5cd7e20c5492286f3ba19c76e4943602f8cb3e2ad47b0bc8b6807f178aba9706

Analysis

max time kernel
153s
max time network
206s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The_House_in_Fata_Morgana_1.3it_(41335)_win_gog/setup_the_house_in_fata_morgana_v1.3it_(41335).exe
Size 760KB
Sample260810-vlmd7stdlh
SHA256 5cd7e20c5492286f3ba19c76e4943602f8cb3e2ad47b0bc8b6807f178aba9706
MD5 63cc0c2c4e68026817bb9e9a9eabfd4f
SHA1 740630d6b8faf6ca1959b4dcf7b67f9d9b97aa12
SHA512 ace9e87e5f8516a2d8667a9921d4ebe0796640e2a653af3d778c6c5191ba5d9ec49321287d95415470027389959a49fd119c792eee17c617044f116d42d613df
SSDEEP 12288:XjhXLbIvt46NCI888888888888W88888888888srzkm3l5CcJ7UHN72a/8s9iKum:Txct1NCv3Kw7QH8xvZdcCqwq2A5
TLSH
T193F40102F3D31472F82AAF38C4758010BE277AF81EF796562CB8E51D1A79EC1687A751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp

Loads dropped DLL 6 IoCs

pid	Process
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_the_house_in_fata_morgana_v1.3it_(41335).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral6/memory/260-0-0x0000000000020000-0x0000000000059000-memory.dmp	innosetup
behavioral6/memory/260-148-0x0000000000020000-0x0000000000059000-memory.dmp	innosetup

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Colors	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\NotificationData	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
5864	setup_the_house_in_fata_morgana_v1.3it_(41335).tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 260 wrote to memory of 5864	260	setup_the_house_in_fata_morgana_v1.3it_(41335).exe	88

C:\Users\Admin\AppData\Local\Temp\The_House_in_Fata_Morgana_1.3it_(41335)_win_gog\setup_the_house_in_fata_morgana_v1.3it_(41335).exe
"C:\Users\Admin\AppData\Local\Temp\The_House_in_Fata_Morgana_1.3it_(41335)_win_gog\setup_the_house_in_fata_morgana_v1.3it_(41335).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260
- C:\Users\Admin\AppData\Local\Temp\is-8QDMB.tmp\setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8QDMB.tmp\setup_the_house_in_fata_morgana_v1.3it_(41335).tmp" /SL5="$5021C,192512,0,C:\Users\Admin\AppData\Local\Temp\The_House_in_Fata_Morgana_1.3it_(41335)_win_gog\setup_the_house_in_fata_morgana_v1.3it_(41335).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup_the_house_in_fata_morgana_v1.3it_(41335).tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8QDMB.tmp\setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
Size 1.3MB
SHA256 52c4279661fc9bb69b765265464b8f39fa4a0cc47e7dbd3537ad82c7bd65870f
MD5 a17e6e5ac4ac1aaa4c22d9dc2e29a055
SHA1 1210788ab195fdc1d697ff3553bf46da4910f6c8
SHA512 bf97a7ca9bd1537a124f3e1c2fd8ce9421847163ae2b8365fbfe70f00f23ea15f09951258d70113ef5c61d5775b6ab83acd1dc7eaee24c4c1fe5651bbf291af2
SSDEEP 24576:YgNfn7OOXeL7dJ/oOP9pjA0fY2Mqz9JT7ytfsxjHElkLD229Oqkipt1NCnqxjVA:5tTX6THjACMq/xCaaMksgiy
TLSH
T197554A22A3D18437D4732F795D2AD6946C3A7E202EA4E44E7EF89E4C0E35B417D39392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1207665293_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\1207665293_english.jpg
Size 180KB
SHA256 ac9437f77577e6762d9a17fe9bbc2606637e5f5d837c11bb9e8084d1d975d656
MD5 437052477b85c8fd2ff89c6e7d37dfaf
SHA1 72504ee67a94f98c8413425daf0a4e90cf3d0767
SHA512 a39f62972861af4d34785604468ca1a76f8145c34838f1d88f725d47278695632d186aa9f7334b1228084c7e9b2f84c72aff216d7d547a66b539300452bd18dd
SSDEEP 3072:e/6USHQcANJ5CvBt7YW8q/WHsA1HmbVo7w07o9qatIOdprg7F6bykaD9hPG8BirE:eSDEvqOpqO0F07oEaKCprg7F6bykWG4F
TLSH
T1DB041237C1269CB3432EC3523F3970840B862736964D30EB4F8A9D99371EDA995AC5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1769415595_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\1769415595_english.jpg
Size 177KB
SHA256 4c4b568b02c17b67e6efb9f787b735e37f3bfb3574c52ca5aa6549609e82be62
MD5 0d21c0c00f22c4e29522110c2dd2dec2
SHA1 7dd970c55f26cb83073f94f3bc5a6fca1495bbfc
SHA512 4d3bf05e1cd8ba81c84172ff4cdaf54fd89d3d3e50b890f2906b3b9f46287cedd1f2a454bae33e661be018792daf32c40c716ec7a7035ba8e5b9a1973626a6bf
SSDEEP 3072:U0KvixY0oMYOBHGceCBLtN/nEdiglINKOSHAhgSpzEQ9ohWc+HuwQFC:Unr0oMYOBHGceKRNyTlINiHZ4EQAyuwt
TLSH
T10B041373D58AAEDF5BAFF7543F415A5627620A0827747CE36C1D839123F30128E4A8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1775067436_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\1775067436_english.jpg
Size 215KB
SHA256 7f7104785b50e9af9dbb3552501e419dac7db836b61e610db307bd225dbd5e2c
MD5 a1b23dd7bd502d031d51c77489e1b609
SHA1 c7e06d690de1d18231439eddbcc0ec0b44558a00
SHA512 c0add0da9a617fec678f9a7ac357c766e59a828758cf21e9e7d36207802f30119ad74f6d550b69dd4d5d403bd42b34c8d023d75440eb996c2609de8c5515aa4c
SSDEEP 6144:boIS8oTbRz9En5H5CHETLAB6j0Kggvs4KNTWup0201990gS:boISbBGnVgEAB6LggCTN22i990gS
TLSH
T13F2412E1EC7B85EF168A83FD349F4D35116C870699133BEA5B3E0C18C29C0961FAB695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BigOK.png

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\BigOK.png
Size 3KB
SHA256 59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a
MD5 5b43a5d975a53f4fc1da67ce9f7784c1
SHA1 8543fa1e471030049942252b23cb22e0880c3af5
SHA512 5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5
TLSH
T17B614DD1323C683EC7F40B2CA1881A5EC1AB1340654B66A852CF64580798A79B77A777
MD5 SHA1 SHA512 TLSH

Submit Download

EULAAccepted.png

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\EULAAccepted.png
Size 2KB
SHA256 0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c
MD5 461dfeb75927bdb39f9db5348612a611
SHA1 b7893b1fff6801e37ee7337d876962a09184941e
SHA512 68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b
TLSH
T1BC512BEFF5921C02C255B8E918E9A6939EE5C9C58DD1542578CFC08B14794B4006A2CF
MD5 SHA1 SHA512 TLSH

Submit Download

EULAShow.png

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\EULAShow.png
Size 1KB
SHA256 6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462
MD5 c596bc9111edc702bbbb29b70984254f
SHA1 d4712c7b91ff4f8994e7907d31357c42eb47c738
SHA512 db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a
TLSH
T19C31B5C9F640B801C245ECD028E9A4328D7E9D805AE1BDA9F8CFE4C745365F8142C1CB
MD5 SHA1 SHA512 TLSH

Submit Download

background.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\background.jpg
Size 277KB
SHA256 5c3127d58b7511ba57889e2165df8d7da5331381f9ffacb9793bab071aa0383a
MD5 53a07317769966bdd601947a7259f375
SHA1 938264c85dc5ddff4c120190f38180b67af9d4e1
SHA512 783211a6d27b508c7b00a132f90cd7007dc403899ba835a9238848a60c06b3d066dd208ef33a9a4192e5c4b06c04dca78df7a3c5a2764bca831021772904d927
SSDEEP 6144:jr5yCKx/5WvZvKz81cEKCCVtgAnAi+RAcKLGSnvrXf:xyLgp1cWCVXAmnGSvD
TLSH
T19E5402278D014B55A90C43B8FE43DD6D5A010F9C34853A6E4163EEDFB5A2226CEDF16D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
TLSH
T180F26B51D9A1C031C085DEBD6D31E21A936F3A201FD64B691A6E5ACCEE4FF03952C2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btn_md5.png

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\btn_md5.png
Size 8KB
SHA256 b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47
MD5 3befe9739354ee24a0b1ea8df05ce274
SHA1 ab0bda986a8c46aa19f57b75a2b7b22445a3c625
SHA512 ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd
SSDEEP 192:+CgAPOTLq6/bkYNuQJA6hcxuGcjMTch2kmBm/5o:+IPOTLq6oAANOjTh2kmE/S
TLSH
T119029FD4E3E5CD10C688BB8B1DCA8526E80C1593E7A6C7C2F536E4029A3327826D97C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crcdll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\crcdll.dll
Size 69KB
SHA256 23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec
MD5 1d51fac9e2384eeb674199cfd5281d7d
SHA1 861dfdc121357d605d0cc3793266713788109eb2
SHA512 921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda
SSDEEP 768:tCrczqrdE7n1KuGUlKTs3RLflC7ZWL/sebzx7jMKkkg8dODMh1MK/N58n:tCrczqJ8U5s3R7lYZWbzx7jPgRE5
TLSH
T1EC637C207951D176C08A6835551AC3B11A7DB8322AF9C983BF971B7E9F203D1F63B34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error.png

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\error.png
Size 726B
SHA256 142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b
MD5 df10adc25b673e74e19971c17bee5a98
SHA1 ee16fb1cf9491f5e611282f0574b27d76fede412
SHA512 dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f
TLSH
T11401946FF800FAA8AD7A1DDA97752550C4FE877D66A200D0B4D2C44831822680F17789
MD5 SHA1 SHA512 TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ok.png

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\ok.png
Size 1KB
SHA256 0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e
MD5 103c1368e60806b1b7995a0894eacf87
SHA1 971392527f6e4b655044773132505c901a6b5469
SHA512 652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a
TLSH
T10A21B7FC167568EA76B543B9428B0D65C9BAEE2D640D730AB076CCB45C43491C6DCF60
MD5 SHA1 SHA512 TLSH

Submit Download

slideshow.ini

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\slideshow.ini
Size 384B
SHA256 339b206da4e83ad8fcc6ee5a29b2dfe032ab44a0b19dcd4f3a1a5d0bc17a17fe
MD5 d82c1f296603404878141e1c01664b23
SHA1 98c86159c83b797d5605e1c89c167388f9631b1c
SHA512 382ca4e3a6ddae8899a01ac73b0707dd8621a532e135d31f2fb642799e267c415dd6ecec67551b67998f4ab396a90eb21382a56b818d3b4b76835021db06d05d
TLSH
T116E0D896110FB0EAFFF8E3617261B5C5BDE536145DC2F0A1F342850A08D95335D0E879
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.dll

Path C:\Users\Admin\AppData\Local\Temp\is-PK520.tmp\uninstall.dll
Size 691KB
SHA256 cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0
MD5 7db706c324cc9b6fda497d081eed6e26
SHA1 ca97392e573af0cf61bfa3301801a85f2beea44c
SHA512 8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19
SSDEEP 12288:9YKdxak+D9/RPZ3GrBBIgk19USw7dffODcHCG0OMnaTVW/Rt888888888888W88c:iea1D9jgBBIz+ZDiG0BaTVW/
TLSH
T1A7E48E22B3D24437E1731A359C6B92655C267F252EE4A54A2FF8EE4C0F7D68138353A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eula.txt

Path C:\Users\Admin\Documents\eula.txt
Size 37KB
SHA256 ffe7a27bcbd466962ac68c69b99e6ee5600af531c9e22f053a50bf0a098bf4f5
MD5 035b82b0403628e0bf44dda1c66b32dd
SHA1 7de1f5ca08f576730c973a10a239e6af1445139f
SHA512 48d9bcf98643e16998dfd2471684c56bcb781dae7feca30f8b9828263e86e282ab887478b94cfc95949a18fee77607514e2d089618901ef2918215774fb86718
SSDEEP 768:B9MyjKpFqQ/K2Oj5p27mnsAtoC1NUEQjxAgUxYcekvraOWszlEn:B+q8AtoMUe5ic5vuz2lEn
TLSH
T19703E9AFE30A23710A920253770775A2F71AC06C676AD5A134F9817C33E5F6943777A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-148-0x0000000000020000-0x0000000000059000-memory.dmp

Download

memory/260-0-0x0000000000020000-0x0000000000059000-memory.dmp

Download

memory/5864-152-0x0000000003F90000-0x0000000003F9E000-memory.dmp

Download

memory/5864-172-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5864-147-0x0000000002C40000-0x0000000002C41000-memory.dmp

Download

memory/5864-60-0x0000000003F90000-0x0000000003F9E000-memory.dmp

Download

memory/5864-149-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-15-0x0000000006580000-0x0000000006637000-memory.dmp

Download

memory/5864-151-0x0000000006580000-0x0000000006637000-memory.dmp

Download

memory/5864-150-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5864-154-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-157-0x0000000003F90000-0x0000000003F9E000-memory.dmp

Download

memory/5864-155-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5864-160-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-161-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5864-167-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5864-166-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-146-0x0000000003F10000-0x0000000003F11000-memory.dmp

Download

memory/5864-171-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-178-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-179-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5864-184-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5864-183-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-189-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-194-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-195-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5864-6-0x0000000002C40000-0x0000000002C41000-memory.dmp

Download

memory/5864-200-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-205-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-206-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5864-211-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-216-0x0000000000210000-0x0000000000362000-memory.dmp

Download

memory/5864-222-0x0000000000210000-0x0000000000362000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads