1984c622b79a5f20da60270f0ea89a3d028b84d1627d4ea5dcb8f97868ca898e

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hypno Hotline.exe
Size 193.4MB
Sample260808-emsplszdpc
SHA256 1984c622b79a5f20da60270f0ea89a3d028b84d1627d4ea5dcb8f97868ca898e
MD5 b455d22bf9e0f0918155d1f2ace9e585
SHA1 fd927c75eb07a0e4bdbd822b748f21c31f2ba76e
SHA512 e9e8186e06fe4d5bc78df7b4f3465ead8899ba075a2b3a1f5e539772bdf63febdcddb1cfaece881d4bae0b110930584e64b0a457ea817fecbc3f34f7af4a7859
SSDEEP 1572864:gHM/7SRmD4j25lgATnMN1+i6uv6rsRi6a7hBqL3ANqgXWcBOCqVF5xzN0iq3RuwD:B/BiQAs8OvGK
TLSH
T143A88C13F39A10E9E05DD17587469633EEB1B8864328A2DF2B5407522F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4144	powershell.exe
1056	powershell.exe
1344	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Hypno Hotline.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Hypno Hotline.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Hypno Hotline.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Hypno Hotline.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hypno Hotline.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hypno Hotline.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hypno Hotline.lnk	powershell.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HypnoHotline = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Hypno Hotline.exe\" --hidden"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Hypno Hotline = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Hypno Hotline.exe --hidden"	Hypno Hotline.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HypnoHotline = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Hypno Hotline.exe\" --hidden"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Hypno Hotline = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Hypno Hotline.exe --hidden"	Hypno Hotline.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HypnoHotline = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Hypno Hotline.exe\" --hidden"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Hypno Hotline = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Hypno Hotline.exe --hidden"	Hypno Hotline.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
3524	reg.exe
2908	reg.exe
2100	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4144	powershell.exe
4144	powershell.exe
1056	powershell.exe
1056	powershell.exe
1056	powershell.exe
1344	powershell.exe
1344	powershell.exe
1344	powershell.exe
3976	Hypno Hotline.exe
3976	Hypno Hotline.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeShutdownPrivilege	4548	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	4548	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	4548	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	4548	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeShutdownPrivilege	4548	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	4548	Hypno Hotline.exe
Token: SeShutdownPrivilege	4208	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	4208	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	4548	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	4548	Hypno Hotline.exe
Token: SeShutdownPrivilege	4208	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	4208	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	2248	Hypno Hotline.exe
Token: SeShutdownPrivilege	2248	Hypno Hotline.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
2248	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
2248	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4548	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe
4208	Hypno Hotline.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1600	2248	Hypno Hotline.exe	83
PID 2248 wrote to memory of 1600	2248	Hypno Hotline.exe	83
PID 2248 wrote to memory of 3524	2248	Hypno Hotline.exe	84
PID 2248 wrote to memory of 4144	2248	Hypno Hotline.exe	85
PID 2248 wrote to memory of 1064	2248	Hypno Hotline.exe	86
PID 2248 wrote to memory of 568	2248	Hypno Hotline.exe	91
PID 4548 wrote to memory of 2908	4548	Hypno Hotline.exe	93
PID 4548 wrote to memory of 1056	4548	Hypno Hotline.exe	94
PID 4548 wrote to memory of 1628	4548	Hypno Hotline.exe	95
PID 4548 wrote to memory of 1628	4548	Hypno Hotline.exe	95
PID 4548 wrote to memory of 1984	4548	Hypno Hotline.exe	98
PID 4548 wrote to memory of 4264	4548	Hypno Hotline.exe	99
PID 4208 wrote to memory of 2100	4208	Hypno Hotline.exe	102
PID 4208 wrote to memory of 1344	4208	Hypno Hotline.exe	103
PID 4208 wrote to memory of 2008	4208	Hypno Hotline.exe	104
PID 4208 wrote to memory of 2008	4208	Hypno Hotline.exe	104
PID 4208 wrote to memory of 3524	4208	Hypno Hotline.exe	107
PID 4208 wrote to memory of 828	4208	Hypno Hotline.exe	108
PID 2248 wrote to memory of 3976	2248	Hypno Hotline.exe	118

C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
"C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1732,i,9299292988429438800,15038834777111524007,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  PID:1600
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HypnoHotline /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe\" --hidden" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Hypno Hotline.lnk\"); $s.TargetPath = \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Hypno Hotline.exe\"; $s.Arguments = '--hidden'; $s.WorkingDirectory = \"C:\\Users\\Admin\\AppData\\Local\\Temp\"; $s.WindowStyle = 7; $s.Description = 'Hypno Hotline background listener'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --field-trial-handle=1732,i,9299292988429438800,15038834777111524007,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --app-user-model-id="electron.app.Hypno Hotline" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1732,i,9299292988429438800,15038834777111524007,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:568
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1732,i,9299292988429438800,15038834777111524007,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976

C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
"C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --hidden
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HypnoHotline /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe\" --hidden" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Hypno Hotline.lnk\"); $s.TargetPath = \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Hypno Hotline.exe\"; $s.Arguments = '--hidden'; $s.WorkingDirectory = \"C:\\Users\\Admin\\AppData\\Local\\Temp\"; $s.WindowStyle = 7; $s.Description = 'Hypno Hotline background listener'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1780,i,6540858178253572043,9852101102448977630,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --field-trial-handle=1780,i,6540858178253572043,9852101102448977630,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --app-user-model-id="electron.app.Hypno Hotline" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1780,i,6540858178253572043,9852101102448977630,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4264

C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
"C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HypnoHotline /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe\" --hidden" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Hypno Hotline.lnk\"); $s.TargetPath = \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Hypno Hotline.exe\"; $s.Arguments = '--hidden'; $s.WorkingDirectory = \"C:\\Users\\Admin\\AppData\\Local\\Temp\"; $s.WindowStyle = 7; $s.Description = 'Hypno Hotline background listener'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1884,i,6243118672975401870,11733536121509068500,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:2008
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --field-trial-handle=1884,i,6243118672975401870,11733536121509068500,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:3524
- C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --app-user-model-id="electron.app.Hypno Hotline" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1884,i,6243118672975401870,11733536121509068500,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bdeb4512d369d06600d10e948623f9946c58d2d68488a1f087ad5ef0624ba385
MD5 9d93f330edd56e82de5c485b1819dd6f
SHA1 c4843d110470cf34d3079993d2332d4b6f3ce871
SHA512 0c1682c09ded07d6aca14799cbf2845fbb54acfca21f69512eea811dc43c2b02f539a9d12f767c71933c74a38cc44402f48b2b3e27c42059bcc25f3a34d130fb
TLSH
T1DF117637B39C8A21CC96153A409DAC1172B683C781AEDF9F7FC4D215A1BF588CB712A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 da9997a3db22d4c3b7900392af3d4a88d09de0df6c4a75d89ea1b271edbb2552
MD5 e936ffde1732f536cc835ed3e6c83842
SHA1 05a7c09e599c32003ea21329932a032ace4f592c
SHA512 35d49450a82c671843080c2ff2ff0d33aa5640234958b7e417a9c2f9e20e24b752a4793a99662253e7ad892dcd70904f6524d5e71c0d80333d7d01741c115870
TLSH
T10A117637B39C8A21CC96153A409DAD1172B683C781AEDF9F6BC0D215A0BF585CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_upxfk25f.mpt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_upxfk25f.mpt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Hypno Hotline.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hypno Hotline.lnk
Size 1KB
SHA256 72d90e28c59adc46aee64b2831e131f9d45ae5009cacf64627d35768229aa84a
MD5 7acdbd577acacb8d62e546c3437b436c
SHA1 780753e0a44e10109e6e4fe57abaec9bca209bff
SHA512 e7325e4d5dee6b7d6a69ad5d113018205cc0fff8608a9457eb2d6bcf4b4a0888c2d740826e6bf5a21f7efc85c0c92d7257faccd2f4c3f763b5d3e8f0ff4b1988
TLSH
T142112825ADE67B20C7F3D77098F66210DAF97C2BFBA03F0D1040808828606017EA5F2B
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Cache\Cache_Data\data_0
Size 44KB
SHA256 8378db2ae93ef7f3b848668b8cb7f996779583a94e38bbaf1ac0efa64f0cc9f7
MD5 dd825a931b965f9012245927286fda68
SHA1 5ac88df0ca2f0cada2f6aed1907f27e7abcc8011
SHA512 5e1658e56082ac020c02cf74101a925053095013694b347eece61837f318766e2d895e3dc923c4934035be2cd6dddb3d6f467ab0d7d7db65b40c6090c741435e
SSDEEP 3:MsFl9tlGallpo/gR7ikflklRBKl5QlH/1VCRwUK88uXl18:/F3XGu0/g7ikNklRJqRP9X
TLSH
T1B3139B1E6DCF8F03C5C1153C504F5675F3714D408701076B81112C9BF41C74F145E549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Cache\Cache_Data\data_1
Size 264KB
SHA256 bddf5ee808df324bfd61c52f68255e0e1e870e37966de1f47ff92871a7223e12
MD5 c0e28a0d5c08a3467cdc98c393aae746
SHA1 2e0e22dc39042b2abc9a0f6fd5eabf694a28b5ab
SHA512 da517b1404d4b5b8a9e2b66c85f6b8ecb571ce510d41ea2fce5d5b1fe1faa98e5feba371483fe73180071c9ff35797ec60c5ad4b5f31a83b958fc63d554f8703
SSDEEP 6:/M/v22D7IfLGLKdQOnSkZTCnWlHA3tVmeleKD0GLKdQOnSkC2Py/OOKeb+OGLKda:U/I12sSkvHb6eKa2sSkC26VH2sSkLe
TLSH
T1D74492E20743F026DE844EB6301B6774846954B63A6BC2D28016A4F6AC056673BC2554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 0592095f422cace0ad9b190ca2a27c5918fb486cd701dcb3d35f6b56bb1229e7
MD5 7e9eae6c26170627b597b309a43db282
SHA1 72664dab67fd6669d6abd601ad2ccd17de4671f4
SHA512 bb10fff8bb453c0fac168e0607ee4f0face1787921f8ad0657f02db8382e550eb88f7d2756bd9f030de9725a5bb7def9be0bfa1e3a6b374d48a7375b29302779
SSDEEP 768:Kf/4kf/42f/4vBUCYfKnaD+Y36r872ALdsRfATCN:G5TqOhiAl3zhQfATA
TLSH
T13316AEE34E98B502FAC5DEB0FACDED2C7C30A5E6FC96D482A11241B985F07D4265A07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Cache\Cache_Data\f_000001
Size 22KB
SHA256 6cf63efbe247ebe9ef28cafd30bf638e919a0712cc755f34f29af1c0e2daec04
MD5 35975379673d2aa05fdc1c62d466563b
SHA1 b764c4f1817533ca55e7f8e9c738ae37bd68473f
SHA512 7e10612351b926f9ddc734c5a7c7a6562af128dec867a77974e76b1f8194b30a29ebcf67f38e9a3bc27a6ec13a973887053bcefc63831e9503994e13a070db19
SSDEEP 384:7YM127AZgUiBpXkHsRKvju3upFJ5f05hCRYwytMFFRFDxmD5czcpvv/2vX/0L:sM12EAh9OjmubTc5Mewy611mDyYpH/2y
TLSH
T1B1A2F25781BEFF9668CAFC757C993BA20F80EE0A010C5BA014976AD55246881D46E3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Cache\Cache_Data\f_000002
Size 49KB
SHA256 c2d23435da37e62a59388771b6b30cbf32ee3f65a55cb477754c4a9aef916015
MD5 d38dc08e39bdd3600fbb741c0a5925ae
SHA1 632105dab44baf55ebf2d2d34fbc475facde01d2
SHA512 abe33b319c8133bfed71037f8ed65dcc536fd2e97565b6257a33284f987e063431b76f64879d1302b60836bc233e3591a434c39f5b25cf15d231480df5c35aee
SSDEEP 768:bV2S3B1LrkFgoIoXx5nVOsbTFWFFWFD2Mbb9IxASLsEsft7sq1R+Nv2:bV2S3B1u/TVOsv5XRXSYLft7se+Nv2
TLSH
T1D533029FDB43BFF5CC9681AD2155DC72583E7EB141EC5A82B85008A3387672BB8E461C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Cache\Cache_Data\index
Size 256KB
SHA256 9c934c268e9a2dc7ba042e52229022e2edb5b11cb87bda99ec14415b2baca9a3
MD5 9a53e67d2ba472ca61bcfc53b77a3dd7
SHA1 858306240ea56ed3b7f0aac900ae52df1658b721
SHA512 b7008e4ee220ad5719c93fe4eeb999045243d9a6902790168e9169458763d15cbe831e76bcaa37378a84967ba9f7cd8ececbb2cf6f7cb49be1bfd5c86cb7193c
SSDEEP 3:LsFlklNllklkXlSKldle11nflXlQlmNtl:Lsk3lP5IN
TLSH
T14244012A0B810C06D980027C889793706338C404CA0BC383132452211C92BD10E4A440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 ac5d78ecb8c787390e1fcb6fe8d88aa2cac6bd0d0e4a991e88ecf9cdc55fb3ea
MD5 7538bb08c55cf45f326357a3de574a00
SHA1 6ebf98a1ad42349005d9f807956ec7b3cf95cebc
SHA512 18af18177a7075327d2cbbba1d0e3ba7e0defd6920bde64a8addbed5b48190b16eb2f2342fc3496487d65af8611969a5c1ff5c6b7494c9bc31fba3a9fbe6e435
MD5 SHA1 SHA512

Submit Download

DIPS

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\DIPS
Size 4KB
SHA256 42f67cde08aaa4db17432058fdd3521a7199a1dfd4afe740ca486d6b49226302
MD5 36aaf53c026ed41733308f1afe2b2813
SHA1 eb10136d2a8208c35473231b2e13519d26dddc42
SHA512 4b822ba843d922d24d5cc24bb80da0e9fc72c4335e1052e7392bdf8ca0a8332e2bf8b78f125c7830b650434862aaee43046bc2168d9fbaae0508b4b0102a686d
TLSH
T144810440774000F1D0D407F754D1130C0F07D5D4D5510F0315010041CDC15CD4C70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\DIPS-wal
Size 44KB
SHA256 6e5d1622553ea24902de58d4403f1e471ee95655740669246987167e2fcd0f1d
MD5 6925a2e0c83b1bbc5c3d39776a487bf3
SHA1 4af2e1441b237ec982ebc86ca86223fe12001ccf
SHA512 f09dcd819ce409dba0861c2eb9fd94afbaaa70992fc640893b4896707c628ca7e6a2dc3ace62e9ec647a3bf07214a827fbe0f02bb52c38e281123b0e0e9f46d2
SSDEEP 48:uOqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwUKxDZkmw:DCEmrm43b/LuaLNW9WjWbflNxDQ
TLSH
T1771366574E692E71ECCAC2B648C26AD20B39077C93771D6B55A840F1DD9264482BF0ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Local State
Size 434B
SHA256 a43fc9dda6e7444a753705d82aabab20d3f76e56af985ef79e928226410f1f30
MD5 b787032c5ec1ec9230a8278b8a639311
SHA1 ff3b31e0dd0bb61a37642bed823b723984116467
SHA512 dfb72a12deb36caaa2a784407ba784a3e622ac568cc3329fa896a07d8a8aadd9b7a30f7da96097c5bcd31e6991f64912b94138126ab022544fed46b28ab483eb
TLSH
T1ABE0F1F319929EE33B5D1ED58A4EE6825E310537018A0D28FE9C028433FB4D1C956E79
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Local State
Size 434B
SHA256 c3e7337a954c8fbbf6f9a37c09aad43757e1054e2537b15f5ce281d5c757475a
MD5 18fda1186e05428636ff0a201b2930f5
SHA1 c69a813cd4d91d797954824bacf32d28a1e56fae
SHA512 062a25e669445865a72dfc2247bc5d4168cb46b1d2c559e5bca5df5d647763e929cff2caf89142454253b4425b73b732c24ff1048be73c1ddc02cbbe02f44427
TLSH
T14CE02B717220AEC1BA28AA62880C9A021C701237B0891B26FE044B80623BCBB0A00C38
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Network\Cookies
Size 20KB
SHA256 d4ec5e87650fd9cc3034760d59f748a675452d898033c5659fbb101d7fb65359
MD5 d3fa262aeaa13a74d78271d9705a8335
SHA1 057bdb9312384ff6d1f24869d562aab6988da9ff
SHA512 472aa02259ffb9871acff35939b49c87a97822275a2179fc60cbbca27e1d55eb9b6464edc374c4e93e230b40591b7fb38e76135146252f1865e831a24df02857
SSDEEP 24:TLIpJ91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:Tg9aw/aHLopFMavU1iB
TLSH
T1AF92AD8F1F343620C0F44B32F9C249972E7C212C93637A89EE6410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Network\Network Persistent State
Size 305B
SHA256 de481310ba9735277de3e8638b3b40a7b0994c2cea80f5e9cdffdb22f917de5f
MD5 0ec45a5db236db6aeece327bac668246
SHA1 81d0017dc191acdf24cb2d96245d070eca7308a5
SHA512 c36089c89bc5f830155b95c236f1a1bb0c20e623ecd9d21818dc25a1c03492119e34ba98e27e14aa3c464696bcf3dec27c9dc8b1e78379adfdce5f08d14c855e
TLSH
T164E07D53C2D498BD078143F51A246913C2BE041542281C96C5D8AB9E43A1479450084E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Network\Trust Tokens
Size 36KB
SHA256 3bfce2028e6e9ffb8e5d62d1a4966f01b0c71a989eeb5c9839d289adb61d4a2f
MD5 0843caddcbdf9a2730c6d860cb321fc1
SHA1 7fd8d89fd7a68db8127a56d46e728ea818e7ed24
SHA512 9a73f4550cd720e93fbbaf3084044666c41601aa1323c1b5093f12d5dd041a2bfbfe3f1ba07da71fa799d766595ac8bed7755ecd892560bc44a459a5f56bddd0
SSDEEP 24:TLHpQ3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Ta31DtX5nDOvyKDhU1cSB
TLSH
T187F2989BE93C2FA3CCC56FB08B07E5B51F752BDEE68276C4247130A00EA860015E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Preferences
Size 86B
SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
MD5 d11dedf80b85d8d9be3fec6bb292f64b
SHA1 aab8783454819cd66ddf7871e887abdba138aef3
SHA512 6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0
TLSH
T113A0124350152476150F2A2400474E5618E801301D1BF945C1E035A1756685C084700E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 12aea932d447f6332d2dc4bb20a790de20d0d977ec5bea6f95437b1212e6ef5e
MD5 30f08af0a9f01ca71585e91bfe63e89d
SHA1 8c3fefa29e4dddbace74f8538b6e6cede9ff40bc
SHA512 1a7f1e8c24930df45590de9fefd147dfee253affbdbc77ef965473e1df343c304af4ffc4b97fdda2722cbbb5cded739de679903729c61803dd828b594f53efee
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Shared Dictionary\db
Size 44KB
SHA256 2e8e32fe633e2edf36070c754e1f6ccec8c798d60bbc87cd23258a20dc50003c
MD5 9b33f0ab00cb79465cc6d6c3091c3a3d
SHA1 1a00649e5758a3dbd3967a6129c95f07a5b6134c
SHA512 ee61d13cfee34ef66f4c89138e0ae392bb534356799c5664e85fc1af32f3a4af341d51cae52b1d378f34fef33613ee7ef717f3e99f0904b7dd5fac979efa8dad
SSDEEP 24:TL6OgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TYOIy4m1b3fbUdSo2qSB
TLSH
T1D013AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D126F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop-prefs.json

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\desktop-prefs.json
Size 25B
SHA256 d4513a26371df43ba2a404c82dc00a26fc0f6d50d8e77477c9bd432e329219fe
MD5 fdf3f4e217253068a73dd38617b13b38
SHA1 a140e41a5fa24a3d2a77391bc9e9de5349c1bf5d
SHA512 a33c5fec7e5b2b134194e03fdf5a5b07546a51c7c6b65e646f524fc6dd32346d62160b842da963da0c14c6b5e3af51c56ed787e6ef85cc0839870ebcf7f9cf37
MD5 SHA1 SHA512

Submit Download

memory/3976-217-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/3976-208-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/3976-207-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/3976-206-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/3976-218-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/3976-216-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/3976-215-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/3976-214-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/3976-213-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/3976-212-0x000001E26BAC0000-0x000001E26BAC1000-memory.dmp

Download

memory/4144-21-0x00000289B7680000-0x00000289B76A2000-memory.dmp

Download