6939D9E66D5672513D8F90E5DD20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\aiview_btn_next.png
- Size 7KB
- SHA256 18b061897be28facb38f53afbf81a62796708c93cf7e885c2d77e4bd739d4058
- MD5 ef0b892781234504a0a975d113afe4b5
- SHA1 01d3851ed7b3260c891fcddda9bf6f4f0f431ed0
- SHA512 006eab9bdbca144c523aa78f65fdec441263bfbb598e6ef66f2328d768e8f2c7cf04e2d8a5d9059d9c29b4081a148d4b478cb5a30a085414c8d3f1326d577a05
- SSDEEP 192:9eVYHKTL391sHtbSCBdI93B2PXcHae1BXLGZ3FkhT2/GIdctzBK:wcKjsHFS4M3B2PXcHx1BbQe35tNK
- TLSH T13BF19E8DD1FEB2703084253A001376DCDB07AED917E09A094575C23B7D7DA535A6E3E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\app_bg2.png
- Size 2KB
- SHA256 1a10a51a9cf29c82e6405483535f8ea1365abe07eddf215949f250d18bfb53d4
- MD5 28f7363d65f989da50a9f7d522ccc0ae
- SHA1 0170868e399de1d29ccb8cb089a07ca3a982fbaf
- SHA512 ba744b6b7e05384421f178021d79517b13b7968b57f951b87b9a4bd89d7bed9f8a5942c1b74a1658d45aca7af9832c6081567ab4396745bcf327af80e43a2d84
- TLSH T177514D8D5840491A100E0BBB356BDE068977EA9043696E0C9DFE824FCA20C513D75F5B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\app_camera.png
- Size 984B
- SHA256 dfeeb01f1c68c3979c29ef190d2980b7d1ffc3b635a1e9b2217f172bd9631e79
- MD5 2b0b891399f0d956f579bfef3859b1a8
- SHA1 b888edfc3aa17675af9cf018466df4efa0015887
- SHA512 29c7ab8f86c208eea4f0f7bd3e0475edaf9df8515a82894e8b5aef9047e2fba7f595dbaa9520d13453155bdc88cd8a7bbd1537ad9734b0e8e30f5527d5cf7b89
- TLSH T12F11CCC17C5F4D644D343577A8CB417AE47344689D876125C13B6C93F3532C70017B56
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\app_honeyview.png
- Size 776B
- SHA256 372bb27951bae9884437076587f31fafc4e10dbc43837eaacf463585f8e10adb
- MD5 874db48d6af0af72f75dc048a32e1a81
- SHA1 46740440a5c81ef5fe50997dbc8d638f16b8a09f
- SHA512 f1d5569138de7c1434daf2d6538fe486bf738fdac73dd7d94d23e899c9140e53a777cf2fbcd8e16ddd929271cac25510692b136f29276c850d056c2a4b963906
- TLSH T13D0120D792E040281B75252F238C5A32E4B3EA90983B3D5960AAECE90B397648411ADE
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\app_wooting.xml
- Size 283KB
- SHA256 fd2104b54e3d5d7a9efd3d04c218d51e34c4a37c736142fc0aaf5aa5e55316c8
- MD5 6886bf7cb73449bfd43061d2125c5343
- SHA1 87b0cb2a769cb54a74dacb6398cd8bf77725a04d
- SHA512 46d09e8184f1a140cb56666c3bfe58b2b0d4ca76df1fce0203373214656e94c2bddce28ced9d1c1afa8028409316bff8e0c5d90162dcffa835005069ab154a6e
- SSDEEP 3072:+LApRnhRrAOkianttSLzXY/GVBcMezjURsySdy0FCweteCvc3n53TvjDQb8W0F1p:UQp8f/5VnUv4hCweteCva5T+hxt+pf7
- TLSH T1DA549DBF8654DB3E62A095F733EFC1863503E93F911601B627B4A14192CC70A66FB4E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\resource.h
- Size 52KB
- SHA256 7192f0d66300464f1acfa000427cb35ab8c8ea4412bc35a984a79767f0e4362d
- MD5 d3036ec2de826267ab8a51a5e78bcdbc
- SHA1 39d8f82ae28cd74cca1e49f701e20b6cada65301
- SHA512 e11253a63678fbbc074cdd64aad6e2ecdd64a12132f93a0d8884d0f2bd87b6e9926df03f66185309c831e014a484836fd934068c114163440eef296a2f4ec015
- SSDEEP 768:t9QakBa55OjL2HFYWS3eSwtGv07bwtm46/v8U3TWjLWC1TNKSq5ZUq9tEt6C+idk:fXkA55OjL2lYWSIFJPChgbBltSD0cRq
- TLSH T15E33980C4DC769DA94B8F548966D87662099EC331DB958ED326E2D8C4F281044BFB8FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\skin_compress_dlg.xml
- Size 1KB
- SHA256 102872f03444c239335280fb500ee0fc7e2b0be17035f115ed2d367537cb4a6e
- MD5 b43ad7ccaadc3baa5d96273ca6a76066
- SHA1 4d61e83f582d86046ec55460a2ad26a67d63e312
- SHA512 c0d479b087e1f6113d52f583410f2c3bea95733762b739b1262c8ff505602ac4023de40672fc74fe3af54731b762d6a2d52e229c04fb4627c031a1f4eb8abcd4
- TLSH T1AD310A4326EC2118B1A6BB85ABAA80755B25FDD5522ECC7D24A11D0EC4E7E903902FF3
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\skin_main.xml
- Size 26KB
- SHA256 0d0f42b5a3df6c24f19bfda31d0be026433ca63b31eb6bc8985cde38d8f4f42f
- MD5 6b7f9bce2378d3bed590deb81682243f
- SHA1 ac645805e5e7fb972fd1faf1781d596c2fdc6e73
- SHA512 a7b33b30b3b7fe690ec06091abb3e04abaf43c80854ff9d7c96408e7e772587035907ce163cf9ca67b569f5b6671e4b855df59b69280319b9980a34a5713b121
- SSDEEP 192:mgqLaTs8p+wur8vJ0Atbeb8zd7vGucgSPAOLbzQSALNbLdfzSJ6+Z4jD6aJz4zq5:Tq2ppur8yESb8FeiBpl14sddbANDy
- TLSH T13CC22F54AE2A3A21C56641023B724B85CEF55C33EBD45358FA0F1DABAFF7548036336A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\skin_select_folder.xml
- Size 3KB
- SHA256 f8e78afa6de39ef866ebfc802909d1e993d642bf9d35abf1fe63076c3d081858
- MD5 a377159184c58012d5d1f7cc1c2b5882
- SHA1 b1d62b7030054a816a654058bbba8ea180c924b2
- SHA512 2af832e0da0277292ec46ef9f302db8bad88940e291e6fa1c74e544ac429f607d3a24260ec172b2f1f2e156d3c88b7540ee73aadd14c0f60738baef6cbc661b7
- TLSH T16571465367ED1528B1B76A98EA7A81214E27BC95253EC85D209C2D0C8BF3EC10943FF3
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\tb_btn_test.png
- Size 1KB
- SHA256 18ea74a7bcea8bcff40c960f74c4c4c5b424458bccebbe5149be6423de3efd2f
- MD5 7217a347c78e75e9e585a23ce8d8823a
- SHA1 fb760bdfc697d807b544b621b68f0ff4fb9dd4f4
- SHA512 d9a71e3e3c2b64be07661bf91a302d22dc2c01cac9484416d1e456c89bee6a4080963bf34dd51f4cd5919d112f8cfec3dd0299df9aabd47c543cb1f8464fa045
- TLSH T1F631C6E0B3648DA9343E914B8277C989CF33805B6DF10A08B9E09EB15A7758E4B655D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
- MD5 ccd060f9f366be151fe026216473d89d
- SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
- SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
- MD5 78b9021e0576c01ec958b87ec52832c1
- SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
- SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
- TLSH T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
- MD5 81b56f1dad28119d54bf23c83fc570b9
- SHA1 cb9a89a716465611149ce3c700bd60681d434faf
- SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
- TLSH T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 7d62cbc89aaaef4c99b3805840963e2fd7828e5a0936a7042b8184f7440f392d
- MD5 ad7e6b16264c4cccf9846240acc5d592
- SHA1 3e73bdb0f15636decca39233c82ab4b83b854368
- SHA512 ac787b79989f36340f5af6046eeca69c4e4c067ecfc4fc6cdf2c9d5dc6d19138d5ff42ee7812178788043d083e6a3388b56e6eb4b1f4b5990b7320eacdcbcfea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI1CE5.tmp
- Size 557KB
- SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
- MD5 db7612f0fd6408d664185cfc81bef0cb
- SHA1 19a6334ec00365b4f4e57d387ed885b32aa7c9aa
- SHA512 25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
- SSDEEP 6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
- TLSH T1AAC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nsj1wxuy.zjb.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Clash.Verge_2.5.1_x64-setup.exe
- Size 44.9MB
- SHA256 203bf29f7a5f0dc5fbc5e42772de6a474501603a19120c2f1259bb27c067df51
- MD5 726b4114172d3af73e6deb52d52873f9
- SHA1 e8837f2c223ebfe4c9703fc0b080cfb9ee5a364a
- SHA512 841577795207788629050ae3813122e8a6d882cce0aae56d0e213009d26fa1e1bc5326ba01c5595ccf8d4bfa2d967a75cbda390620f133ac91dae928a33252fe
- SSDEEP 786432:BLR8F6BvAHI0ooazvRsF0wx6C2/NF6HGZRXYhl5+szEYmdY6yf/dq7f4kfVz2lUB:BLSF6WHVnazvR9LC2/NumYhl5ArYzddk
- TLSH T1A8A733EAA32C5418DAD1183319EC4C98D1C2DD05BAD551AED3AC3A147E0C89E4EBDEF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI7C0F.tmp
- Size 25KB
- SHA256 eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
- MD5 81902d13c01fd8a187f3a7f2b72d5dd0
- SHA1 0ac01518c5588eb2788730c78f0c581f79cf2ed4
- SHA512 04d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c
- SSDEEP 768:ZUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5:qXVoSnrfyjf5brQ0rPx
- TLSH T197C28EC753941886E13B8673AA8B8622FD76358003B09FDF1B98C1B51F93BD126BDB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 0aa7155c56df471d5d1f5b1cab1e59eb0b15bdb41e0333225aa9b718df87dce2
- MD5 b65cf4383170b395ae7f0f67a1e46e70
- SHA1 16d8459ccc0cec36b528b6405dc93df07a3a4c0d
- SHA512 5b812953f5e315eefeb44e549f1ed69e36bdeb48a111a167b7664cb60129cba1f2ac0cefa72bf35070e79adbb81fb3bc147ca69f761fe366e0b2695015289807
- SSDEEP 24576:1Fo3DMPldoO/vvTL/SgFlClwvbev+7iGUYTXNo79zwLqJiU1MIRmlcPEB+9:VHw
- TLSH T1A757B41436F92210F7F79E3CA8F06A23493A7D5BAC15DE8D45411B8E0862F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{64a8eebf-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{08ea4f58-e460-4d97-91e7-d0d20acf2a1d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ed0b8f07526bc81d55beff9f6d3ff8cd433752e243eb33aa1311ed2fd029762f
- MD5 7d60750cc583d22b115a0d8880655b50
- SHA1 c83e30c70ad47b66bee221d03e000b698e115677
- SHA512 00ea8be5dee350e7143b781d83be2f9f3d942b3398713684497c95410ecf7585d0281c4c72715976586e567dbc6c6185bc7e1b4f9c4bbaae66297a84e18b0ab2
- SSDEEP 96:FMnwkUvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Sn6b++uVm
- TLSH T153D1871C5AF54711E2B3AB3229F18557A837B911EF33CB8E0198238E2671910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH