Overview
overview
7Static
static
4Plugins/de...ll.exe
windows10-2004-x64
7Plugins/de...ll.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$_14_/Imag...er.tga
windows10-2004-x64
3$_14_/Imag...er.tga
windows11-ltsc_2024-x64
3avcodec-52.dll
windows10-2004-x64
3avcodec-52.dll
windows11-ltsc_2024-x64
3mufin/aspects.asc
windows10-2004-x64
3mufin/aspects.asc
windows11-ltsc_2024-x64
3script_fil...1_v2.c
windows10-2004-x64
3script_fil...1_v2.c
windows11-ltsc_2024-x64
3script_fil...al.txt
windows10-2004-x64
1script_fil...al.txt
windows11-ltsc_2024-x64
1system/internet.ico
windows10-2004-x64
3system/internet.ico
windows11-ltsc_2024-x64
3system/int...te.url
windows10-2004-x64
1system/int...te.url
windows11-ltsc_2024-x64
1Plugins/di...ll.exe
windows10-2004-x64
7Plugins/di...ll.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$TEMP/Dire...Ti.dll
windows10-2004-x64
3$TEMP/Dire...Ti.dll
windows11-ltsc_2024-x64
3$TEMP/ildo...ll.exe
windows10-2004-x64
7$TEMP/ildo...ll.exe
windows11-ltsc_2024-x64
7$0/Fonts/OFL.txt
windows10-2004-x64
1$0/Fonts/OFL.txt
windows11-ltsc_2024-x64
1Downloads/Legacy.txt
windows10-2004-x64
1Downloads/Legacy.txt
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
150s - max time network
190s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 11:07
Behavioral task
behavioral1
Sample
Plugins/deckadance_install.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Plugins/deckadance_install.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$_14_/Image-Line/Effector/meter.tga
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$_14_/Image-Line/Effector/meter.tga
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
avcodec-52.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
avcodec-52.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
mufin/aspects.asc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
mufin/aspects.asc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
script_files/casio_xwj1_v2.c
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
script_files/casio_xwj1_v2.c
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
script_files/tutorial.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
script_files/tutorial.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
system/internet.ico
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
system/internet.ico
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
system/internet/about/Create your own DJ web site.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
system/internet/about/Create your own DJ web site.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Plugins/directwavevst_install.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Plugins/directwavevst_install.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
$TEMP/DirectWave VSTi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$TEMP/DirectWave VSTi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
$TEMP/ildownloader_install.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$TEMP/ildownloader_install.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
$0/Fonts/OFL.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$0/Fonts/OFL.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Downloads/Legacy.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Downloads/Legacy.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target Plugins/deckadance_install.exe
- Size 61.7MB
- Sample260809-m79gvsdr4w
- SHA256 e78d143416d04bbf0e2617c6c3429a6e3f8e7fa08f87c00bae94e80cfd849fd5
- MD5 7e9723fd49942c8956c05570822dac20
- SHA1 986850ffa7197077dcf9544476c9259a7e62cc2e
- SHA512 a89c0f670d56c9ac3f9ef688ae6a93306ee587796a2ed60cd7c64fa9c65a0fdc53e7bbf5b7cd10f38b83a56602e94dc0ace32f9593192668a580e54fd2eda6f3
- SSDEEP 1572864:uxw1qYlgU9QzYc4XrV2siCePWZ4rUGtutOaiX6+V:t1qTU9QcT5a4s4a
- TLSH T1D9E7331CC1B9D1E5F058463D5C65C5228E0AA8AEEF3BA03FF7E664AFA47CD312D06542
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1496 shareddlls_install.exe - Loads dropped DLL 15 IoCs
pid Process 1496 shareddlls_install.exe 1496 shareddlls_install.exe 1496 shareddlls_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe 1588 deckadance_install.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\system\internet\about\Deckadance DJ Mixer.url deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\system\internet.ico deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\avutil-50.dll deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\grossbeat_files\delete_me.txt deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\system\internet\about\Diagnostic Tool.url deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\changelog.txt deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\DelZip190.dll shareddlls_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\languages deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\mufin\cfg_extraction_2002.esc deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\script_files\casio_xwj1_v2.c deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Cuprum.ttf shareddlls_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\script_files\behringer_cmd_micro.c deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\system deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\ILGlyphs.ttf shareddlls_install.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\PT_Sans-Narrow-Web-Regular.ttf shareddlls_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\adec.dll deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\avcodec-52.dll deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\audio\Toby Emerson - Can you feel the music.mp3 deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\Reverb_x64.dll shareddlls_install.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Cuprum\OFL.txt shareddlls_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\audio\Toby Emerson - Can you feel the music.mp3 deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\audio deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\mufin\aspects.asc deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\script_files\behringer_cmd_micro.c deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\wavpackdll.dll shareddlls_install.exe File created C:\Program Files (x86)\Image-Line\Shared\Artwork\Fonts\Francois One\OFL.txt shareddlls_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\avformat-52.dll deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\audio\Headstrong - Symphony of Soul.mp3 deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\smartknob_files\delete_me.txt deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\REX Shared Library.dll shareddlls_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\xerces-c_3_0.dll deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\beatmarks deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\samples\delete_me.txt deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\script_files\dd_commands.h deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\xerces-c_3_0.dll deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\deckadance2.exe deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\LAMEenc_x64.dll shareddlls_install.exe File created C:\Program Files (x86)\Image-Line\Shared\REX Shared Library_x64.dll shareddlls_install.exe File created C:\Program Files (x86)\Image-Line\Shared\SG.dll shareddlls_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\mufin\aspects.asc deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\freetype_x64.dll shareddlls_install.exe File created C:\Program Files (x86)\Image-Line\Shared\wavpackdll_x64.dll shareddlls_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\control_cd deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\mufin\cfg_extraction_2002.esc deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\script_files\tutorial.txt deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\system\internet\about\Sytrus synthesizer homepage.url deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\avutil-50.dll deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\deckadance2.exe deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\disk_recorder deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\system\internet\about\Image-Line.url deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\oggio.dll shareddlls_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\setup deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\elastique_x64.dll shareddlls_install.exe File created C:\Program Files (x86)\Image-Line\Shared\freetype.dll shareddlls_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\avformat-52.dll deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\disk_recorder\delete_me.txt deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\mufin\cfg_classification.esc deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\script_files\vestax_spin.c deckadance_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\system\internet\about deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\system\internet\about\Sytrus synthesizer homepage.url deckadance_install.exe File created C:\Program Files (x86)\Image-Line\Shared\QuickFontCache_x64.dll shareddlls_install.exe File created C:\Program Files (x86)\Image-Line\Shared\Reverb.dll shareddlls_install.exe File opened for modification C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\avcodec-52.dll deckadance_install.exe File created C:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\changelog.txt deckadance_install.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language deckadance_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shareddlls_install.exe - NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x000d000000024420-2.dat nsis_installer_1 behavioral1/files/0x000d000000024420-2.dat nsis_installer_2 - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1496 1588 deckadance_install.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Plugins\deckadance_install.exe"C:\Users\Admin\AppData\Local\Temp\Plugins\deckadance_install.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\shareddlls_install.exe"C:\Users\Admin\AppData\Local\Temp\shareddlls_install.exe" /S2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1496
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsi312A.tmp\InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi312A.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- TLSH T1E181857B92E50DF3D0A447BB00D71CE70226DC701769411E89472A8924E572BFE2EB06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi312A.tmp\ioA.ini
- Size 457B
- SHA256 a024cf0d135511cca7f388549fefc568e2e91f361fa9f07ead7fef1b1844b1d6
- MD5 2ca0c4e99b75849c49bb22fab522270e
- SHA1 b2093eaf676a718caf94b52f65cb3228de3fed44
- SHA512 6725fc21621414affa6e48f3ab4dede5b5645557d83ead707a5500a39575faeb64589c9591eda06583011506592bfa0cf323889649d3156557ec10a853df7fa6
- TLSH T1C9F05CCD980281B9D430509628AF9BD133D025281E0628E5F2B530C7E789CE30CFD281
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi312A.tmp\ioDirQuestion.ini
- Size 804B
- SHA256 047656a120577baccda7b559d0933f967dab1e2fb4bb639f3c4aa2aa4bcd7259
- MD5 b1e0466d155c15d131f0589629ef93c6
- SHA1 12bc2c3999c599fe0812b04cccfa27e772559f05
- SHA512 75e99d4f8b85769c05fb850fb637dce3fe26ca2ed3defce7c6d6b0990e77e5909142f5b510351ba4e27be81990e392325ee83d4307b4a4c69b01a36069817f2b
- TLSH T12201D68C910503FAE420A7961D6B7DD273D4683D5E222DE9F1EB1087E75DDD108AC6CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi312A.tmp\ioDirQuestion.ini
- Size 900B
- SHA256 17a6d0af7f47b0b09f9a22a23b06b9173f324e6b0c9ed539739f48ec64efe3b3
- MD5 09825edfe12437da6d62418ad8ef0a18
- SHA1 5b1ed93ea63a2475e359ef4dc9c5757197524746
- SHA512 c0de7e5e241af7e96bbcdce15c3e683430257edb61bb3708c2f7fe469ff4f3fac64e4c7df9858e267b62ae619ce3bd12365988738f2e5a71b782a83d7110ce0b
- TLSH T135113A8C940143F6F420A792296B6DD233D4683D6E263DD9F1EB1087E358DE108AC2C9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi312A.tmp\ioDirQuestion.ini
- Size 1000B
- SHA256 a4cbec99a73953e22ea75896c8f4352751f1424a144ef60cfd86ed40a5d1a8ee
- MD5 8d6951ad95a0b816006fdea9893d7a63
- SHA1 59ee29bab91391dc75adeb71a417d48209d22b26
- SHA512 49d65fa36e77e572b89bf61e9060d63db5cbd049e50babdea08236364c6536f442d39d6b4255aa74a413fceb7a9693b6d6e979b1bd563d11b0dc8eced7b1713d
- TLSH T16B117B8C944143F6E420A7C2296B7DD633C4683D9E2A39D9F1EA1087E399EE1089C2C9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi312A.tmp\ioSpecial.ini
- Size 692B
- SHA256 9e0737af65acb08d9ae2deab1e92d70acde4f0b51256983800a8e97d0fdf7229
- MD5 0ff7f9d657e5804cade58039b7e4a3d3
- SHA1 9b63471fd43112f9bcd553a24155524b87ceafce
- SHA512 53d06d96e91d1fcfd30101dc75f47718638b22a078bb8a59e005e8091aaa65ae6ca116bd8dbe92f681e2b94285a1b15678ccac47ce90e7c262bb238a56d68a71
- TLSH T1A1019E88881FA3394420649664F937964BE02D3C47113CF7F0A28C86678CDD38EEDED2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsp27F3.tmp\AccessControl.dll
- Size 10KB
- SHA256 4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
- MD5 055f4f9260e07fc83f71877cbb7f4fad
- SHA1 a245131af1a182de99bd74af9ff1fab17977a72f
- SHA512 a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
- SSDEEP 192:8SEWBGgiJM4LN+xq56XdNcNz/NWdlJmlyOcROQ:8SEPgii9KTzyt
- TLSH T171221A569F3493F9F083953B595269178BBAD24180C09C072EA7FF8D464074AEEBD317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsp27F3.tmp\ILInstallUtil.dll
- Size 343KB
- SHA256 32b674a0de4577544e138b7675110a6f09a99dd576a8b847af6a8e5976002325
- MD5 e396b4dba8c838b9eec93e8ef428e73e
- SHA1 f4c17acabd53262ce1576e1a59a4f8dc264ef077
- SHA512 cab82519fe54f37d33e5254ba6abe3cf1533580535a27faf5f8c9caf832269564067e9355a99e33d8cc218c19f20fa17e439aa49ea21058435f933fe246bac1d
- SSDEEP 6144:9S9ZlvuAVyPczPlWo+AiL9RujmwyJYi8q8V1NjQ:98ZlvvVqcz9WpuyJgfV1ZQ
- TLSH T142743B23EF80C43BD0618A3949E7A363593FBE60F9D578165EE4CD4F4E65281283E6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\shareddlls_install.exe
- Size 9.4MB
- SHA256 f08d223856f9f035dd76eead3394a9a44bb8354d3f07944b5aae52dd152206e9
- MD5 9cfc9e10e52073324bd70603060e5208
- SHA1 0b7579e67475711cd219a64f83963370454f3abd
- SHA512 1a7baa359c8ac40a4fa2f8366d26615a294fcf4d46c75cd14c8c960ead552b72711fb21d7e397438485068c2e11840bcffc4b121515b3449f94e43799790f504
- SSDEEP 196608:63vycBah/lwKUwI3uqQl7j5Ry+J/D2mPxL4jTZF:6aIah9wKBIqFVR7L2mPx8v
- TLSH T17DA6334976E23402D1000B7855F69C75CACB6778E982DBE3BAE7BEE06CBC007191DB65
- MD5 SHA1 SHA512 SSDEEP TLSH