Overview
overview
8Static
static
3hsrpk1303_v19856.rar
windows10-2004-x64
1hsrpk1303_v19856.rar
windows11-ltsc_2024-x64
1H-Suki.com...ad.url
windows10-2004-x64
1H-Suki.com...ad.url
windows11-ltsc_2024-x64
1Need help ...ki.url
windows10-2004-x64
1Need help ...ki.url
windows11-ltsc_2024-x64
1[readme]_SETUP.txt
windows10-2004-x64
1[readme]_SETUP.txt
windows11-ltsc_2024-x64
1v19856_Rel...ta.ypf
windows10-2004-x64
3v19856_Rel...ta.ypf
windows11-ltsc_2024-x64
3v19856_Rel...me.txt
windows10-2004-x64
1v19856_Rel...me.txt
windows11-ltsc_2024-x64
1v19856_Rel...nm.exe
windows10-2004-x64
3v19856_Rel...nm.exe
windows11-ltsc_2024-x64
3v19856_Rel...fg.dat
windows10-2004-x64
3v19856_Rel...fg.dat
windows11-ltsc_2024-x64
4v19856_Rel...��.exe
windows10-2004-x64
3v19856_Rel...��.exe
windows11-ltsc_2024-x64
8Analysis
- max time kernel
599s - max time network
483s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 01:27
Static task
static1
Behavioral task
behavioral1
Sample
hsrpk1303_v19856.rar
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
hsrpk1303_v19856.rar
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral3
Sample
H-Suki.com - Hentai - Games Animes free download.url
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
H-Suki.com - Hentai - Games Animes free download.url
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral5
Sample
Need help to install, read this tutorial first - HSuki.url
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Need help to install, read this tutorial first - HSuki.url
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral7
Sample
[readme]_SETUP.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
[readme]_SETUP.txt
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral9
Sample
v19856_Relaxation Yuka M/data.ypf
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
v19856_Relaxation Yuka M/data.ypf
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral11
Sample
v19856_Relaxation Yuka M/readme.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
v19856_Relaxation Yuka M/readme.txt
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral13
Sample
v19856_Relaxation Yuka M/relaxationm.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
v19856_Relaxation Yuka M/relaxationm.exe
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral15
Sample
v19856_Relaxation Yuka M/yscfg.dat
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
v19856_Relaxation Yuka M/yscfg.dat
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral17
Sample
v19856_Relaxation Yuka M/エンジン設定.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
v19856_Relaxation Yuka M/エンジン設定.exe
Resource
win11ltsc2024-20260629-en
General
- Target hsrpk1303_v19856.rar
- Size 514.0MB
- Sample260705-bvlpgsby4m
- SHA256 30d8ef0a86c4c5b94007b098498603b88c784399900b3628fd50807e78d6ceec
- MD5 a849659768406df978e3531df0b3e2f5
- SHA1 3acd1353c3aae617dccb75739a490a8d94a87d8c
- SHA512 e2f805a2a0f35a6888e82666a949f5320e4bc21996d3d33889a042749611209ffe54695493b047a142c72f3590d74df8f1c261c0d9bb57c71b51acaf774b74b7
- SSDEEP 12582912:ZqKaaxgwVU6huEIdDvEuvrex0Tn3VA2Z4VqHTZIaz:caNVU6hu/DvVex0Tn9zHtj
- TLSH T11E4933000E66AD0DF9FDE4375A4C29C81E93A391EC6D41B72B631E4597CD1261AC3BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1636 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1636 7zFM.exe Token: 35 1636 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1636 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\hsrpk1303_v19856.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1920