e885a55e2e0db85a8df50138fec820cff22533fc51b3c3f6fe1b24f1d36fdf93

Resubmissions

22/07/2026, 22:38

260722-2kfzcsda767

22/07/2026, 22:27

260722-2c59aach828

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 6.1MB
Sample260722-2c59aach82
SHA256 e885a55e2e0db85a8df50138fec820cff22533fc51b3c3f6fe1b24f1d36fdf93
MD5 684ccb38c88f3c750dac32beeea273a9
SHA1 59affad4ceffb0f084d4049b2334ee67fc7fcba1
SHA512 9dfcc12c51c20605b36bf01e0b54e75903f8a099e648c0e91650a92f6ccd9f53b0553b59840e6c846f3aa3d40ecf9b4d6d602da2d19ee65b4d74af37c471cc2a
SSDEEP 98304:Qf7wCQInrje/CAVMJy1W5uNnUk/DCNanVm4gK+EcpasKuJTN2JbSvoN:Qfn6/VSl5CUoDCNaoj+fublq
TLSH
T102563351F3D31036F0641C7D1E02A46C2D02EAA669E4647A1EBDC7DF0EB81C77AB79A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3528	setup.tmp
1392	FlushFileCache.exe
2968	unins000.exe
5896	_iu14D2N.tmp

Loads dropped DLL 11 IoCs

pid	Process
3528	setup.tmp
3528	setup.tmp
3528	setup.tmp
3528	setup.tmp
3528	setup.tmp
3528	setup.tmp
3528	setup.tmp
3528	setup.tmp
3528	setup.tmp
3528	setup.tmp
3528	setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4652	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlushFileCache.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_iu14D2N.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2944	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5872-0-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/5872-78-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3528	setup.tmp
3528	setup.tmp

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1392	FlushFileCache.exe
Token: SeProfSingleProcessPrivilege	1392	FlushFileCache.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3528	setup.tmp
3528	setup.tmp
5896	_iu14D2N.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 3528	5872	setup.exe	89
PID 3528 wrote to memory of 1392	3528	setup.tmp	91
PID 3528 wrote to memory of 2968	3528	setup.tmp	94
PID 2968 wrote to memory of 5896	2968	unins000.exe	95

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Users\Admin\AppData\Local\Temp\is-JDFV6.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JDFV6.tmp\setup.tmp" /SL5="$40182,5833665,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\FlushFileCache.exe
    "C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\FlushFileCache.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- - F:\Games\Disco Elysium\unins000.exe
    "F:\Games\Disco Elysium\unins000.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="F:\Games\Disco Elysium\unins000.exe" /FIRSTPHASEWND=$40272 /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x374,0x7ffc14c5c188,0x7ffc14c5c194,0x7ffc14c5c1a0
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,17001720985454955602,14184676017708684620,524288 --field-trial-handle=2644,i,4280384868931545399,17131314336020371240,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
      4⤵
      System Time Discovery
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,4306532739469406942,15489999974884064448,524288 --field-trial-handle=2644,i,4280384868931545399,17131314336020371240,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,15300166774087258369,14043017498416171718,262144 --field-trial-handle=2644,i,4280384868931545399,17131314336020371240,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,3614799663368535078,14598732281289585125,2097152 --field-trial-handle=2644,i,4280384868931545399,17131314336020371240,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,2074212731973794648,6868220116403636303,2097152 --field-trial-handle=2644,i,4280384868931545399,17131314336020371240,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,16951131536478127962,5809670285511100883,2097152 --field-trial-handle=2644,i,4280384868931545399,17131314336020371240,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,6832728788286500752,17176269875898156072,2097152 --field-trial-handle=2644,i,4280384868931545399,17131314336020371240,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:4276
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall Disco Elysium.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Disco Elysium\Uninstall Disco Elysium.lnk
Size 709B
SHA256 172b1c0f67abde22ce6f6e91a9fbc827ac4828dec1c081584264b2185fa309de
MD5 105518e00e1dbf33da445c3327ab993d
SHA1 0267ac1502624541346db24a4f30905bb232c966
SHA512 b085b38b21edf88ebd792fa5bea526cb9ad6c22b0a71043c452bca90b51b37904ed3f47260dedca38919d752ffdf7e71f87681f3743eb9dd9635e4883d15154d
TLSH
T16C01816202956B64D2E047320DD33B56C729B797CDA5AF0E45CC9002C5C0008F57ADF7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c5278060d68961c1e793aa621c658cd3e4b4f1e57bcbbc30c3c6d1b63f74e66f
MD5 76aad0c953eec62e8f1a14e73a2c47cf
SHA1 b7547ea431172c31fa61a78c8eec1191785b7dcb
SHA512 3a172bd362c8f5d5b93ed7e6bd71159f80976299f720f7f99fda18993f525c3a5051053cf33611b85a321d58107fad104c8b57cdc258dddfb56988cab9964d62
SSDEEP 768:6rv+4UNbds36mdDZIO0ynfMNzc4ReyIsXmeVH1S5D:6bsbS36AfMtc44bsWEH1Y
TLSH
T1D903CF36A8788937ACF6A686B54B76533EF8511BC2D81ED4C5DE1F0C4A8B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-1GE2C.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JDFV6.tmp\setup.tmp
Size 1.4MB
SHA256 09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
MD5 ae9890548f2fcab56a4e9ae446f55b3f
SHA1 e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA512 154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
SSDEEP 24576:sH9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextx:0IEJxCWluyZ8UbMK
TLSH
T15B654A12A2A28833E1733F359D2B86946C367D642E74988B3FF45E0C0E79B417D39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASS.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\BASS.dll
Size 103KB
SHA256 df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
MD5 8005750ec63eb5292884ad6183ae2e77
SHA1 c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA512 febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
SSDEEP 3072:75yP416sLgrTWiKc0rUH9rRq/SJIJmECqc2QOeH:czsMH0Yl2QE3zY
TLSH
T193A301CA68D54913E28B2D73B59B61EA63D8A3C4DB63DFD11E0A030A76FA5D406B3304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS.ini

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\CLS.ini
Size 990B
SHA256 3c47c0714b87bb3648a2281a15588c2bf5a41594c1917776b6dad916f7224863
MD5 bccbde7496fea5a4ac700d2b2f4de10d
SHA1 77649dc55adab3924d95cc7292431955209e5fec
SHA512 ae56321cc57ec2e1dec849e573af44c643c7397c87da3a87e52cee9bdd0849540cbbc7e681d0e0949e0da2af7e7fe4ea85084af6cb72686d417314c8e32e9594
TLSH
T14D116611196D556D2100006335B57D1E8D3DCFB4C116AE2C239B48FF2AD487A60FF2F6
MD5 SHA1 SHA512 TLSH

Submit Download

CallbackCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\CallbackCtrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
TLSH
T1F281BB43B3F81059F5B75BB07EE39B8729BAFD315E39C61E0A50011A2830A55AD36B33
MD5 SHA1 SHA512 TLSH

Submit Download

FlushFileCache.exe

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\FlushFileCache.exe
Size 29KB
SHA256 a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8
MD5 df77f2b6126f4f258f2e952b53b22879
SHA1 fedda8401ebfe872dd081538deec58965e82f675
SHA512 623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37
SSDEEP 768:kd82J2m8FCija+1I9ETzJHI6JeLzT3O1:kd82J25TzJHI6JeLz
TLSH
T18FD25A9282D1C0FDE762C5714F389411E97B3A31153196BE3AED55DE4E98760AB0C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\ISDone.dll
Size 380KB
SHA256 c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
MD5 63dc27b7bc65243efaa59a9797a140ba
SHA1 22f893aefcebecc9376e2122a3321befa22cdd73
SHA512 3df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
SSDEEP 6144:YAua3SAQSoYo+1Cjnqakl6j+vn+nLE4FZZHYg5mcQXQJSnI4EUiy:biAKg1C7qmvLE4FZR5mcHSnI4EG
TLSH
T18884BE27F686C1B2D10221319D56E7F66279FB804F2904C3BBDDEE1C5D3AB916A38253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MusicButton.png

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\MusicButton.png
Size 1KB
SHA256 7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
MD5 473a683962d3375a00f93dd8ce302158
SHA1 1c0709631834fd3715995514eef875b2b968a6be
SHA512 24ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
TLSH
T1AC21657F52385772496C03A18FAD75C10F94B65903A563CDA65EFE2807E48A60179045
MD5 SHA1 SHA512 TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\botva2.dll
Size 37KB
SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
MD5 67965a5957a61867d661f05ae1f4773e
SHA1 f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA512 c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP 768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
TLSH
T125034961E9E2D030C096DAFE7D34E224E76F3D201E264AFD5E996ACCDE5BE02141C167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\host.cmd
Size 4KB
SHA256 4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855
MD5 b1377c69e6897fdb715452b1776fad57
SHA1 9e50e4dc1fd1dd782b6181bd59011340486b8e3d
SHA512 13d3b1cd9b011180e517eb8aaef5dec4c03ef53153e099c5d85b996e27571291d227ad54e70c0618b2c6749197460ea1686496644efe26a8ca3c1ec27f3afdf4
SSDEEP 48:sBxWxexnx2xXxaxAxVx+xPxixtxVxXxUx9xUxBxwxmx3xfxCxAxXxeaxXaxZxLxZ:uG1ez
TLSH
T1BCA1F4DF93A9FE52E49854F0F33A2AAA7DDFB423C9C5BDC494350066674B4B0C3A5608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts.exe

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\hosts.exe
Size 32KB
SHA256 49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119
MD5 a7f30bb876775a914422675a13dd56b3
SHA1 3ea28fe66a04ebbad2507a7dfdebf1622c701d43
SHA512 6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656
SSDEEP 768:Oa236jCLhhCBOtYcPhswK7kCQn5A11E4O:OaeY6GWT5R
TLSH
T131E2091133E8826AC67E0EB178F2521045F2FA276E32D70E0D99409F5A67BD4F412BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\idp.dll
Size 220KB
SHA256 f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
MD5 af555ac9c073f88fe5bf0d677f085025
SHA1 5fff803cf273057c889538886f6992ea05dd146e
SHA512 c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
SSDEEP 3072:00EeiIJYud1RvIOACb918qbQ0XY3chnBLqRAJUZxChtDUOZlLFv:LEIVd1VIW18qbQ0/hn4EUZxmfN
TLSH
T15624AE0079CBC437DA4F0378842AD719073AF99617744ACBEF985EAD8D352C39E36296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintb.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LISP4.tmp\wintb.dll
Size 16KB
SHA256 1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
MD5 9436df49e08c83bad8ddc906478c2041
SHA1 a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA512 f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
SSDEEP 384:6j34r4daxbDGQhh5tfEMrg+dOVMVjG+nHL:iorhyepdOVMVRL
TLSH
T16072D68ABF6B24F3E37206F8D1FBB73F3A792910C821AD71DB094515EE33611920521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Disco Elysium.lnk

Path C:\Users\Public\Desktop\Disco Elysium.lnk
Size 559B
SHA256 215a6e512072e0b335d24ea737f1b4b50655188a47c9da76f7984cf268895ab7
MD5 7a09f3450e51544c07f4236fa5884cf7
SHA1 5833c13752b67313f08bebac7235ed7d90448de7
SHA512 011682522b0c0f842627b61fbf49f8bff7fb5fb83107176656432e82979e2939461ce033bfefcbbb537a29c3f64c2ee38dfa93f47c2d25fe52fc2ac4dc7d27e8
TLSH
T18AF0127008BD9A54C3F18E751A679740C9A575D38D69C34E454CA4075652900F435B33
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
TLSH
T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

QuickSFV.EXE

Path F:\Games\Disco Elysium\_Redist\QuickSFV.EXE
Size 101KB
SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
MD5 4b1d5ec11b2b5db046233a28dba73b83
SHA1 3a4e464d3602957f3527727ea62876902b451511
SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
TLSH
T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickSFV.ini

Path F:\Games\Disco Elysium\_Redist\QuickSFV.ini
Size 155B
SHA256 74ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629
MD5 c5c28798bca6e9ed5d84fa67b656065a
SHA1 4b6fa3465f1b393e22e9f083b177462028a48e93
SHA512 c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963
TLSH
T12DC02B3D075C40150D310E54D0CD71406D4C550F6438CC01AC0437009F10D232A18FA0
MD5 SHA1 SHA512 TLSH

Submit Download

dxwebsetup.exe

Path F:\Games\Disco Elysium\_Redist\dxwebsetup.exe
Size 292KB
SHA256 ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494
MD5 56d52c503adf02184f19eee4767ef60a
SHA1 ca133f67a286f4f20282e19837b53b38a27a1caa
SHA512 246f35664a9af548d402878a3e6ce6d8901a0978477b145db5fd4e5857021efc4016369e9e02e709a27cf5c84f44a32e106008668ba96e2b45d4d06599090d8f
SSDEEP 6144:lWK8x2ZFD7h/uMdnv0iyLI6utiI1ARjhaXcoUvedlVFdo:22ZFD77dnBhi3Us8/VFdo
TLSH
T14F54F15263E9813BE0F52B7929F747432B70BDA49C7DE32E534654880CB2788B87572B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fitgirl.md5

Path F:\Games\Disco Elysium\_Redist\fitgirl.md5
Size 320KB
SHA256 e1901e8d038d5fa7f9437b75624723c66e9ebc5d7928dce6ead1f0cb98705336
MD5 5382b99c99d24780f70a3231df6d4c52
SHA1 e36f9149ab3345975f115cd8ef450e2ceee21782
SHA512 b120e0e12b4607fd0f9d902d632d1277607ae4ea6391fd1baa9d442ac98c8062512fa96c2b1d2a11ed6aa60e54ff90dbac4160aef82dc3865b25a79e26fffafb
SSDEEP 6144:dH4cwtae2YeJ4T1dTR0w4FMd4DcWI84uy:dH41Qe2YoS1b2M+D68+
TLSH
T177648099865DCE3B6A367724436B47C0027163E20F61F25CCA1487D2BA5BC9FBD63DA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64_2013_x64.exe

Path F:\Games\Disco Elysium\_Redist\vcredist_x64_2013_x64.exe
Size 6.9MB
SHA256 e554425243e3e8ca1cd5fe550db41e6fa58a007c74fad400274b128452f38fb8
MD5 96b61b8e069832e6b809f24ea74567ba
SHA1 8bf41ba9eef02d30635a10433817dbb6886da5a2
SHA512 3a55dce14bbd455808bd939a5008b67c9c7111cab61b1339528308022e587726954f8c55a597c6974dc543964bdb6532fe433556fbeeaf9f8cb4d95f2bbffc12
SSDEEP 196608:19OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:Gz5x7jLXkmkU4cFe
TLSH
T131763331E7B05023D6F201B2E411D528BD3DB2291F109CAAD794DD2D3AA9AD6E7F7213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86_2013_x86.exe

Path F:\Games\Disco Elysium\_Redist\vcredist_x86_2013_x86.exe
Size 6.2MB
SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
MD5 0fc525b6b7b96a87523daa7a0013c69d
SHA1 df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3
SHA512 729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d
SSDEEP 98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
TLSH
T13566233296642033D6F10873F469E2217E3E721C2F1188BAD294DC5D3EA95DAA7F7352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.dat

Path F:\Games\Disco Elysium\unins000.dat
Size 153KB
SHA256 f0cab7205170f081c6ff4b0aa00eb4f0779246eaa5c97043a28f4c77af567a53
MD5 8b7abcd4b040f402bd3e9e7755f8cda0
SHA1 15ae8b4dc0cc190a6ef23283f10e9d53cdc059b0
SHA512 0d1f8660c957eb9f189a9ad0d58c55cf6f52a0f6cb6e26627fbaee1c2df5d980c0db1aa51ffe726eda7406cadd79977d3479423d727b80c1045ff0dbacd01aa7
SSDEEP 768:sRafhZ2jLfJVYzs31h73mlOoPHzfDfgR7B:jhMjLfL31UOlR7B
TLSH
T12AE33A0DAEFC9831D76DE636D8B71208373A3D8496A2C33627AF4DB65413B8C95A7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path F:\Games\Disco Elysium\unins000.exe
Size 1.4MB
SHA256 027e1f092b04e82e2b160d005508736026aef4240bbb0ab144bd265f213b16a6
MD5 1d000e301ef0ebd9189ed4bbbaf6668c
SHA1 150ffbaad7535fb014bcad37829675ba8ab079ae
SHA512 19f10e630cf8ca573ecc2105b02b5ce96ab08728e3b6d26ea26605ccef323efc208c12bf028e05ffab1a82bdb83e8ebd65dc16ab78f8aaf57b244cb72b1acb24
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextxG:cIEJxCWluyZ8UbMKq
TLSH
T139653A12A2E24837E1733F359D2B82946C367D642E74988B3FB45E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-224-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2968-231-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2968-250-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3128-284-0x00000000008D0000-0x00000000008DE000-memory.dmp

Download

memory/3528-89-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-101-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-131-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-138-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-146-0x0000000007E70000-0x0000000007E85000-memory.dmp

Download

memory/3528-145-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-152-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-162-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-163-0x0000000007E70000-0x0000000007E85000-memory.dmp

Download

memory/3528-172-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-173-0x0000000007E70000-0x0000000007E85000-memory.dmp

Download

memory/3528-118-0x0000000007E70000-0x0000000007E85000-memory.dmp

Download

memory/3528-117-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-110-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-226-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-225-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-115-0x000000000B3E0000-0x000000000B3EF000-memory.dmp

Download

memory/3528-111-0x0000000007E70000-0x0000000007E85000-memory.dmp

Download

memory/3528-103-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-104-0x0000000007E70000-0x0000000007E85000-memory.dmp

Download

memory/3528-108-0x000000000B3E0000-0x000000000B3EF000-memory.dmp

Download

memory/3528-124-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-94-0x000000000B3E0000-0x000000000B3EF000-memory.dmp

Download

memory/3528-80-0x0000000007E70000-0x0000000007E85000-memory.dmp

Download

memory/3528-82-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/3528-8-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-90-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/3528-83-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/3528-81-0x0000000007FC0000-0x0000000008025000-memory.dmp

Download

memory/3528-9-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-254-0x0000000007E70000-0x0000000007E85000-memory.dmp

Download

memory/3528-253-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-255-0x0000000007FC0000-0x0000000008025000-memory.dmp

Download

memory/3528-260-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-267-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-79-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-23-0x0000000007E70000-0x0000000007E85000-memory.dmp

Download

memory/3528-33-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3528-30-0x0000000007FC0000-0x0000000008025000-memory.dmp

Download

memory/5872-78-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5872-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5872-2-0x000000000041E000-0x000000000041F000-memory.dmp

Download

memory/5896-251-0x0000000000400000-0x0000000000579000-memory.dmp

Download