a74c04b901b29791a178793e15353d88ab2f822eaa8bd5f6c716f795602334c2

Analysis

max time kernel
36s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QuickWareSetup.exe
Size 84.7MB
Sample260723-qfvfeabb33
SHA256 a74c04b901b29791a178793e15353d88ab2f822eaa8bd5f6c716f795602334c2
MD5 9c97507ca8f31c701a0a50c752d4334a
SHA1 c7aef75bb74eb36de61a43de0215c8d1cb1d5a74
SHA512 3d384695b9f8d3c28d94817f7410c23de797965c0189eb5477f7b4cd817d2a282bc82e15d528e98db1f2e5e551f48a4275f8345765dfd9183dd77f1009b7783b
SSDEEP 1572864:c+RnR/cBw2QBtRkeWy01F4ttoY+fdoEj81J+pFgrTrnmTD8G:XxT2ItCEoY+uMFgDmvR
TLSH
T1B4183337F39BA17AE26DA93AB9325024993BB9A459154C0287FCF18CCB342714C3D797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer persistence

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
2076	QuickWareSetup.tmp
3424	WorkFlowy.exe
5444	WorkFlowy.exe
1056	WorkFlowy.exe
3016	WorkFlowy.exe
2996	WorkFlowy.exe
4260	WorkFlowy.exe
3824	Distributed_38.1819.431.45_INSTALL.exe
4256	Distributed_38.1819.431.45_INSTALL.tmp

Loads dropped DLL 17 IoCs

pid	Process
3424	WorkFlowy.exe
5444	WorkFlowy.exe
5444	WorkFlowy.exe
1056	WorkFlowy.exe
5444	WorkFlowy.exe
5444	WorkFlowy.exe
5444	WorkFlowy.exe
5444	WorkFlowy.exe
3016	WorkFlowy.exe
2996	WorkFlowy.exe
2996	WorkFlowy.exe
2996	WorkFlowy.exe
2996	WorkFlowy.exe
2996	WorkFlowy.exe
2996	WorkFlowy.exe
4260	WorkFlowy.exe
4256	Distributed_38.1819.431.45_INSTALL.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.WorkFlowy = "C:\\Users\\Admin\\AppData\\Local\\SmartWarelyMegaSuiteize\\WorkFlowy.exe"	WorkFlowy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.WorkFlowy = "C:\\Users\\Admin\\AppData\\Local\\SmartWarelyMegaSuiteize\\WorkFlowy.exe"	WorkFlowy.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6064	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuickWareSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuickWareSetup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Distributed_38.1819.431.45_INSTALL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Distributed_38.1819.431.45_INSTALL.tmp

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4148-0-0x0000000000CD0000-0x0000000000DB9000-memory.dmp	innosetup
behavioral2/memory/4148-250-0x0000000000CD0000-0x0000000000DB9000-memory.dmp	innosetup
behavioral2/files/0x000c00000001c627-262.dat	innosetup
behavioral2/memory/3824-264-0x0000000000290000-0x0000000000373000-memory.dmp	innosetup
behavioral2/memory/3824-286-0x0000000000290000-0x0000000000373000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3016	WorkFlowy.exe
3016	WorkFlowy.exe
4260	WorkFlowy.exe
4260	WorkFlowy.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe
Token: SeShutdownPrivilege	1056	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	1056	WorkFlowy.exe
Token: SeShutdownPrivilege	3424	WorkFlowy.exe
Token: SeCreatePagefilePrivilege	3424	WorkFlowy.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 2076	4148	QuickWareSetup.exe	89
PID 2076 wrote to memory of 3424	2076	QuickWareSetup.tmp	90
PID 3424 wrote to memory of 5444	3424	WorkFlowy.exe	91
PID 3424 wrote to memory of 3016	3424	WorkFlowy.exe	94
PID 1056 wrote to memory of 2996	1056	WorkFlowy.exe	95
PID 1056 wrote to memory of 4260	1056	WorkFlowy.exe	96
PID 3424 wrote to memory of 6064	3424	WorkFlowy.exe	97
PID 6064 wrote to memory of 3824	6064	cmd.exe	99
PID 3824 wrote to memory of 4256	3824	Distributed_38.1819.431.45_INSTALL.exe	100

C:\Users\Admin\AppData\Local\Temp\QuickWareSetup.exe
"C:\Users\Admin\AppData\Local\Temp\QuickWareSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\is-DC23GE26X3.tmp\QuickWareSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DC23GE26X3.tmp\QuickWareSetup.tmp" /SL5="$500F0,87622760,893440,C:\Users\Admin\AppData\Local\Temp\QuickWareSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe
    "C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe
      "C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\WorkFlowy" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1696,10109177395146259777,11491913627244095538,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5444
  - - C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe
      "C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\WorkFlowy" --mojo-platform-channel-handle=1980 --field-trial-handle=1696,10109177395146259777,11491913627244095538,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\1784812400447\Distributed_38.1819.431.45_INSTALL.exe""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\1784812400447\Distributed_38.1819.431.45_INSTALL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1784812400447\Distributed_38.1819.431.45_INSTALL.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\is-CJ9EYE9U9V.tmp\Distributed_38.1819.431.45_INSTALL.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CJ9EYE9U9V.tmp\Distributed_38.1819.431.45_INSTALL.tmp" /SL5="$F0062,2909603,868352,C:\Users\Admin\AppData\Local\Temp\1784812400447\Distributed_38.1819.431.45_INSTALL.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe
      "C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\WorkFlowy" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 --field-trial-handle=1696,10109177395146259777,11491913627244095538,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:4552

C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe
C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe
  "C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\WorkFlowy" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1780,17380502825658185848,16130700640121586246,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2996
- C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe
  "C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\WorkFlowy" --mojo-platform-channel-handle=2060 --field-trial-handle=1780,17380502825658185848,16130700640121586246,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe
  "C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\WorkFlowy.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\WorkFlowy" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1780,17380502825658185848,16130700640121586246,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:4200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\578373b004c954bf\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 a5fa28c8a8a9c975f246b205606ffedd24656f5cdb647eb78fe41181012be98e
MD5 9de1bbe8c45864680880198ad7c8c083
SHA1 f7c8489e4c6474c021a9b934fd9494a2971fe72d
SHA512 3fff253160fcf7cd40463de50539a3108710b51371e00e79ea7954112f445d011b92961882c61b8e05031a55d5c9efb059d3bd050806ed621f69c559bd53a6fb
SSDEEP 3:Bfj/lGlll/l/lXp9ZjrPBY0GlGlxeFTP:p/0dPBY0yRD
TLSH
T12C5312C651C20127C462433004C70A483AF417040353041147104230C4B97000060181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\578373b004c954bf\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\578373b004c954bf\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1024B
SHA256 f3b14914c1109e66c7b900583a4ab0e4989b76f2206f313ea45cb906d1cfa136
MD5 3d8b232c12af63c528ce303e96883974
SHA1 c4afce679ddfc8987a926d4da759dc18bab7a5e5
SHA512 e493f846ca5c8335450e0f531707bf6b73574110d1213288a03c6e21dbf57e755bccd2d0420202a10bd2f6d8b9527f98aaee2c52c021e712c033af174ff5c278
TLSH
T1A21112817BEF3D70FBBBB93575B6E2182677B1255881D10D4480C45A4D3295D8821B65
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\d3dcompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\ffmpeg.dll
Size 2.6MB
SHA256 094f0d3051a1a6e0e7bc950cf013776c9beb51c1cb78fb76785b8a14b43a4011
MD5 ab8368e8d0c31177a96e666f403d4163
SHA1 947d916c32f753e5e5c7bc871c65c47b727d8c64
SHA512 007f277a05b42022e7ca3e31edbcc6d24fb701faf038607bc6a07f281c0ac061b4ee6d0fdb61412cac1d36037dbc2dfee81d3f563634564b9e9357998c305851
SSDEEP 49152:+ECJ65OaQWBt2agP7TsyRT63/aoFHSgaYrUgZtAc/9Z3xB0a4Tml0m+af:xIbRTeioFNUJc304
TLSH
T139C59E17E2E640DDD01DC67487AF9233F93178494724A6EF2A919A252F3BFD06A7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\libEGL.dll
Size 437KB
SHA256 6b88f66d88ffe7447e77bc015a91619bba22be4fafc660cdd8f34df638a3fa7e
MD5 aeb671e5980459e504d89fcc6902dfdb
SHA1 1362f1d02609d686b107a5026662a062f10f8e9a
SHA512 5af1141cf4960792f93bc31f20163de9ac404b59d53700f1f7cab5c463dbb6ca20ee1925d3465f96858cc6b80dba10b536c5cb85d8f1e1382e5c045195813da6
SSDEEP 6144:udpiWYLBViWOSdAr1Knk2mI3LpxE0RYqowpW6VmHrtIf1FI:wpvYLbiWBqrQnPxE0cKmHZMP
TLSH
T10F948D16F79444B9D06AC074CA634643DE61B8960B25F6DF13A4836E2F7BBF45B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\libGLESv2.dll
Size 6.7MB
SHA256 e64ab8eef811cbf0c61e142b0f22e3a51ac5fab4a8f3f1c66f61b80e6ac2ce0c
MD5 126cf6e2d56b356eb88a38de66689597
SHA1 a3f1a0251e9467f4fbecf0f51b6866817e2d726b
SHA512 593db4f97c9e25d681130db02f95d6c8bc6e8dce3917dd6aa95649883e52de0137837d0337ae33b7faba230ec92f35502a70e939df21c9aa0939bcfff6042f43
SSDEEP 49152:IK2UPH7xqUcXJQ/jprR9tf3NPj3O92E+hvk3aOosZPYkZXup70MUgSgcS87ExQhc:gUcXJ8950X+KS5nUSoPYiLbm
TLSH
T197666B07F2A140DAD04DE2B99B5BA122EE31BC460764B2CF229477113F77BE46B3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\vk_swiftshader.dll
Size 4.4MB
SHA256 3a5293d0a9ef80508e8a4c1b94ec56134fffb3979099da24354de3900ac233e4
MD5 19b2fc488eacb64cb5712c41a91166e9
SHA1 f5d11af95cbdd79edaefe8338fa6bdc2d7b002df
SHA512 5c4a7463f26bb5f98fd70a28ba8d95f7d394034bf1ae5735f546f818220732db1314396220a7d8285dbf215fc6588a27500aeb4135328f96be088e9176a9c9fc
SSDEEP 49152:rx2VjoakX4pb7QH1fUlTB7zmNmdpTE5NSomaZXYjLlHks2RPF/lOzl+LZ/n6du7F:s2DtJ+wixdag
TLSH
T191263903F6858099F05DD57D8B4BA622E632BC801B7276EF52A02F152E77BF06B39714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\SmartWarelyMegaSuiteize\vulkan-1.dll
Size 819KB
SHA256 0abe5a73d41de830917df956e3a805c84f2158fd8cde62a19bd673d6c3490367
MD5 50558b0de6bb7c025af145b09ee51a32
SHA1 826a7697b414f7429477a0f24be91efe955b9bd5
SHA512 e950aedcac911d2769e26d4659cdeae9423b1fa33dd8b59e4fccab4a1ef0b57cca3882a9c02e91ae0c74efeffa8c24eff66acb2eb0f1955a3638baf3e73f685b
SSDEEP 12288:UkyJJLfcn5To6PuXtLvEdGnZSss43uobmoD:rnhoR5Ed8S2uWD
TLSH
T175056D27A688856AD4768039D9828603CDB17C921B25B5DF13742709BFBFFF4273DA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Distributed_38.1819.431.45_INSTALL.exe

Path C:\Users\Admin\AppData\Local\Temp\1784812400447\Distributed_38.1819.431.45_INSTALL.exe
Size 12.9MB
SHA256 14172b5e602d40ec247e1180a8430266ad5f9e14068e82556f3dc346b72eba99
MD5 4eb44336d61e363c42a6779b405bea5f
SHA1 9642a814afed4d419a83bbd79d953c8c1a138f28
SHA512 f72d4d82e378e8ff9205464a97f5482a69f7b70f2753901dd4d6dc0fdf4f32cc662c747e4a9c400c48f61641531c6e6cd46673c334473e1817fdbdd77f935dfa
SSDEEP 98304:coJJqS2sncom1pHaPnwuRoYPUTa7eKITIXyeLMuo:/Rdcx1pwnXR6TaKKIcieLMu
TLSH
T134D6F13BB24AB93DE06A27359973D160543B7E24AD024E0B96E4386CDF359E03D3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Distributed_38.1819.431.45_INSTALL.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CJ9EYE9U9V.tmp\Distributed_38.1819.431.45_INSTALL.tmp
Size 4.2MB
SHA256 b89cf32a17344e90170500707055d6e7f319617668c567470447e03a3d55aeb9
MD5 5a5facf2ba0b62e79e9df55bc0dbf201
SHA1 810a9da767675a4915b7b8326e5ce2fac7063315
SHA512 013e84558c1208962f9349e3c53f7a7cda6aaaf496a8c7398bcf4b0a5d20368bf704f61680d55fc179fc4c1c83cab9ce36ed26a26ba287077cd163fce21c3524
SSDEEP 49152:NeGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4jiN3331y:NeGwK5YHCNmi16F+QxvCeFLmN3338
TLSH
T180167E17B348753EE4671B3A4837E694983B7E213A128D4B7BF41D4C8E39A80BD26753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickWareSetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DC23GE26X3.tmp\QuickWareSetup.tmp
Size 4.2MB
SHA256 72f60523207deaee7cc01a78609810c78e4de650b2fe0b3e89ea39fe033decf5
MD5 5028625863c37fa70d1d4d0f231bcf5c
SHA1 04a38885ca4f8eb00fd6effd1dbf785cde586841
SHA512 a4c86c1a4fb6a918c273c8070510e3f7fe4fcb4be5cae69dd10d5a4a58bf48cd38744013d90e3e6a950b98f496fe74004c6a596fefae9a5fbe55b94bd2f90bf5
SSDEEP 98304:B3U5HY/KwjoYY1j48UWm2eTMFdC+Jb333Pl:24/1jorPmEhl
TLSH
T164268F03F388753EE4571A3A483FA680983F7A213A15CD4B6BFC295C8F396416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-S4B8Z2XFFT.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\WorkFlowy\Local State
Size 389B
SHA256 78eff586aa8cc163d1208ad20335df471b38c1c9a0c4402a29778574ef397ec2
MD5 b267ab120cf665a9784cb9c5d725efd8
SHA1 5a953732972984070324bd72180414c4c7eda6ad
SHA512 06ad7aeff38f2d499ae15e844e029981228898baa8dd3b119ea2086c11a59e3ea6d1f35a8f94c7c135197bad863cd0cb77593640bedbef38b272fe97cbd0e395
TLSH
T1DAE0C0B469935E081BF35EF2D5A2D4072D4C24B712D11F05DFEC9124B156BF84C0BCA0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\WorkFlowy\Local State
Size 389B
SHA256 7c0432aad8d9dd58f3b7e4996408cfd993cbbf655be507464da7b2adbbbfe978
MD5 a9bd7224144a22019620e6259715d43d
SHA1 65fac9c5852890296af9997b6c3c6eb19182f4cc
SHA512 75be9b69a3dccf3f9c1454b756bfbf4d67d588ce3ff4a1d07f38917d2844fa5d8ddd030448f211851c625ea82851d4bcb064de7a570938f6bb50c95aae6751f5
TLSH
T155E0C0B526901CC7356E80AE4593D6224E2565435366278D1D6EB4046A78ED6086CC78
MD5 SHA1 SHA512 TLSH

Submit Download

setup.txt

Path C:\Users\Admin\AppData\Roaming\setup.txt
Size 8B
SHA256 aff12ae22c4ee6bdc6ba89acf3166c8474acb8d8d41c94270c91918c0a874116
MD5 31258b2ad2d7d26ec4fc263843dcf465
SHA1 e25eb1759ce25fa36ac4ca9405856234c249c228
SHA512 57153ffa796c957bc5e55dabb6dc73e50f10d80e792c1b83152777f817342cf6881fae3f1bbd3a8c6abe39d8f157dae01911b03f752a8443f2024fbd3e95c14e
MD5 SHA1 SHA512

Submit Download

memory/2076-253-0x0000000001680000-0x0000000001681000-memory.dmp

Download

memory/2076-6-0x0000000001680000-0x0000000001681000-memory.dmp

Download

memory/2076-251-0x00000000006D0000-0x0000000000B1B000-memory.dmp

Download

memory/2996-285-0x00000236BE070000-0x00000236BE117000-memory.dmp

Download

memory/3824-264-0x0000000000290000-0x0000000000373000-memory.dmp

Download

memory/3824-286-0x0000000000290000-0x0000000000373000-memory.dmp

Download

memory/4148-250-0x0000000000CD0000-0x0000000000DB9000-memory.dmp

Download

memory/4148-0-0x0000000000CD0000-0x0000000000DB9000-memory.dmp

Download

memory/4256-287-0x0000000000AA0000-0x0000000000EDD000-memory.dmp

Download

memory/4256-293-0x0000000000AA0000-0x0000000000EDD000-memory.dmp

Download

memory/4256-317-0x0000000000AA0000-0x0000000000EDD000-memory.dmp

Download

memory/4552-353-0x000001A1302D0000-0x000001A1302D1000-memory.dmp

Download

memory/4552-360-0x000001A1302D0000-0x000001A1302D1000-memory.dmp

Download

memory/4552-361-0x000001A1302D0000-0x000001A1302D1000-memory.dmp

Download

memory/4552-359-0x000001A1302D0000-0x000001A1302D1000-memory.dmp

Download

memory/4552-358-0x000001A1302D0000-0x000001A1302D1000-memory.dmp

Download

memory/4552-357-0x000001A1302D0000-0x000001A1302D1000-memory.dmp

Download

memory/4552-362-0x000001A1302D0000-0x000001A1302D1000-memory.dmp

Download

memory/4552-351-0x000001A1302D0000-0x000001A1302D1000-memory.dmp

Download

memory/5444-276-0x000001A0B57C0000-0x000001A0B5867000-memory.dmp

Download

memory/5444-233-0x00007FFAC7E60000-0x00007FFAC7E61000-memory.dmp

Download