a497f34dca6838899633919f0f2e31922c61893a9a434b895b7f96aab856837c

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TigoTagoSetup.exe
Size 8.2MB
Sample260724-gvmvfagr2v
SHA256 a497f34dca6838899633919f0f2e31922c61893a9a434b895b7f96aab856837c
MD5 2d71d4968cda4d18034a5dca87e7e269
SHA1 ea17a2f86a506208cbc0cb37c9ff185484071561
SHA512 06b16a2aa8bca7574ea45ce96feb964b5188584e75dc29008669ea3b04bc69876fc869ff0d86899a020728e4cefb7d61c06934e68cba716f51195f73d7a5aa09
SSDEEP 196608:I3vXS0/YdzIlqHHvuihxS/ZyRNIISsX1YYrBF7RzZ7a7CloWL759:I/XS3zkiHWihxS/Zq7Rl7/loC759
TLSH
T1529633A4A791366DFA0592B60427B385C3391BFD26B5811C83D53B60BF0DA0D0F5A7CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2520	TigoTago.exe

Loads dropped DLL 43 IoCs

pid	Process
5772	TigoTagoSetup.exe
5772	TigoTagoSetup.exe
5772	TigoTagoSetup.exe
5772	TigoTagoSetup.exe
5772	TigoTagoSetup.exe
5772	TigoTagoSetup.exe
5772	TigoTagoSetup.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe
2520	TigoTago.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 47 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Yoplo\TigoTago\SourceGrid.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\bin\ffmpeg.exe	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\openjpeg.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\xvid.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\abcAVI.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\CueSharp.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\fastJSON.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\Interop.abcAVI.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.Media.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\TigoTago.exe	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\libvpx.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\opencore-amr.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\plugins\Yoplo.WaveInfo.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\TigoTago.Resources.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\ffmpeg.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\lame.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\README.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\shntool\shntool.exe	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\uninstall.exe	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.Controls.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\license.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\frei0r.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\sdl.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\vo-aacenc.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\vo-amrwbenc.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\zlib.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\TigoTago.chm	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\taglib-sharp.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.SysUtil.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\bzip2.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\gsm.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\speex.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\x264.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\xavs.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\rtmp.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\schroedinger.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\shntool\alac.exe	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\shntool\flac.exe	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.Resources.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\freetype.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\vorbis.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\shntool\mac.exe	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\shntool\doc\Credits.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\TigoTagoSDK.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.Net.dll	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\FFmpeg\licenses\theora.txt	TigoTagoSetup.exe
File created	C:\Program Files (x86)\Yoplo\TigoTago\tools\shntool\doc\shntool.txt	TigoTagoSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TigoTagoSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TigoTago.exe

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}\2.0\HELPDIR\ = "C:\\Program Files (x86)\\Yoplo\\TigoTago\\"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\ = "IExtendedAVITags"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\TypeLib\Version = "2.0"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\abcAVI.ExtendedAVITags\ = "ExtendedAVITags Object"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\abcAVI.ExtendedAVITags\Clsid\ = "{18EC608A-B23A-11D6-BEA5-444553540002}"	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}\2.0\FLAGS\ = "0"	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}\2.0\0\win32	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\Open with TigoTago\command	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\TypeLib	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\ProgID	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\ProgID\ = "abcAVI.ExtendedAVITags"	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\Version	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\TypeLib	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}\2.0	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}\2.0\FLAGS	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\ProxyStubClsid32	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\ = "ExtendedAVITags Object"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\InprocServer32\ThreadingModel = "Apartment"	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\abcAVI.ExtendedAVITags\Clsid	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\ = "IExtendedAVITags"	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\abcAVI.ExtendedAVITags	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}\2.0\ = "abcAVI Info Library"	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}\2.0\0	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\TypeLib\ = "{18EC6087-B23A-11D6-BEA5-444553540002}"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\InprocServer32\ = "C:\\PROGRA~2\\Yoplo\\TigoTago\\abcAVI.dll"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\Version\ = "2.0"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\TypeLib\ = "{18EC6087-B23A-11D6-BEA5-444553540002}"	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}\2.0\HELPDIR	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\TypeLib	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\TypeLib\ = "{18EC6087-B23A-11D6-BEA5-444553540002}"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\TypeLib\Version = "2.0"	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\Open with TigoTago	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EC608A-B23A-11D6-BEA5-444553540002}\InprocServer32	TigoTagoSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\ProxyStubClsid32	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18EC6088-B23A-11D6-BEA5-444553540002}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18EC6087-B23A-11D6-BEA5-444553540002}\2.0\0\win32\ = "C:\\Program Files (x86)\\Yoplo\\TigoTago\\abcAVI.dll"	TigoTagoSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\Open with TigoTago\command\ = "\"C:\\Program Files (x86)\\Yoplo\\TigoTago\\TigoTago.exe\" /path=\"%1\""	TigoTagoSetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 2520	5772	TigoTagoSetup.exe	91

C:\Users\Admin\AppData\Local\Temp\TigoTagoSetup.exe
"C:\Users\Admin\AppData\Local\Temp\TigoTagoSetup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Program Files (x86)\Yoplo\TigoTago\TigoTago.exe
  "C:\Program Files (x86)\Yoplo\TigoTago\TigoTago.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SourceGrid.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\SourceGrid.dll
Size 584KB
SHA256 df32e7330f27b476ef3d64bdd07a670ad7fce6c95f40b9d9c034af8261c84732
MD5 2f9ea0f0daf50c2aa0feb9c79dc33f27
SHA1 2973c09974ed5600649ae8d4b3f0df5ccb31be1b
SHA512 95c3d37ff9deffc4ab8e15188f64b92fccbd78df040277f61bfbed41999948f03de686df1ed498d3f2fe93c75b6085f473873cce75145fc27a15513f8329b942
SSDEEP 6144:OBK7AVM37f4AE+3YcHx0IXliqxFQHLC1ygM7xboD4Ya7csorTHoXS:OBK7AurfcxcHxxVi+uLCzrTHC
TLSH
T15CD45B21739C9AABC49F0B3EA430440997F0E545779ED79FBD48A22D2C937669F21323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TigoTago.Resources.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\TigoTago.Resources.dll
Size 232KB
SHA256 f4f1e6564d4c4bbbcbf2c2beec97d1bcdda3d2ea003ee7b16d09274702cb0355
MD5 7e3ffcc73fddaac704f2ec063e263cdd
SHA1 4a4a6ebfbfa30b0146356e65ce9aa4f91b00736f
SHA512 1bd720a0c39b217a1245d599f4b4582f78da45c689d91d166b004717371a936fa52d303276412dd2c742fc90a048ec407fdcfd8f1b9f0a7fe21062e1c8763c1a
SSDEEP 3072:6TJgJxpkfUzbNEbauIHEOaACy93WgATOLjRHEfI:61WyoEbxIkOaACWWPCLNEf
TLSH
T1A3348E82BDFF9411DD2F73BEB9DEE650B622792C47EA52077444B11684A7304BE2AF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TigoTago.exe

Path C:\Program Files (x86)\Yoplo\TigoTago\TigoTago.exe
Size 300KB
SHA256 9379115797299b502ff34328bbcc694966fd817993d61bcd65ccaaf38d6198ee
MD5 b2f0519047e99f68fa95e4bf346c66f8
SHA1 3973f08f87b8db40910cbbe3513c75716f208381
SHA512 f853413b598d46cf89eb9dd924512386639d76bf99fc3a4c8eedc1195673086bb195deb5b93eae48b964b42ecfdcdb9e7b7117647b09d5306cbb63dda3fbb844
SSDEEP 6144:pSiMIbT+tNzqspYDbkwaWYLvAJCR5si0/537:UauTzq+EXaW2AUeJ17
TLSH
T1E66417A133B886D7F67E4BF044241C8083F5B20B6A9EE2DD9CC124DE19F2B918712767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TigoTagoSDK.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\TigoTagoSDK.dll
Size 24KB
SHA256 50ef36a92ce9dd68ae682613391d28939e7214c3ecef51432e59c3892682b722
MD5 8504ff073ac1ca51b783c31edf3a125e
SHA1 dec76dc1fcc6a5a742133d5cdb02f03070eea581
SHA512 5d8051ed1bb835cc73868a595a6844b25f745563e02f05c1f8cc994853b6169f46fef5821ac6a82efd30d92a4b9e83db5f1b1cae0c88c03f6045cc0f7594ee21
SSDEEP 384:7uQn9nbnenBnonznqMnGPM4JnGn0Z+nN4n3TCiMZBlqJ9zAa/syb:/9beBozpqGSDHMZBlQL/zb
TLSH
T1D8B29506D76DC32ECE9E0276FA5323261270DB832617C789097881DEBC977A416C23E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yoplo.Controls.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.Controls.dll
Size 40KB
SHA256 71538314c4d8f7b5c18f374571a718ce0b27f8964d949af3f6ea27746edde063
MD5 ef73d689f2a7dfea8b4a2ad3001522d6
SHA1 963bfa9bc08091dc23d87c562064bdea04e3a660
SHA512 f5f0c74204f75f9db859ce21fa51231efe2217bd04a739692a76110bb3d1d9261df61984c362dd7a9b4ee6e334d2456cc1c97d5b497385ffdffbb0eee3b6541e
SSDEEP 384:lPg3xf46PiujQ7NxfedNnCWLdg+Vvh12fBb67s7B8a/jllllllvmzNXU/coX:Fg3WuQ7NFeuCJvhUB3/GXUJ
TLSH
T12303E72773989613C9B916F8682233840336A34D6817D39D0CC967A9DDEB7C3A7663C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yoplo.Media.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.Media.dll
Size 100KB
SHA256 b816490236664e6efa4178093127d36c1f8d0cd380a0e5303a7a8967944644e7
MD5 e80e3e3bbbf1d3ab4fbf8b2ea9c1d025
SHA1 91b467b392216b87d07a933fe0b1c854c98f1682
SHA512 dacc5b1488a3fa7d1b32853a3e27ef178f77d1370357f1138ab68ccc9ad07130b09ee62121bd71affb54f333191405c183f607a47a085e745929fd5a73c3ca54
SSDEEP 1536:bEDDOV3reV6+7u4q0nVFZbF1kw9eLXDMP1x/5ss4mXEUUga:06+7LF1ALXDMP1x/5szUk
TLSH
T140A3C604D3BCCA5DD2FB0635F4B1823646B2FA23B625EF5E1FA480CE9C627044956B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yoplo.Net.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.Net.dll
Size 24KB
SHA256 4a330287f312b8e461917f46c20cd6319cc608bc5b643e3eda2c5ee646ea21a7
MD5 dae44fa0fde4b38e546b9c047de3b204
SHA1 72eeaa756def4d9f75aefb887e15b8f6360a0197
SHA512 8076338c63b2b2291ee192bf700151c08b70e50a42a49eab29516ee058d05c4c0e7546f11f593c5f8dd5caf2482a64504fd8791ecb6a4484ac4342212713f080
SSDEEP 192:ibhyFg9i62+Uy5x522M/KiflySpseRkXaaCfsh8oa6Xkhpk+YyxRt:ibqy5xY2TAoSCutaCcB0hpk+/t
TLSH
T1D3B2C31FAFCC473BE9595A7CA86A4B810231D8205593DB5F8DC0A49B6C53F281B2372F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yoplo.Resources.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.Resources.dll
Size 72KB
SHA256 4da9e9a54b9bb6de44f6eb74fc566594a4a7fb875d8aae188164a4b0a3e1c13a
MD5 29b824dbbb495c7a6e5022aac18fd3a9
SHA1 cae423fbb98c8dc8975d3834291b104c97a8ca64
SHA512 e4945e4e43188322b2f1e63f0bc2cd85dde00ea160f0aa5fea63aada024a85492ded260049cc28038a0c756f2cdee27e8f9a02f0156e060ec927674770083f0e
SSDEEP 768:WafkltW21bN91YoDcjncmO/LEqf4Jy/BrKOVYeJX2nK2S7qY62awiOa5G2a4:WLtW2jocmO/4a3p2KX2KF7qXDk4
TLSH
T11873C73233E85F17CCBD1AF40C2462840735E2566911E79E9C88525DBDA7F9B8B12BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yoplo.SysUtil.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\Yoplo.SysUtil.dll
Size 20KB
SHA256 298aa84110a011d4fd8d63f0fbf58ed061f9696af2d67b8a1d6a1d452a319652
MD5 607b81497bf4b1250b94c8657c75cb92
SHA1 9f49cd9a42e524b2135775f35549d24607c24613
SHA512 66e2be14a1e194b8ba9fa0c2e241438a51b6bdc9ffebd070ff3b624f412db332fb95d9be57a86ba13d5386920e643f5bc7b461643935d9c9c364650a6485b65c
SSDEEP 192:KbgjfEIUtX8BIrAn23MWsPuaezkAYXSWA:KT8BlRPuawZN
TLSH
T11692E619E7A54722CD6E077DDCD343429736E618EC12DB1F1A8D409BBD727A40722B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abcAVI.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\abcAVI.dll
Size 396KB
SHA256 828b32b1bab470ee25fbce4361584dadaba285fbfa829b15c22d7bb4f3e47646
MD5 231e446e6e3b1e8ca9e918350583572e
SHA1 7745aa85919f1f47e2d6872e6d4f4d6c01aff525
SHA512 b99bd887ce7f25d4c1be71731789f1e1ab639444a7448d76afedaee73d8dbe8be8cf4d0b7b2e100073a1b1a0093eb8420f917e334e572a02a441b86c992a5623
SSDEEP 6144:HC2pxmYv7TokhkyrjnOEoAA98180b2esza7HyAhmznrBH8CinS7uxav8pu/q8Gpm:i2pxmYfLrjOEoHpmWa5hmznrELui7
TLSH
T1A7845C26F7808437D2232A398C1BA6589875BE712F2968473FE42F4C8F797C17916397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yoplo.WaveInfo.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\plugins\Yoplo.WaveInfo.dll
Size 32KB
SHA256 b4b5254460d9b1170cd0a0262d0e59f21f22edf6cac44a2028cfa6a643d20eca
MD5 dd59f7c386b87ee413779f33a107366e
SHA1 7c4ee40d8633faf028de311c066b82eae54b8c35
SHA512 2338d4cee1da10428c4583705c917a0760b84c5765ad0b6361ad2e37a5173af59e853856c8ead66f6bda0488bfa0671076eaa72b2d4592e9a897672f9bc5f5ca
SSDEEP 384:3cWNtrTsOBw4FEfjtsXrVzNNT3g3UWJK8oNX:5rTsOBlEfjWXhAUW2X
TLSH
T14CE2F7826AF8E6BFD66E0375B877492006F4FA616F03CB5F4D8C51CE5E423484641E9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taglib-sharp.dll

Path C:\Program Files (x86)\Yoplo\TigoTago\taglib-sharp.dll
Size 425KB
SHA256 ec6a0050556e1c2dae51ccac9180d559653dda53f7f9b81cd4dcb173e7525dac
MD5 cf9e61501651d4fd24e8e9aab646f0a1
SHA1 e77d95d97c5f3eaae9273486c5a7c1397b482c62
SHA512 cab95ac83d0018a7c7b4fcec53098d9fa9fcc6d60b8cfc1fbc0b6f46f3b6316661051ed903c37e30b20bc5bc279cc7c685ceb619f77884e063fff3ad35eae659
SSDEEP 6144:px8yBEOr/2mmnYm7DNU2gdmF20mqGS10HFHS9yX0VNqnuI2ZNr1RGW:pxcU6DNU24qsFyQXK4L
TLSH
T11F9429549BE4962BF1BEB7B4F4B40028DBF4F545E15AE75F688824BA2C53B01AD0133B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsy5887.tmp\Header.bmp
Size 119KB
SHA256 240357ce93c5e43ea587dbad982e127c85d1c693fe48552a0c4958fd44d3a36d
MD5 1dd93160222a02c48c6bf7e30b6e7223
SHA1 79f995035a985320f936f8b831baca2b2be085dd
SHA512 bd82cddc79f32173510892e1d1cc224aa97e1e2efc717f0a03e68f6f7c12797f5902251b04c86b5bc99c2556c9b1f84fe2e08e2c74d624cebdd8ba5b10116252
SSDEEP 3:vE/zni/c/l3XsleleBh33333333333333333333333333333333333333333333H:vkm/0slele3
TLSH
T108C3020F317C17C5E3CB0073400C8E7C33407949F50E03602BC69C1F69145863309340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy5887.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkinnedControls.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy5887.tmp\SkinnedControls.dll
Size 68KB
SHA256 512d67d40f6c73a8c7ce63060962b7632c47b528f340f152fbbda6ab12883579
MD5 c3e5d1a39e1f4dc8317a9e71ce93d141
SHA1 7f1e4bcfb2a6b58b5e337d58713eb27dfb2afef4
SHA512 32b5c5439a1d58f4fcc9348d0a91ed6c4ecf5bec3abc646a345a2256060a962978a7fc9a5ce155ad1498a1d6f77dac29d433e9398252bd66b1d89875447e4603
SSDEEP 1536:pFkV9DWMRT1Cjz0rc2T7pWhpPZMcgnutbGFL3e4tTBMcMY8:peTDhRMz0rcJPCcRYu4tTB/V
TLSH
T1C9633A13A2C240F2DCCE197D11BA6716DBAE9802C7D1D6C78EDB4F56EB221D2A53434E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy5887.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsy5887.tmp\ioSpecial.ini
Size 491B
SHA256 0fa165d4b0e43d905f515fdb29b5f020b33a54ab5e4c3696a474a9bbfa03a87f
MD5 cd1d2b9fcfb51525c524bef2999c3437
SHA1 3b53b09cb319fc73bb681fa7f70ef1d65733f358
SHA512 51c5729ced796c94368cd430c846ac981f041f9bd2494c99e0b4b60638ca6ff85d16d4168529bfdac1b6c401385404d0edccb3fd957a17fcc629068fc5222084
TLSH
T10BF05C5C900E526E887000AA54EE769137E01E38930139B0F6B20883D79EEC58CFCACB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsy5887.tmp\ioSpecial.ini
Size 534B
SHA256 519ac5825acc8ab3f774098708bb3bab3036a27aa1cc431d66bdb66a7c45563a
MD5 1735eb4db1ad85c172c38d580fdc8e79
SHA1 34d3566148bbdafac7ba61a3f688b8ab9c7c238d
SHA512 89f7fd204734b6ad4aa2730aeded4a61da6ed22e0aceb693beb36c07e7877611fa04c94ab3f26c09219c0f918ba3f3b647ff378bcd6cf23185b4293688ff80b2
TLSH
T122F0509CC81FE379487010A964D93392A7D12E7C071239F5B1A6488693895C34EFDEDB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsy5887.tmp\ioSpecial.ini
Size 560B
SHA256 1df2e04031e348d3a4a9b9e8b85d5e83702e12cbd7e39af51cb84c5eda0159db
MD5 7c30736bea0a04caa408ffa943902a65
SHA1 a844f0148fcba97b26a075e67275f2c23b79c41c
SHA512 e10309ce660847a5d0209877b981f2cfe39ac4cc7d31519dca87c50aa147269a542f350d72acbec667519cbc1ba3f4baa775f21c8a602a47d0cba61208e8ff5c
TLSH
T1F6F0815C840FE3B8487010E910D8339177D11E6C471139F5F1A644865399AC38AEDDDB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2520-304-0x00000000734B2000-0x00000000734B4000-memory.dmp

Download

memory/2520-252-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Download

memory/2520-253-0x00000000734B2000-0x00000000734B4000-memory.dmp

Download

memory/2520-306-0x00000000734B0000-0x0000000073AD1000-memory.dmp

Download

memory/2520-289-0x00000000734B0000-0x0000000073AD1000-memory.dmp

Download

memory/2520-290-0x00000000734B0000-0x0000000073AD1000-memory.dmp

Download

memory/2520-305-0x00000000734B0000-0x0000000073AD1000-memory.dmp

Download

memory/2520-303-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Download

memory/5772-110-0x0000000005AC0000-0x0000000005B28000-memory.dmp

Download

memory/5772-17-0x0000000010002000-0x0000000010003000-memory.dmp

Download

memory/5772-18-0x0000000010000000-0x0000000010014000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads