Overview
overview
7Static
static
3TH-9800 Eng 2.0.7.exe
windows10-2004-x64
7TH-9800 Eng 2.0.7.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$SYSDIR/Msflxgrd.dll
windows10-2004-x64
3$SYSDIR/Msflxgrd.dll
windows11-ltsc_2024-x64
3PL2303.exe
windows10-2004-x64
7PL2303.exe
windows11-ltsc_2024-x64
7Program.exe
windows10-2004-x64
3Program.exe
windows11-ltsc_2024-x64
3uninst.exe
windows10-2004-x64
7uninst.exe
windows11-ltsc_2024-x64
7Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 12:25
Behavioral task
behavioral1
Sample
TH-9800 Eng 2.0.7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
TH-9800 Eng 2.0.7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$SYSDIR/Msflxgrd.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$SYSDIR/Msflxgrd.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
PL2303.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral8
Sample
PL2303.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
Program.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Program.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
uninst.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target TH-9800 Eng 2.0.7.exe
- Size 2.4MB
- Sample260808-plvgxsde28
- SHA256 4b8223d2da1ab38567d19add629d8f5212fe36f6663996e60832ac427e511cdd
- MD5 f110f4cf704aba96b4cc59fde2365d00
- SHA1 ef6e42fedc062a939d92187b5f78d323f5ee6156
- SHA512 ff24457569b415c399cdaaf7b371e1bdb578e0a5bc3722bc3a188c72f4a9609ffa251edf2ce124b1f20a1a097ac882600e66f65f033a0ab5e4c299b7066cbd1a
- SSDEEP 49152:oi/LXpqEpmPyzVTAi5P4oN+AEIrFoTyyWrM6qKKchqWysRitDlQ7R:XbpZpm0q0zkHUBl7Rj9
- TLSH T104C533207FC4EC4BF3742B75A9975835ACB266807B25927307185F3BF4B22A3492B725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5436 Program.exe - Loads dropped DLL 3 IoCs
pid Process 4204 TH-9800 Eng 2.0.7.exe 4204 TH-9800 Eng 2.0.7.exe 5436 Program.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Msflxgrd.ocx TH-9800 Eng 2.0.7.exe - Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\TH-9800 Eng\PL2303.exe TH-9800 Eng 2.0.7.exe File created C:\Program Files (x86)\TH-9800 Eng\Program.ini TH-9800 Eng 2.0.7.exe File created C:\Program Files (x86)\TH-9800 Eng\Program.exe TH-9800 Eng 2.0.7.exe File created C:\Program Files (x86)\TH-9800 Eng\Logo.ico TH-9800 Eng 2.0.7.exe File created C:\Program Files (x86)\TH-9800 Eng\Default.dat TH-9800 Eng 2.0.7.exe File created C:\Program Files (x86)\TH-9800 Eng\uninst.exe TH-9800 Eng 2.0.7.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TH-9800 Eng 2.0.7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Program.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\ = "IMSFlexGrid" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\VersionIndependentProgID\ = "MSFlexGridLib.MSFlexGrid" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\MiscStatus TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E9E78A0-531B-11CF-91F6-C2863C385E30}\1.0\ = "Microsoft FlexGrid Control 6.0 (SP6)" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E9E78A0-531B-11CF-91F6-C2863C385E30}\1.0\FLAGS TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905} TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{609602E0-531B-11CF-91F6-C2863C385E30} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\ = "DMSFlexGridEvents" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\TypeLib\ = "{5E9E78A0-531B-11CF-91F6-C2863C385E30}" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32 TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\ = "IMSFlexGrid" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6319EEA0-531B-11CF-91F6-C2863C385E30}\InprocServer32\ = "C:\\Windows\\SysWow64\\Msflxgrd.ocx" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{275DBBA0-805A-11CF-91F7-C2863C385E30}\InprocServer32\ = "C:\\Windows\\SysWow64\\Msflxgrd.ocx" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\TypeLib\ = "{5E9E78A0-531B-11CF-91F6-C2863C385E30}" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\MiscStatus\1 TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\TypeLib TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSFlexGridLib.MSFlexGrid\ = "Microsoft FlexGrid Control, version 6.0 (SP6)" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\TypeLib TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{5E9E78A0-531B-11CF-91F6-C2863C385E30}" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSFlexGridLib.MSFlexGrid.1\CLSID\ = "{6262D3A0-531B-11CF-91F6-C2863C385E30}" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\ProgID TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\TypeLib TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\InprocServer32\ThreadingModel = "Apartment" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} TH-9800 Eng 2.0.7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6319EEA0-531B-11CF-91F6-C2863C385E30} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\ProxyStubClsid32 TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Control TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\ProgID\ = "MSFlexGridLib.MSFlexGrid.1" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\MiscStatus\ = "0" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.0" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Programmable TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.0" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\TypeLib TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSFlexGridLib.MSFlexGrid\CLSID\ = "{6262D3A0-531B-11CF-91F6-C2863C385E30}" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSFlexGridLib.MSFlexGrid\CurVer TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ProxyStubClsid32 TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\TypeLib\ = "{5E9E78A0-531B-11CF-91F6-C2863C385E30}" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ = "IRowCursor" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\ = "Microsoft FlexGrid Control, version 6.0 (SP6)" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6319EEA0-531B-11CF-91F6-C2863C385E30}\ = "MSFlexGrid General Property Page Object" TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E9E78A0-531B-11CF-91F6-C2863C385E30}\1.0\HELPDIR\ TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\ProxyStubClsid32 TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.0" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ProxyStubClsid32 TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Version\ = "1.0" TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSFlexGridLib.MSFlexGrid.1\CLSID TH-9800 Eng 2.0.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6319EEA0-531B-11CF-91F6-C2863C385E30} TH-9800 Eng 2.0.7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\TypeLib\Version = "1.0" TH-9800 Eng 2.0.7.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5436 Program.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5436 Program.exe 5436 Program.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4204 wrote to memory of 5436 4204 TH-9800 Eng 2.0.7.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\TH-9800 Eng 2.0.7.exe"C:\Users\Admin\AppData\Local\Temp\TH-9800 Eng 2.0.7.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Program Files (x86)\TH-9800 Eng\Program.exe"C:\Program Files (x86)\TH-9800 Eng\Program.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5436
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\TH-9800 Eng\Default.dat
- Size 68KB
- SHA256 89660eed0500e02e6a478d32a3e0fa890eea062d92956b83bfaeab260866ea23
- MD5 e9bf9c020c1b917de0d5cfc8b4c9951e
- SHA1 529199a82fb778430acb5bee30a24c459be5fd1f
- SHA512 8c75568442f56fc91f24ea8692ba0901c82c1322c5b8e3029ce058dd07bd1bc99f5ddcd6d0d928bbc5a7393655d8ba065f25680e8465fc973c0327b8d1a471fe
- SSDEEP 96:U1WVrdxxkk0iLMMMMMMMMMMMMMM9pjjPcwSOQGHJMMMMMMMMMMMMMMh:U1WVssPcw46
- TLSH T14C6336257A5CC76EF45150B5AC43A1CC6CBD6EC0ACD090CFE6883F4EF47A85E4AE8290
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TH-9800 Eng\Program.exe
- Size 1.0MB
- SHA256 e8bf5d5be8b33ac92c2ac10fea2f4351a0dde6300a6a6564edba26a726ef3640
- MD5 6bdd0bf2fb6e755034ff8cf92083e822
- SHA1 747dfc1f8c2654408161447ab2645138ec5409ad
- SHA512 50654cfd2d8292af47568ca9a71cc3fccf222b20d96a922de983c927e366ea6e3aa991f1ba2ec120d1a45d3ee7aaff3b5df11dfd0b666ac44a4dbe9374435424
- SSDEEP 24576:Xk6nbo9ZFd8XOlGanfQcOwcWUZu0EENW9dq:X9YZFd8XOlGanfQ0cWUZu0DNW9dq
- TLSH T11A354A24E655D81BE9A114B7DDBD08EC60182F201B2956CFA3C83FBD92761F32D36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TH-9800 Eng\Program.ini
- Size 264B
- SHA256 b406a4664769378c8ff049f889bc058a0107fedb75b5622754045cd471d58912
- MD5 8b09b18f412cfa489291e009357f223e
- SHA1 e30d511d249fa8cbe368cf83b8118944eb8f67cd
- SHA512 cd0c6a1762da67196ae7a62d8727b25eb8747522deec8b39aff03243782f97edc4c64b7c8feb52f7d86d75dbb95380343000f3f452c2787c497e336c90171561
- TLSH T1E3D0A79B22640112A8237B50C3A49935A327FC6D5C3DBB1861D9860DB2E0501340B7FF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa2B3D.tmp\InstallOptions.dll
- Size 14KB
- SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
- TLSH T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FC66D2B09D3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa2B3D.tmp\ioSpecial.ini
- Size 681B
- SHA256 67b3ac9863caef9cb3fb117e754099f252ec4e062616115545e515e3e26328b8
- MD5 d8136f7b04e35e6dff51a170caa264cd
- SHA1 2abaaf50bac82e8704e41a2cdd1fc9f1799ce1d7
- SHA512 47fd3d666ccc756e2ac46810c5141852a3f9b6f57cf3d0a03558f1758bf967781d6298c4b6c0db55734722108151f2243356a85089b541e6271247a5455c6beb
- TLSH T188019E88410A535A4814558654FE3B9257D02D308B1636F5F1628C83974EDC2D5ED6C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa2B3D.tmp\ioSpecial.ini
- Size 681B
- SHA256 fe9080039a5af1b762cc6c538c44b3a4682f242e2844d473c0a26922b699d452
- MD5 4713064e741ed91cd4428ec966350166
- SHA1 b983f398058aca56655815ee4df8ad4b0312ae59
- SHA512 4eada0e8b7ca429b75be221b04a1a4cfde09eb43aa70cb6b538f6191e641672d40c863636794558620f3af8a34c92ab5c4d0e921d2bf1a28f743c4dfe89d1573
- TLSH T11D0199C8410A435A4828598654FE3B9213D02D308B063AF5F1A28C83974FDC6D9EE6C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa2B3D.tmp\ioSpecial.ini
- Size 758B
- SHA256 3c5b7fbe4dc23d2b6c5462c5e2c5e960681098199bf074bc158f4941e9f15e30
- MD5 6901da4e3f791ffd30ec7cead9d828bc
- SHA1 0a5bb14aeaa49a1bdf95a6e272f23090978d23b8
- SHA512 860d35983731ddedcdfb1ae317dcd805b5a9300e96204fb1ebe43797e8c9978c15fd7bda7ad03526c68d983502a541c5209995f71edb2d6f21c1b238d31f2a81
- TLSH T15001BDC8841FA3A4086014D690F93792E7D02C684B1638E6E0538846574DEC38AEEAD2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa2B3D.tmp\ioSpecial.ini
- Size 719B
- SHA256 312007c69e018b61fe43b93bb83a06f2837c9cd46700aa2417ac6c69f6152958
- MD5 8e253f777b0773e94720916675ee55bf
- SHA1 781d1d0e212677557020d6579db3ac4ce58ea512
- SHA512 1c1cbc45f4846cc1a30efe6fbdfac9628437b587f45b607f5fdca1835b549839259b93b91cb1741981c5e32f8050488bd9486c458c15aeb644f773f5d049855b
- TLSH T1A8019CC8851FE32408601596A0FD3792D7902D2C4B5238F6E0538C86534D9C38AEAAD2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa2B3D.tmp\ioSpecial.ini
- Size 668B
- SHA256 772008668e180464a335237a313d9e416a31d1e0a2c6dbc45dda53a14173fc71
- MD5 f9f31dd6c91cf18a1d1ecdf60ff45e16
- SHA1 ed711d9b7cdb7bf30ee03daa68a5a2110c1d6f86
- SHA512 e84002e66bae38764f2d8cd2df60372595f3d12f449501c2551022bef15b3cc66bd9d4b40ad6d464acc5e36a71eef96d9ec3132587d321330bd0a2e3448e23d3
- TLSH T17B01DDC8410A532A4824598754FE3B9257D02D308B063AF5F1A28C83DB8FEC2D8FE7C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\Msflxgrd.ocx
- Size 254KB
- SHA256 36464966fbf46136ce0746c8cf419ca31360f81f06744e10d066441bc0ad5538
- MD5 3f7a98d7be824143c7c88fc447e944ac
- SHA1 d2b8e15b4b1c54670d3723d3d7468256a44de386
- SHA512 45141b841ef87b99be8d9afceaaad0e9b281ff5d04dd34f630e0800c3260e1cc6e7f5b872b2a04ed2a4c4e2e8122e135ba23342f07e635b515d0a8f039317a5e
- SSDEEP 6144:Kr+yiDlar6B3McDdhnN4R86DIqMQYe0SwXlktCfh1jRM:KrpuBznN4RZIH5XlkQdm
- TLSH T130443A42F3E581A6E0B736306A7623B15EBABC56AD39D54F1304364C2D32E64EE35336
- MD5 SHA1 SHA512 SSDEEP TLSH