e8badd6a782c583c61d98804649682e35ccbab63b07aedfddddc91dda0e039d2

Analysis

user interaction
yes
max time kernel
898s
max time network
817s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sonic.FBX Full Verison/SONIC.exe
Size 43.0MB
Sample260812-sshcqaaq5v
SHA256 e8badd6a782c583c61d98804649682e35ccbab63b07aedfddddc91dda0e039d2
MD5 80b35f5a6aa0fcefb2e11ff07aab8f29
SHA1 c46e1b93221411b9097c118af6670d0ed010fc7a
SHA512 3fe5cdb38f806b818140e54434c6b820e9b8742f30b8224ca104aec2cfb2ab4698bb0a24c3e98a6d2858686832f7e025ccd64e12acc730ca6368eeabcc6760ba
SSDEEP 786432:xN3eETMN+gEMpwPzkHSr2svwtUpxaEkb7z5jqwiiKQN7ni8gHTOU3c:xUpwPwHcQtoaEkbJHiiKQN7ni8gBM
TLSH
T191A7232CFA88402DD9F94C7ACEB6B762E71A5D541B2415C75C403E2FBC78AE066B07E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 50 IoCs

pid	Process
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SONIC.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{5A03A216-AEB7-4438-AD4A-CF2D7CA39AA3}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{5997B4B8-E32A-4A5B-BE6D-0A70BEDFCCC3}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{CBDEFA9A-7F5E-468B-B08D-E96C6F9990CC}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{C9FA4CED-8140-45E2-A169-D66BDDCA5AB8}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{F2559544-6B03-4D5E-BBA9-D8B89CE9CCB2}	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	OpenWith.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2824	SONIC.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2824	SONIC.exe
2824	SONIC.exe
2824	SONIC.exe
2836	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Sonic.FBX Full Verison\SONIC.exe
"C:\Users\Admin\AppData\Local\Temp\Sonic.FBX Full Verison\SONIC.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4136

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5020" "2276" "2236" "2280" "0" "0" "0" "0" "0" "0" "0" "0"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2892

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4068" "2284" "2252" "2288" "0" "0" "0" "0" "0" "0" "0" "0"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3016

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "2352" "2268" "2248" "2272" "0" "0" "0" "0" "0" "0" "0" "0"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DRPC.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\DRPC.mfx
Size 861KB
SHA256 5e7c4bcc7b722179ca5de3933d0e807d0d1630d8e5a0a51b98cce85199051ea5
MD5 0aa331b547d0650059a75dbad66248f6
SHA1 df01d62ecb2d263c80248c144d0b6212c0910767
SHA512 9f4c0917cf39676c0c7145a21f1349d8ba981023a8c33990cf4046e852824a76ebab89371065ba546376fed95eeecf0accdbbf8fa99935ff4cb4622086c219bb
SSDEEP 24576:vnKXGOuXtgFPNnL5tj112jGLF2eoRdDyLI3QALP/z2Ji0Kj3BmsdeAnQ:vpVsPJL5tj112jGLF2eoRdDyLI3QAf2t
TLSH
T15715AD113EC0C072D77B21310E29F66A55FEB5620D308A9F73EC4ABD6FB05836A26657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Easing.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\Easing.mfx
Size 181KB
SHA256 d0409d7558ef6b61574f5907179fd77e8b41553be0a588940243ffa2d1cdf9c2
MD5 c3728db47cf34a1dd117c42511ae7213
SHA1 8e006ab527da565312c9877effaa76ec17b440d2
SHA512 f61e49ba1e1fe8d1e4c13605f34663b1bd25b16c8bc6adfe5de6dd443633a54881c0d105426c3c1d6cd9649a5a6380db9ab6859c9e1036f22a3f5bf95a0bbc85
SSDEEP 3072:JwVg9FDqbIjXjmPoZ4+ABNEAg0FuQBNmAg0FuP5s7Xtby1D2r:JwVg9FDqbGXjVZ4ZiAO4EAOQUUr
TLSH
T1E7045A0165F2C972D5BE06750878AB460A7E79124BB5C9FF2BE45D4E4DB03C04EB2BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetNSetMouseSpeed.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\GetNSetMouseSpeed.mfx
Size 116KB
SHA256 bfa435ea7fa61d3bdf081c426a81645911326883fd407fe1db7a5e7facf3dc6c
MD5 40751becd59ab639fbb74111daebc01d
SHA1 cc1c6d48c3bbe2ed4494ccd7bf3aba1d10d6845b
SHA512 52ce123b05d72bd2fe76e97968443f54cfefb011d740a946d1cae403f9d7ea0465b90cada6ac71e0c40e2e04115df5873707a9a95658ddd74066df11cef96eb4
SSDEEP 1536:zD4DVF7+753Ug2v2jBdjf6SN4kjr0xUtClkHBoGw3jIdWE0/RqYvLnodM7m8mxLC:zD4Vg2+NdhDnMcWrBEyyM7m8mxLV
TLSH
T171C38D2135A0C072C19A25384969CA725BBEB832D8B5958BBBDC077D5FB07C0AF39357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSON_Object.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\JSON_Object.mfx
Size 233KB
SHA256 c6eaa6e7469900990aa0a0d7cb93583110c09fe4c74703a21e9a3805389d27b8
MD5 764d0d42df08bed432d4dc1099606007
SHA1 d9484873687693a0c33c485664a4c3f053875683
SHA512 6f434aab2422dea7a947e65bd8b1b037752f54d9c3995430daf9876aa18570bfeebacdb601869d40e6b66a67ce98fd809c5bc23231e06e1832b2a14f6b0a90d8
SSDEEP 3072:wjz3rcqxMVhDDkFgdz7BOajeK346++OqyxWrPakAg0FuPTNqRjfG:8z3rcqxQFzw2P46RjyorPakAOJA+
TLSH
T18A34AE2236D5C833C5AF22349826D7B92AFCB4308135C59BFBD44B6D4F26793EA25346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Joystick2.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\Joystick2.mfx
Size 187KB
SHA256 92e7a8d7184be827390cbbaca20384dbe32bd50dc5f38c82d45db633aa15ddf5
MD5 00111b182d79f48b05b6cd9f09f54916
SHA1 5da67a194bbd3e1f4c10d4ed9b703bf51f2dbaac
SHA512 697d09ec671ee04d54a67ee851dea9b3570cf75d306e7444314d296e9a12f13f0943ee181e55c4facaa00b12eb023ba426b7a742fb88abb927b8af396228dfe6
SSDEEP 3072:2Yc9nmxB1VVQ0UmY/unnz8OvAQKtjxvuOVT57C00TKC:Jct+BFjzHKttvuWxZ0m
TLSH
T1D1146B11B7D4C175C1BB2E7618BB92221A7A79215B39C6CF73406A6FAE307C0AD35387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KcArray.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\KcArray.mfx
Size 32KB
SHA256 6021f990d325ff8594c1a8f53f9b75d74a80a5bf7a6e260ab72e823a0439632d
MD5 df7570f0769731c6ef6e574d2e4044ee
SHA1 f6b18f2c0db323daf5d5408a14ffb548a3038532
SHA512 360691276f51717eb47901cdb6e00124257cf5a20a51c40eba3e7719a5111c843576e11aca031f81181e15feebf19db313c4173df14378cdd0811c09fae72445
SSDEEP 384:PocCYN+m5kmg2isq1G1sFhs2eVm9n3JepY8LMxG:wcCyg2ip1G1SnwpY8g
TLSH
T1F9E2C445EBE244D4DAB61E7059FEA333B636BD432ABEA22B4250D41C2C32343FA15731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KcBoxB.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\KcBoxB.mfx
Size 40KB
SHA256 44193fde76ef8bc240bfcdf8d5ae7e68ee2a46bcd11691f21204bcc9e20bf82f
MD5 c02cb4e8bc66915e2f2caa491d8f81f4
SHA1 1a950b5f3bc03bf88f24c80949a4f75c88d61406
SHA512 817bebdac337a4c9016adac616578c52a9feefc895b481585adf8c3a02a6111518c4af215d037f3307a266e645552231071089a40318012267bc1031c3aaf7ab
SSDEEP 384:BOWdaOHAQmUDRHMgq3z3RuJj61w15oW3RldpujYT1TJAihS9194qj:YqAQmUtA9sj9lQI1dJhS/94q
TLSH
T1ED030762A35B80B0D9A15C7C0CDE763BB632EA97891F96B34161DD1E3C62792FA14334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KcCursor.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\KcCursor.mfx
Size 36KB
SHA256 957395a47050cebdf4476b8e908a03e90cc8d77f3e50c518a491e4e0d3443a43
MD5 d4f7402bbe6770a3c262f91495d01847
SHA1 375953d6b23b2eaa8b075e5b2f672ba0ac263b42
SHA512 731ffb510f61daa507ff5fa6ae643cd22c3ef0da464e11ead9aa3a315f56bc77760ee27093f8cfff2fac0caee643b80a40b910034bab6a7db564dd6e23d069a8
SSDEEP 192:Bl0tMHeTeN4dUDRhMn38xmrgO5w9LLApekguc/3RabLpNAZi+90lO0gP6ZWlLbxo:70O+2ZDPaNAZi+9NjP6ZSe
TLSH
T1BFF27322E3B59059F4B2AB754CBA42319736FDA3A838DF0706A0F60D6C71B91AD15733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Layer.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\Layer.mfx
Size 122KB
SHA256 9e9d49c81e02cdef2ea10f53fee958bb750a96e7567d680f86202f0e28e267a8
MD5 8bba7602e13f66901207e4d7bdc99ff2
SHA1 7efda2baa3eee70df450110bb89d934417bec3e1
SHA512 7f31819c1ac931ff51df57b1ee0bad9a6d22c97c0e0bd6fdfc1bcec990f1c581773e90b3af609c734f9248736fa663136573298c9e0c5873307180cd2b9beb20
SSDEEP 1536:NaGgvf+Q3Mmx0FnYGRPpnNm6prmICndZac8VkRyvsWjcdV+8OfDh+eOsadq:NaGgHf3i/nmICdZueV+vfDh/OtE
TLSH
T131C34A1176E19032E4E317325D786A520ABEBD22FB75DACBA34C014D5DB03C19B39BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Parallaxer.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\Parallaxer.mfx
Size 25KB
SHA256 6388be433fbc58bd720da099ccbcc39034e15b497b9761638e06dc6ac70c7358
MD5 de81d67c5238f35d402bd4fe82294237
SHA1 b4c7e96034a93bffe1156850e94077ee1c92fb66
SHA512 76aac99a545b19e9cf4a0eb79089962c87bf895ab166f8299aff27983dfadfaa3b2895094e7b3fe2333ea4d91fda5f5ce1a60c0f79fe37c419427ea405fbd1d8
SSDEEP 768:LbgxiPwt9nX+eT3wNIAo/vueKvCJiiH7vl:LbUt9X+q3w29+eNl
TLSH
T15EB2F782ABE84449F5F737357DB727275B7AFC84A9B9C24E0BD2440D4E3160A9820B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Textfile.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\Textfile.mfx
Size 82KB
SHA256 5f0227e898ccaba747465189b768a269432b2ba5ae2b7498aef41f3bece393a8
MD5 2394d12a80698ba149f2524b11d8d98e
SHA1 feccd34ab3e96064da9b38e0039d004f0926a7c6
SHA512 19df7f009ae35c52b60e9ac74570d1e8e049c7520273fb97e424523b3f930921b7b2e18e2adf4271ee0f10a6b4500d4da0a9f5bf36c9e3a2d8c98ea4ee84087c
SSDEEP 1536:VjrT6mppVsHxhgGS52opr/DRzX4Jaavc93pRCp/:DppVO/SLn8493pRCp/
TLSH
T16C839E11B690C071C08E65794472DB756B7FA520ABF085CBBB680B7E6F603E15B3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XBOXGamepad.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\XBOXGamepad.mfx
Size 64KB
SHA256 54286bc3449bc3c7191a0f16e99d2811020c8903d2c603cadf6e1105da2c66db
MD5 b48b02cb8842aec2cca9579ff52ab113
SHA1 6f7c959b5e67a7b4de02cf0883a6022f59a4ebfa
SHA512 a6c8ea6dff3ed8c2b2389857030b6afaa4efdcd1ac0c624ea95de557f282ed7acae1485390fc5eb0eb58970cbc741abf5a909026b2bcdf615de13e36fe979bcf
SSDEEP 1536:WZn9Ntt+Tm2GG5MqSnKntd7zvYEMKYGtL7D5F:2n9Ntt+Tm2GG5MqSABvpYGtr3
TLSH
T1FE5319053A634033F04649B681EA56C15FBE7D033BBAE0EFEB5041795EB26C88571BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yaso.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\Yaso.mfx
Size 58KB
SHA256 4d0b438258cc4ef0043e5ef78142db6fcf8bb34197116d4440d3988d13562b4a
MD5 b4507e6a8030e670b5c3b1d774826584
SHA1 f252cc0f0c4f8b80073306fa3deb222fc25b7b73
SHA512 8eb6b82fc09d7dbbf5367ef1cf4e128854b3c225aa4acc5955f155680eb59d246c6d325c9f329c5d1d8e450c65741fd38c471c77fd8645da2f978cc514c7148b
SSDEEP 768:+BdtsSiQqLwBhnMWYfnuwrrrMnL3/ujzsz4qMEl9bVwGKKaP3F:nJ0MWQtj+LPz/lxVwYaP3F
TLSH
T1E6435B12FBD040F1E67E5AB114BA1B32067DF8A21EF9A14B4B24E6DC1D33661E53A743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZipObject.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\ZipObject.mfx
Size 65KB
SHA256 83c427f4905c93cacbc744e13be31490ff342294e07e46d4f1079dd6ae7eaed4
MD5 e4c878abf2e39a0aa185eba311cdcdc7
SHA1 33e3bd474ac318e384ca0773234327f922399689
SHA512 386696bd2c60fe04c7be8aacdf29fa1445a9e0de3e1a4c49446ac9709127344a9c36bd37ffcdcddd68a00cd08cfb221bc4039da19f50613bf97f6e74b4fb529b
SSDEEP 768:LNiBVEP9uMVaZ6NKedUsWqn1hzdr9XqeNkgGxPT/7LiqipHJHO8g84w:cA9u7Z03UdKzDNkgiviZJu8P4w
TLSH
T1EF536B53A3A159FDE1B24B717C7B63B58ABDBD103074EA89ABA9282E0C30454F716317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigbox.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\bigbox.mfx
Size 100KB
SHA256 b6aff593b831901ba276b8d54540a350355aad9bb1d5d35e4da4c2e56585b28f
MD5 f6e69b034b25ffc5de3ea3d4955947b4
SHA1 c26f423c56847ad4f228effd9773133b2568c270
SHA512 d26989cd3dd4f99c55eba6f77f21e4a40070f5ad2e71ba92900d29d179f8693212b58cabd385502343443bda2401012659c5d92e3d671aeb6681915e81afa18b
SSDEEP 768:1jQCRU6XvGk73U/YH8MjCRc5L4gHOSqIF9/Y7mBJN+OAH61t9ZuR4HgxjvkFbVGF:1kCR7/2V5RMkIP/YjletSZ6GdcC
TLSH
T1F6A35B1032F08131E5FA26B688769B105A7EF9608BF9C5CF2BA6C5BD59307D09B36743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cctrans.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\cctrans.dll
Size 347KB
SHA256 9b834b5d26983451ef3a11c8c2a715724daa188fbd28597081ecb1e9ed672f87
MD5 21e093d52a3afe8ed5532fcaa189c067
SHA1 8aa7bcb26e3064cd4d1172090ff00d083ee19cc4
SHA512 b4c2205c234e8ed4973fca9c64c0ec11753eb200c1d2eb3c66b9f4509426c8774f14ae1271583e0eaff268eae9c8375c5993af107e4db8d7c87b817bd1ccd9e8
SSDEEP 6144:diAs8FRxWGjVbzWKCc/IEqibsBVthDU6Uthoy28TZKmpEGB:diAsmRgGJzWKCUIhUsjBhP9GB
TLSH
T11F748E10B9808031C2B7383416BDE6B21DBCA8301F749ADF9B581A7A5F745D1AB37A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctrlx.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\ctrlx.mfx
Size 52KB
SHA256 1c955f3cfa9a79a222b43238d153c59032cfd0cd9b54bb26a2d44e546bc2462f
MD5 c132d7446cc3fdaaff25b143e2c91c0d
SHA1 2af70a0cf892f71b2f69a49a5b98654328b638e0
SHA512 9b7b90c5e172b59bdcd6783e66ac4e11b47e69298e6c0da1e163296cb8e96de3a9780b60011b8e9d487a2b58c12b1abca5d1d37aceb9503258f5947cfd88f61d
SSDEEP 384:k+CQwDk4OEIjGVQVpaNUAQYoqrGLs8U0Qw1LcQCb3OEM6YcbDKw4OA7SQPJZJh98:cQwJHl7k2YZbyN4P3/0lrKtDtt
TLSH
T1A833B55073F441A3E5BA6E32BCBF2F72E97ABC9268F5D20E0A51C85D5032695E83071D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

joystick.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\joystick.mfx
Size 40KB
SHA256 cb62d9fa8ccf7b743148816153eb697dd9c9f8ecffce92251a42d50b5dd10dc0
MD5 9d50d753abe703724001d637306c2c10
SHA1 13f883de06d8baf0fba4e5ff2179a94609b89ece
SHA512 8c04c0e99c0001dd58f9f93b3aedb1eb44b03dec0d27f9a71eb9aeab00fbe99292bb9b8148a3c0c1afa1518953c021465f01ce0f8ba5f94e60d80772475f2b26
SSDEEP 768:BniZjDqD8s8kkkkkks8MkC8QUENEpW48A6Tm0wGn:cZ6D8s8kkkkkks8MkC8Qz2pW4LXCn
TLSH
T19603417267F10482E1B70F77A47A2133B971BC573EF5901A0691D93C58A2A16DD30FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcclock.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\kcclock.mfx
Size 108KB
SHA256 58588b5e12d0c5629ee481ad7ed9e8b4d6798cfa83004aecaa600a6924bc97e6
MD5 3aa5cbe7b31e550511ce011457c44790
SHA1 93c22c4f9ddb40d72865ec5dc169cef3feb3e337
SHA512 c29a54368badaae841eb27dfb3a9ca74571828618888021c45949d1d999242e07bf240b08f602dfacded4c82e12fb6a13f501a09efe68fd5a310541099fa4a42
SSDEEP 1536:jw3Qb5+iBxoDymPqUKlZwdkkpciB2TjsWjcdeVR1d:t+jnZd/7B2TMeVR1d
TLSH
T176B36C0076908374E8BF06B54ABA9BD20EBEBE21477489DB1790449E4DB47D0BB31B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcfile.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\kcfile.mfx
Size 36KB
SHA256 1d1a83db2abfea8c92008e99e7dd12bd3c01e92baf5f2297f8874aa400f2e761
MD5 147788ae04300afedab921998dbd838e
SHA1 db937ae697f98965084bd6cf7ab024101af0f732
SHA512 381d0c0ccea2155a3510d992fd513bda7804432e9d4377c0b35337f037b5ddd8a4eae9d41439a8c12056b4c07fc2191296f88dc53ca8c5fef61008ce57185b39
SSDEEP 384:Jotnw23YeLui6fdiLDgWDBAOGOkHSlKIsfYWqPZlD0JOJlJAwHQ:JinwReLu989DBxA9I/W6FpQ
TLSH
T1B9F293466FF81461F4F66E357E7E22336938B9D59839C20F4210EC1E0973A17DAA5723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcini.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\kcini.mfx
Size 330KB
SHA256 5af175ffb932fb653873dad095dd40f2ab8d3fb56f287213c21bb68652ddad2d
MD5 a6ad14845999c5aa7adf2911671a7c5b
SHA1 98dfd5a9584d1c1b330c2c104c1779bd55ded211
SHA512 32bb59826b82d47ec420ac2532e1387a85422d2f0ce5370ad2c95b914a7615d3b122dbf4dd045105eb8ffea49324dac57659f0e5f2500b4d0eb75047cb36dfd8
SSDEEP 6144:K3gRipIs36PvsSufsm7Sna98p8r2jaeAfSfIaC4MeTkC3O:KlIs3s0SuR7SnaepwjKgH4M6k+O
TLSH
T160748E20B9C18032C67B35704979EAF11DBDA8201B345ADBA3AC097A5F744D2FE3596F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcmouse.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\kcmouse.mfx
Size 11KB
SHA256 1ab16267641f349ea1ce3d4acccbb060da3a62f9a7e93668b6dba5e63f99995f
MD5 253d57fb93560bf0c7b4a45ef34b95c6
SHA1 3597105a5812953f432cdef85d0db00501b391f3
SHA512 b8222042555bc23f0607dc565e9df1ab575e1df5ade2cb99737dd73166ae9d34184446be9bf4f2ce6a34b1e49f876ad85558a9671875cd09bbb72a8ce947833b
SSDEEP 192:HPZlTDBCj/Q1dFnpJw49mmQP998VeV9V73NLP:zDXjnXfCP940f7dLP
TLSH
T1FB327332F2F484F2D17A5E762D6A18BAF436FD115B35E20B0612F13EA972705EC29312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcpop.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\kcpop.mfx
Size 10KB
SHA256 28726ae556cbe1e2b4995ab135da1bfc72d0bc4e4f56d821e95dab738eed61a6
MD5 44557bf7ff780cfa6019c0c4119fb54a
SHA1 e02f00a1f9b9eae1855ca0168c362bd389fd6b8d
SHA512 071c11c89f59397b873d540561bc26f96651b6647f991b34ccdbb22809a16241c5e0167e892d3b660038d3fed5089c20a19eea1ca2a8607acdb6984d84cdf62e
SSDEEP 96:kFmxDB0z0dBZHgb0L4cY0v0kNQpuYJ0Fzlk7:kFjzgY0Q0Q
TLSH
T18322549177C44D78D1BA7E764D2F52F2E930611728EF5E23C989993A094F2C28C71EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcwctrl.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\kcwctrl.mfx
Size 63KB
SHA256 0666e52ea54bb2bdb81216443ea0787b8fcc6292b64d6bdf285eebf42e1bbae6
MD5 fa3aa3c51150eb5410dc3d74484d84bb
SHA1 3ffca600b9d8b2d580c99021c95e8c6400d9a824
SHA512 81ec7ec2a5877d1b226dfb4ccc8c3946b61fb409d5c53c789e6f8c310a0dc0b3ce1681613cc110a5559540a0ab302e6c36a00d0df07acb41c5a7c35b37d4594a
SSDEEP 1536:Gur/2P3+7NhvoU5bc8Tcd2QsWjcdiVKjnB0ya:vK/ohv/y8+YiVKDB0B
TLSH
T1F053050476D09072E1B21B349CB69622472EBC82D9B5DDA73B88114E5E713EDE738F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\mmf2d3d9.dll
Size 1.1MB
SHA256 53edf5138930d52b473104ce0d085413248d15a4aa891ac02a718e89625de6ef
MD5 3ae47534f1224c4797176107a9a41683
SHA1 5c4af10c0afa5233a21a661d7ba9130c808a961d
SHA512 6dc285765b4726708afaab793b7b384121476fa807114490824a5513c5c80b6278e376dae3b0d82a7360cd65cdbce8d3f60ed23271453a08e2a5af311715e8d3
SSDEEP 24576:uE6cfv6jilsTCw8RCmttZtcJPFGySBDmXA4HwoSJc:MyA8omXGSFmd1
TLSH
T19135AE51F192C036C0AB33710657A3B932BDAF25197589CB1A887DBA3F345E187293DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\mmfs2.dll
Size 768KB
SHA256 763ef4484ba9b9e10e19268c045732515f0ac143cf075e6d1ea1f5adcc77633b
MD5 200520e6e8b4d675b77971dfa9fb91b3
SHA1 0c583bf4c3eda9c955fd0d0d3ba7fdc62a43bf07
SHA512 8b7bb334b6bd83ae43e5a4fe32a92b38b1edd2c292c4a540a54c2ee16092eb30108524c1c363508f7c62617bb224d9b447f07cda97ab7de01688acbfbacec51b
SSDEEP 24576:OAN3eETMNlmLBNc/82oLOsy6rvPXPT1YI:hN3eETMNELBNczoM6rHXPT6
TLSH
T1E4F4AE20BDC5C131D6AA247286BDFFBE19AC66300BB455CB4B881E7A1F201D36F36657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mp3flt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\mp3flt.sft
Size 24KB
SHA256 81c9a9459a8e124793addf142cd513945d6fe600e1d67f74897898d7570e56b2
MD5 5bebc3ae0122702b89f9262888d3a393
SHA1 064731c0f1d493b5b82921fa78f06e3d1db95284
SHA512 c10cb520c2c4a9fe7c371f17ce7f86f138db247468ab1e465dafd7abd294c2beb13cf3a2595b4c8c820d911d8b70842c8f4e45398693c4f0454f973bd58a10a1
SSDEEP 96:24znrBZKgkk1jqIU9my5F3TM+EXt0D0CZpMC07X7Xbw9pbcPw5KqQ+5lyV:24bXSIXy3IrXtafMCOIpwPRzElq
TLSH
T159B22B12B3A10CF1E55A5E322CE7027B6E75FB9917B4625B9F91C23D1C33901A81B573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oggflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\oggflt.sft
Size 130KB
SHA256 9e589f86317d840df9bb74f6ee20c24ca65afe58f4009740382f63a0f5531941
MD5 0c8c1ee3ba92189f4ce21d1b396a2765
SHA1 b7daa4a6e16416151dccbb0a89f304961b6cb627
SHA512 0a4339092ac55bac3b1bdfaaa3401020f8f49918bd2fdb14524f3d558eb840b876aedfdeb54a1da163fa36393abf3fe8ab7e112a34ea9d891e82a22e96c85ddc
SSDEEP 1536:Ww+JHBmul5IMIPkmLnFfUs3OF+KQ51PGTUBHnEJj0AtDLPJwdMSIiRaEUsXxTTUI:CCul5jEkSbOF+31PGTUBwoA8uMR0IjD
TLSH
T142D39E529687A0FEE8CE1978146F367FDE261A0D7218CD539314EEF69C61E10BE1930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

parser.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\parser.mfx
Size 40KB
SHA256 19417d80bbcf961e4941ad9fc839a7f266fa58cc6156ccb012c9a09eb4929054
MD5 aecd3e2e63217d6fe7f15e950555f9bc
SHA1 9fc29cd71decdceaed7da262e09b498a3fb21dbb
SHA512 03cbf4b6253029008112883209ccd1713303b2ee0ab2aac91d975083c0c2019f3f5b4f5feda8365082b7ce498d1222b8f05506377eb75c5eda3865e0e49c2ddc
SSDEEP 768:IGuqbXplBuz1ZLKB2n7VWC1Kuqeth3wmG5j:IabBuz1Z14C1Kuqeth3wmG5j
TLSH
T19313F61593D100B2EABA1D79197F1A32BA31FC861B7682DF5321DC3959722A5EC3132B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timex.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\timex.mfx
Size 40KB
SHA256 a0f8b4b101c0d0e719b2dd2131ef5d47bdf51f1dd9f4a8f32103c11f51557a91
MD5 2d075f90f879f30719b1bf1ad826ac4d
SHA1 9e7f305dcf7a1cbf9774b283cfeacc258f1a91da
SHA512 31cdc6726d43e945c9be7cf61bed6ecad2784b34cf5b82f5a9bab384d179fd7efe8377830af19aabcc45b590d9310ae1ba19a884548c8788c68a3b624eb87163
SSDEEP 384:U7pyONRZBmMSIXQ0UgMQkKLlYfsYEoE4DeOmWePaGLdi0cFzyNLctteVV91enBx/:GpyA803NLq/5sfm
TLSH
T19603849067F945A3E2FA69316C7B2372B530BF5A8CF4A20E0D94E41C5670953E934B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ultimatefullscreen.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\ultimatefullscreen.mfx
Size 73KB
SHA256 fd179783ff6e6eb0959185087f33ed4a1b256e58762d9817bcb16888e20f7058
MD5 96059dbec69c3904e4d7ce734a4b38d0
SHA1 5169934f8d89b0dba963861dcbae55e78fc21dfc
SHA512 82977b2c249e47ca37d6fd62f416ed995b4b5f953bc5c18c84bfbdacc2c5b17fdc50c1e736fafcac242a3f8921b5000e0ec84302bc4e0077d6eeee3aa43cc520
SSDEEP 768:SZfXhNSu1qUKsek7uCZCbMh09RzRLh5xjEnR114TkeWeBg7RIAyEDVyncXBwfSV0:aSZc091RLh5xwnl4TkKBUuAMWHwn+q
TLSH
T1A1738E2072D0C072E0AB1679587666705ABE68129BF440CF6FA9067E7FE07E01E79377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waveflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrt4EC7.tmp\waveflt.sft
Size 8KB
SHA256 92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
MD5 57ea61dd14314ef155e80c6a0be8a664
SHA1 963b0ef2fe976ff77044a821fe1e29be4a8cf8a7
SHA512 cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9
SSDEEP 96:vLor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6N/8cKH+ewp:v26Dj9t2ubTVdGJgOcGvw
TLSH
T16FF11B12A7A500F5F8DD0B7134B7627BE875FA285B11C24FC580DE6C0C301E2D928BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2824-128-0x0000000002AD0000-0x0000000002ADE000-memory.dmp

Download

memory/2824-156-0x0000000002DF0000-0x0000000002E12000-memory.dmp

Download

memory/2824-60-0x0000000002200000-0x0000000002233000-memory.dmp

Download

memory/2824-179-0x00000000038D0000-0x00000000038F4000-memory.dmp

Download

memory/2824-141-0x0000000002B20000-0x0000000002B39000-memory.dmp

Download

memory/2824-106-0x0000000002470000-0x0000000002481000-memory.dmp

Download

memory/2824-163-0x0000000002E20000-0x0000000002E3A000-memory.dmp

Download

memory/2824-76-0x0000000002260000-0x0000000002273000-memory.dmp

Download

memory/2824-121-0x0000000002A90000-0x0000000002ACF000-memory.dmp

Download

memory/2824-99-0x0000000002CD0000-0x0000000002DE2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads