Analysis
- user interaction
yes - max time kernel
150s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
GMZZLauncher_v1.1.43.0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
GMZZLauncher_v1.1.43.0.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target GMZZLauncher_v1.1.43.0.exe
- Size 149.3MB
- Sample260822-bddbsazelb
- SHA256 2fc1f5fdabde32da48157ca7881e06dfbd5a38eee43c94ca836899c297429540
- MD5 88a77ad3cd5b5ecf71d72d489f3eabe2
- SHA1 5796d6446e6c4a658270260de08f23669bd03b6f
- SHA512 d0668c6a0e37adf32bf490a1e573c3ba5d560bb268b951de888b959b36bddf059676563a0dafa4e98f21414caec8d7533a846778c9187c79302824e502912d68
- SSDEEP 3145728:QrsQCYgJQQkEsGAX2u5XeTgfHSiOzYIy9SgpOGGldOyNlU5M:QJTQkEA2E1fyBiXkpll
- TLSH T15E783344E3E046E0D027D938CAA99333D770FDA55725C38F2A65EB4A1E337904E6A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,1081,19041,0" ie4uinit.exe - Modifies Windows Firewall 2 TTPs 6 IoCs
pid Process 3412 netsh.exe 4804 netsh.exe 2188 netsh.exe 4212 netsh.exe 3672 netsh.exe 648 netsh.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation GMZZ.dll Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation GMZZ.dll - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\GMZZLauncher\chrome_100_percent.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\mr.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\resources\app.asar GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\resources\app.asar.unpacked\node_modules\better-sqlite3-multiple-ciphers\build\Release\test_extension.node GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\v8_context_snapshot.bin GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\解压失败，以管理员权限执行.bat GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\ar.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\da.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\he.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\kn.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\ms.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\ta.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\bg.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\el.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\fi.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\ja.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\sk.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\解决页面白屏问题，请退出游戏以管理员权限执行.bat GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\installConfig.ini GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\GMZZ.dll GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\cs.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\fr.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\hi.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\pt-PT.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\vi.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\plugins\7z.dll GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\chrome_200_percent.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\ffmpeg.dll GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\en-US.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\fil.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\nl.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\sr.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\plugins\7z.exe GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\resources\app.asar.unpacked\out\main\KCustomNative.node GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\config.ini GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\it.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\pt-BR.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\tr.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\plugins\WebUpdater.dll GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\诡秘之主.exe GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\es.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\LICENSES.chromium.html GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\d3dcompiler_47.dll GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\libGLESv2.dll GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\resources\app.asar.unpacked\out\main\KAppUserModel.node GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\snapshot_blob.bin GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\vk_swiftshader.dll GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\vk_swiftshader_icd.json GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\icudtl.dat GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\kLocal.vfh GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\af.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\zh-TW.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\en-GB.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\hu.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\plugins\libcurl.dll GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\resources.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\resources\app.asar.unpacked\out\main\KMapview.node GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\es-419.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\lt.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\ml.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\locales\sl.pak GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\plugins\WebUpdater.exe GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\plugins\logo.exe GMZZLauncher_v1.1.43.0.exe File created C:\Program Files\GMZZLauncher\uninst.exe GMZZLauncher_v1.1.43.0.exe - Executes dropped EXE 9 IoCs
pid Process 4896 诡秘之主.exe 4312 GMZZ.dll 2068 GMZZ.dll 3700 GMZZ.dll 3816 诡秘之主.exe 3812 GMZZ.dll 2772 GMZZ.dll 1348 GMZZ.dll 1856 GMZZ.dll - Loads dropped DLL 17 IoCs
pid Process 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 2068 GMZZ.dll 3700 GMZZ.dll 2068 GMZZ.dll 2068 GMZZ.dll 2068 GMZZ.dll 2068 GMZZ.dll 2068 GMZZ.dll 3812 GMZZ.dll 2772 GMZZ.dll 1348 GMZZ.dll 1856 GMZZ.dll 1856 GMZZ.dll - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4260 cmd.exe 2768 cmd.exe 2420 cmd.exe 1212 cmd.exe 3420 cmd.exe 416 cmd.exe 1016 cmd.exe 1888 cmd.exe - Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GMZZ.dll Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GMZZ.dll - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString GMZZ.dll Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz GMZZ.dll Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz GMZZ.dll Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString GMZZ.dll Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString GMZZ.dll Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString GMZZ.dll Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString GMZZ.dll Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GMZZ.dll Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 GMZZ.dll -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\OperationalData = "12" ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\BrowserEmulation ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main ie4uinit.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\ = "Open in S&ame Window" ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" GMZZ.dll Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\Content Type = "application/xhtml+xml" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\Content Type = "message/rfc822" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command ie4uinit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\Open\ddeexec ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\CommandId = "IE.File" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\CommandId = "IE.File" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\printto\command ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\PropertySheetHandlers\{FBF23B40-E3F0-101B-8488-00AA003E56F8} ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings GMZZ.dll Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ GMZZ.dll Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\EditFlags = "2" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\IE.AssocFile.HTM ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.svg\OpenWithProgIds ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xht\Content Type = "application/xhtml+xml" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-903" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-912" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\CommandId = "IE.File" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1" ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff GMZZ.dll Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" GMZZ.dll Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" GMZZ.dll Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\ = "open" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\CommandId = "IE.Protocol" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\printto\command\ = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\system32\\mshtml.dll\",PrintHTML \"%1\" \"%2\" \"%3\" \"%4\"" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.url\OpenWithProgIds ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\IconHandler ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-17" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ = "InternetShortcut" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\PropertySheetHandlers\{FBF23B40-E3F0-101B-8488-00AA003E56F8} ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5000310000000000165d530810004c6f63616c003c0009000400efbead5c6ba7165d53082e00000076e10100000001000000000000000000000000000000cacae6004c006f00630061006c00000014000000 GMZZ.dll Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" GMZZ.dll Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\ = "URL:File Transfer Protocol" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-53504" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\svgfile ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.svg ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.svg\Content Type = "image/svg+xml" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\ = "open" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\Open\command ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394\DisplayName = "windows_ie_ac_001" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 GMZZ.dll Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell ie4uinit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\ddeexec ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff GMZZ.dll Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" GMZZ.dll Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-17" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-17" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.partial\OpenWithProgIds ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" ie4uinit.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD GMZZ.dll Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f GMZZ.dll Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f GMZZ.dll - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 1856 GMZZ.dll 1856 GMZZ.dll - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4312 GMZZ.dll - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll Token: SeShutdownPrivilege 4312 GMZZ.dll Token: SeCreatePagefilePrivilege 4312 GMZZ.dll - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4968 GMZZLauncher_v1.1.43.0.exe 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll 4312 GMZZ.dll - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3816 诡秘之主.exe 3812 GMZZ.dll 4312 GMZZ.dll - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4968 wrote to memory of 4896 4968 GMZZLauncher_v1.1.43.0.exe 93 PID 4896 wrote to memory of 4312 4896 诡秘之主.exe 94 PID 4312 wrote to memory of 416 4312 GMZZ.dll 96 PID 416 wrote to memory of 2060 416 cmd.exe 98 PID 4312 wrote to memory of 2068 4312 GMZZ.dll 99 PID 4312 wrote to memory of 3700 4312 GMZZ.dll 100 PID 4312 wrote to memory of 1016 4312 GMZZ.dll 101 PID 4312 wrote to memory of 1888 4312 GMZZ.dll 102 PID 4312 wrote to memory of 4260 4312 GMZZ.dll 103 PID 4260 wrote to memory of 3412 4260 cmd.exe 107 PID 1016 wrote to memory of 648 1016 cmd.exe 108 PID 3816 wrote to memory of 3812 3816 诡秘之主.exe 113 PID 4312 wrote to memory of 2768 4312 GMZZ.dll 114 PID 4312 wrote to memory of 2772 4312 GMZZ.dll 116 PID 2768 wrote to memory of 4380 2768 cmd.exe 117 PID 4312 wrote to memory of 1212 4312 GMZZ.dll 119 PID 4312 wrote to memory of 2420 4312 GMZZ.dll 120 PID 4312 wrote to memory of 3420 4312 GMZZ.dll 123 PID 1212 wrote to memory of 2188 1212 cmd.exe 125 PID 3420 wrote to memory of 4212 3420 cmd.exe 126 PID 2420 wrote to memory of 3672 2420 cmd.exe 127 PID 4312 wrote to memory of 1348 4312 GMZZ.dll 128 PID 4312 wrote to memory of 1856 4312 GMZZ.dll 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\GMZZLauncher_v1.1.43.0.exe"C:\Users\Admin\AppData\Local\Temp\GMZZLauncher_v1.1.43.0.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Program Files\GMZZLauncher\诡秘之主.exe"C:\Program Files\GMZZLauncher\诡秘之主.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Program Files\GMZZLauncher\GMZZ.dll"C:\Program Files\GMZZLauncher\GMZZ.dll"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "REG QUERY HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run /v 诡秘之主"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\system32\reg.exeREG QUERY HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run /v 诡秘之主5⤵PID:2060
-
-
-
C:\Program Files\GMZZLauncher\GMZZ.dll"C:\Program Files\GMZZLauncher\GMZZ.dll" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\诡秘之主" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1992,i,4387260763487085888,4412734277973629180,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068
-
-
C:\Program Files\GMZZLauncher\GMZZ.dll"C:\Program Files\GMZZLauncher\GMZZ.dll" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\诡秘之主" --mojo-platform-channel-handle=1932 --field-trial-handle=1992,i,4387260763487085888,4412734277973629180,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall delete rule name="LordWebUpdate_0""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name="LordWebUpdate_0"5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall delete rule name="LordWebUpdate_1""4⤵
- Executes a command shell one-liner
PID:1888 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name="LordWebUpdate_1"5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall delete rule name="LordWebUpdate_2""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name="LordWebUpdate_2"5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "ie4uinit.exe -show"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\system32\ie4uinit.exeie4uinit.exe -show5⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies Internet Explorer settings
- Modifies registry class
PID:4380
-
-
-
C:\Program Files\GMZZLauncher\GMZZ.dll"C:\Program Files\GMZZLauncher\GMZZ.dll" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\诡秘之主" --app-user-model-id=com.kuaishou.gmzzlauncher.pc-ks.9b094c12 --app-path="C:\Program Files\GMZZLauncher\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2684 --field-trial-handle=1992,i,4387260763487085888,4412734277973629180,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="LordWebUpdate_1" dir=in action=allow protocol=TCP localport=49152-65535 remoteport=49152-65535 profile=any program="C:\Program Files\GMZZLauncher\plugins\WebUpdater.exe""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="LordWebUpdate_1" dir=in action=allow protocol=TCP localport=49152-65535 remoteport=49152-65535 profile=any program="C:\Program Files\GMZZLauncher\plugins\WebUpdater.exe"5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="LordWebUpdate_0" dir=in action=allow protocol=TCP localport=49152-65535 remoteport=49152-65535 profile=any program="C:\Program Files\GMZZLauncher\GMZZUpdater\Update.exe""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="LordWebUpdate_0" dir=in action=allow protocol=TCP localport=49152-65535 remoteport=49152-65535 profile=any program="C:\Program Files\GMZZLauncher\GMZZUpdater\Update.exe"5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="LordWebUpdate_2" dir=in action=allow protocol=TCP localport=49152-65535 remoteport=49152-65535 profile=any program="C:\Program Files\GMZZLauncher\GMZZUpdater\WebUpdater.exe""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="LordWebUpdate_2" dir=in action=allow protocol=TCP localport=49152-65535 remoteport=49152-65535 profile=any program="C:\Program Files\GMZZLauncher\GMZZUpdater\WebUpdater.exe"5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4212
-
-
-
C:\Program Files\GMZZLauncher\GMZZ.dll"C:\Program Files\GMZZLauncher\GMZZ.dll" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\诡秘之主" --mojo-platform-channel-handle=3304 --field-trial-handle=1992,i,4387260763487085888,4412734277973629180,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348
-
-
C:\Program Files\GMZZLauncher\GMZZ.dll"C:\Program Files\GMZZLauncher\GMZZ.dll" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\诡秘之主" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5576 --field-trial-handle=1992,i,4387260763487085888,4412734277973629180,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1856
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f8 0x3041⤵PID:2868
-
C:\Program Files\GMZZLauncher\诡秘之主.exe"C:\Program Files\GMZZLauncher\诡秘之主.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Program Files\GMZZLauncher\GMZZ.dll"C:\Program Files\GMZZLauncher\GMZZ.dll"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3812
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\GMZZLauncher\chrome_100_percent.pak
- Size 126KB
- SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
- MD5 d31f3439e2a3f7bee4ddd26f46a2b83f
- SHA1 c5a26f86eb119ae364c5bf707bebed7e871fc214
- SHA512 aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5
- SSDEEP 3072:5KzwqCT4waJL2myFhPNL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:5Kzwt4LwmU3K18Gb0OV8ld0GecQ3f2
- TLSH T1B6C3E0D3B3F4EE7DDE9756B7A2160072ECB346640AD1424A178ED8362A36748D9C8783
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\chrome_200_percent.pak
- Size 175KB
- SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
- MD5 5604b67e3f03ab2741f910a250c91137
- SHA1 a4bb15ac7914c22575f1051a29c448f215fe027f
- SHA512 5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d
- SSDEEP 3072:+DQYaEQN6AJPRJL2myFhPNafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:+DQYaNN68RwmU0gx5GMRejnbdZnVE6YR
- TLSH T15304E1D773F89E7CC9630AB7622601F1ECF2113559B6525B17CF9C353A96B8889C8283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\config.ini
- Size 1KB
- SHA256 40a7c8d117d97b332d0fbe824327622a63b0918de85da84d55c03296ed7d5251
- MD5 f5137e6979828f0342663919ccc06051
- SHA1 03659f2899a04d31809e51db44f0f7166cc03c46
- SHA512 a007ef4e6d9c2a238935b2019972c7d59a99496356ab2846bcaf71a60daa9e5dca6bf2d68b5704b7bdcecd23e2086b5d03879bb7e9900e0021875df6ef445a18
- TLSH T18721C884291104E805406F29826A384DCC3AE5B4B5BA835BDE5E80712EDFFC7687D53B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\GMZZLauncher\d3dcompiler_47.dll
- Size 4.7MB
- SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- MD5 cb9807f6cf55ad799e920b7e0f97df99
- SHA1 bb76012ded5acd103adad49436612d073d159b29
- SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
- TLSH T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\ffmpeg.dll
- Size 2.6MB
- SHA256 399f4dc4e13feb0a54bd5f1b47658fe06e144cb591138b501c2a49c3c58e6a24
- MD5 3423f8a3adf817aec50b02a4ea9778f0
- SHA1 e5e1de0e12c35c76a0c66f9ff4e7fa44040ff8f3
- SHA512 6ea7874f138984c3f0fd3175c487ed4dd7a18eba6c9f7bf40da77b83d30abddc0f37308dbd2b0bd3c0a2402a2133fc7b987ea45aa75884ff6ce0912ddfdb5af1
- SSDEEP 49152:5qMAAYNDEmcTfAZMHkwfPYX6Edxhi1uGaVrFY7Q9b5hpN3lzl3hHLNoJXd:5GDfRMHR8rFYU5hNAN
- TLSH T1E0D5AE07F6D600E9D01DC574879F9233F631384A4B24A5EB1A91AA242F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\icudtl.dat
- Size 10.0MB
- SHA256 97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3
- MD5 76bef9b8bb32e1e54fe1054c97b84a10
- SHA1 05dfea2a3afeda799ab01bb7fbce628cacd596f4
- SHA512 7330df8129e7a0b7b3655498b2593321595ec29445ea193c8f473c593590f5701eb7125ff6e5cde970c54765f9565fa51c2c54af6e2127f582ab45efa7a3a0f6
- SSDEEP 196608:p5zwSv9AAyse6liXUxCGZHa93Whlw6ZCXU0:pyKlysTliXUxCGZHa93Whlw6ZCX1
- TLSH T101B62807A2FB8DC2F9F76F30D9F452679567BD496E32805A11042F3B1C337A08661BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\installConfig.ini
- Size 512B
- SHA256 b4e90e465f4f468083111b20425bab712f9a1f8d46edbce50701d5136bd7c23f
- MD5 08c02ac9352a00b7c5ff81fb273d0253
- SHA1 1a7733687b26172627b0ddb9fb677dafb9ef154b
- SHA512 1582e3a40d6cbf4ef5629b5e61876421deef4f77249d41f3c35ba06c28338e0adf2d28962ed8cb5c136db4f790f19754718c04417a389610c17658155bddd514
- TLSH T1FDF07501D00B46931CBFC0E2B84B136D223B7470D2C31C591D7DA923091103D81FDC94
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\GMZZLauncher\libEGL.dll
- Size 483KB
- SHA256 4c14cb7db41256dd801fba99f601bfe8018b4a527a5a00b74fd27d5d52034fda
- MD5 779d1022f5229a1e04361875b57de70b
- SHA1 dbe1f5b14ab358fb6726234a794138ddc37ef766
- SHA512 780b32aa1801095dc0bf73c043ef05d7a30dfb2d846612c7705ca46dc2efa2cb7bf2292feee79b717a25da168aa64214a7c79b1ff29eb0c75ab4818a9a799db9
- SSDEEP 6144:9Tv0fq4dz9B4x4w/jvtGW9ZST3BypG48yOnb4pgsHVlAYnReZRO8kvT:9TN4dNw/jvtGW9c3BypaagYnKROp
- TLSH T18DB47C12779554A8D03AC474CA134612EE76B8860F35EADF02A4D27D2F77BF85B3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\libGLESv2.dll
- Size 7.2MB
- SHA256 c84eba581bd4cc06408cf6399d8378c2c9bf1e6a31a36e57cd55275a6c43aad4
- MD5 2c73798431d01219eab1e31c84dda1bf
- SHA1 112898f4de1afa136517dd267a1477e95f31f4fa
- SHA512 be014cb6eaf825818c2ee11b8edda2708c83b8a7c989778ff00829271f752af47308c5a05c056f23eef264f0a1597999479a84d8437e4efe03a000a795cbcc77
- SSDEEP 49152:ls95E5fqF3q/xEpLJgw7yQj1+lSWsucneTA4fwEmN428bbvbgNqay6q/iyGtxJez:alq3ZieHhogDbBztUecv7r7frgsOMU
- TLSH T1C1766B07E6A581E9C05ED2B88B5B9222FD30BC4A4734B2DF266437112F77BE06B79750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\locales\en-US.pak
- Size 313KB
- SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
- MD5 3f6f4b2c2f24e3893882cdaa1ccfe1a3
- SHA1 b021cca30e774e0b91ee21b5beb030fea646098f
- SHA512 bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c
- SSDEEP 6144:SssphRVKuQ+KVMP9elsY4ZfaYe7RqIZ5HS5xswS:JsIvVMNY467Rv5HSPswS
- TLSH T1FA645D1FE7842266069312627F05A5A2FB36D06DA35112673CBC813C33B7B66C3776E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\log\2026-8-22.log
- Size 7KB
- SHA256 38f5cc252873c591512a4ee7d43d577c920480b6db1fe30e70e3dc3362234957
- MD5 0186b164c9024e44691bb5488f678810
- SHA1 324489c62a872757de7a05f98ab77ed724abfc6e
- SHA512 252683baba5844a433b362492426c210294f4eb05b1ce8165a7e51adcbeac17f6a7a6673842181765e9435de03d987a4f5fa57b8a33160a07a95329aa64a54bc
- SSDEEP 192:HTPxExxEIsQMt7NagKkV3fN4TEkV3fN4cLILoqGYo5Ld:6ne7sgRvuvNco33
- TLSH T136F1CC364BF460B34A660728E4CE3F9EB55539131C948C6062FC4944A7BEE1ABDC772C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\resources.pak
- Size 5.1MB
- SHA256 4f29587bcd952de1dbc0b98df0aa506bd9fcf447e6a7258c5eb7e9eb780e6d6c
- MD5 f5ab76d2b17459b5288b6269b0925890
- SHA1 75be4046f33919340014a88815f415beb454a641
- SHA512 6ec6a08418743adb5e20218b73169be4f45f5458592219497c3718e620e37871876788937418f1341e0023c1137f9cac715e6bb941f4690febdda993b072feab
- SSDEEP 98304:jefgvjX8Y3INBibFPzG/7DN7h1rA0Z0rwreQVnHbwJwKgoHksnR:jeIvQY3IzAq31hKi0kreS45JR
- TLSH T119463320E1686D37D58A977AE4AC91335735C9031CA1782CF4CD620E8F9D2EE16B93BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\resources\app.asar.unpacked\node_modules\better-sqlite3-multiple-ciphers\build\Release\better_sqlite3.node
- Size 2.2MB
- SHA256 8da1266c201bea3d91b788fbda192ef3f811b19984c6a415d98f9050f48c4d5d
- MD5 82b1d5188f818559735c9a23d01b6baf
- SHA1 6be03d68558b7a7d9b0642e2e0806c28041960f4
- SHA512 7aa93307909056f90a4711204a23394c7446ebd78b0e0b12904e88bff8f1ed0675edfc5e582137dde00faa512eb516315ffa2a5b476b6ecafb57b18aeae37b45
- SSDEEP 49152:2jijNoZ1p3q0jp+MO9iOxVxZZ4fdf2ejHVNM1kmK/ULxhUnIOGJzMa0VI:ei6T3q0jp+MO9iONZGfP+Ma4I
- TLSH T12DA59D8BF2A900FCC067D1B9C61B5607E7B174151324A6EF1590CAA96F63FE217FA324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\resources\app.asar.unpacked\out\main\KAppUserModel.node
- Size 146KB
- SHA256 f92d6fe907a79f0b133244232f84b4587ab0c9789342842961263dedd0171aa0
- MD5 d63c0507502d1a87c6a976f50241d96b
- SHA1 d7a051b208ef2001307c29dc955fab7fa4ea6fd3
- SHA512 470244b06ee312959f50a0965cf8deb5cdf14e6b3d0dde83a65cd009d4154b1c9ec2bb4bed0effcd15f656fb2028bea08229d166dba8af05d3040d3f0b2df5d7
- SSDEEP 3072:dZPUBkthzS/Tz9CFa+lj1pTGkIHkS+XzR3jYdFs7KH7vwm:dZPUBk4zE3b4HkSUzn7k7vh
- TLSH T114E35B47B7A900BBE137C67C84D34A01E7B6B8151B619BDF0790826A1F237E59D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\resources\app.asar.unpacked\out\main\KCustomNative.node
- Size 219KB
- SHA256 bf0ad069542d45bef2563b03b0f67f7d013a93f7f5cc840f727575a7efdab49b
- MD5 6d4b82abce7e86170dfdaa7da71d0b9b
- SHA1 3aa453f888dad1dfcfeaec6e9ec625bf4abc8de7
- SHA512 e34e1e5505f1a244e65a81151f13bdda6a8ca3ed5e9d9f4f28dc3227586b0df05a0a89948e98710acf6cd6db7b65d2f25d84acbe6315bdbc0e65b09715eb5a26
- SSDEEP 6144:+pFmgIeEKYf8FQf6/q4PiOlwpiKrhzJTdXXyD9vM:sFmJ7s5DwpiQdXr
- TLSH T1C5247D06B569007AED67D278C9834A02FB72BC5107B0AADF4390477A4F2B7D89B3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\resources\app.asar.unpacked\out\main\KMapview.node
- Size 159KB
- SHA256 23cb67e5a8a0d0fef7a5487e4d4762fb91ecda6d4ed425aadd3f2c57c71e0070
- MD5 399816153e244ef691bec31fda4bca4d
- SHA1 1602073952e06d51f2a73cb545f734a9cee59cd3
- SHA512 5152eac8be585833a1c8ba2a315265c7bc182d4a0be05a25cf2e470fde73e6f8c88e414257fa5b7f5311c7d5ea11a82d2a66f118176fb98499fc1412f436b46a
- SSDEEP 3072:zZOVeJAUm4BoRm9Q6Uw4W+jRgIVmhi7pCdnZPHavwjO:zhCUm4BooK1pjqIrCdd6vl
- TLSH T1A1F35B57B2B400BBE177C27989D34A12EB72B4114B609BDF47A082791F137E1ED3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\v8_context_snapshot.bin
- Size 471KB
- SHA256 add78f3f85f0b173cbe917871821f74c5afe0a6562462762b181180d16df4470
- MD5 6503b392ac5c25ff020189fa38fbaecb
- SHA1 50fb4f7b765ac2b0da07f3759752dbc9d6d9867b
- SHA512 9c12fff1686845a2c0b43d35a8572f97e950f232f1ce5690fd1212f48c171edbcc5d725754f10a66599b0823ac0c995c7212e263b7e02ea0ed9f2d2b937fa760
- SSDEEP 6144:PjKA3pW4TRXsLj3EpK0P8iWhyFUaxw/5h56N:r0LQf8i2yy/5h58
- TLSH T116A4952CB701FA22CC576EF049F1DA51F7B17E8CBA02110BB1DE5EAE11EAB852D57190
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\vk_swiftshader.dll
- Size 4.9MB
- SHA256 9923ed1014891faaf39316793d6a3c8bd2b61ec7645d92ad669ee7d569a55e73
- MD5 f84604f5d91698e5b16f5676286927c1
- SHA1 e28e5084b0b24102e4eb331c2480d73060896b91
- SHA512 e68905d14a0d936b642ba09e880adb579102d401d5f8c188704483cb705a82c2078df44112fe69db44af28ea25299e1a2410c436cfb7b263c45a3c55bb9e7c81
- SSDEEP 49152:RGrnxGr9pGmj8pGtA/bVVku6KZlxsMOtVKOkc4FjHjAW3vZ1B93k1RE7SrLop8cx:anxY9NURayzxX61u0Lflb0wrDw
- TLSH T19A363903B295819AF05ED179475FA632E631FC811B7276DF42A02F192E3BBE06B39705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\GMZZLauncher\vulkan-1.dll
- Size 904KB
- SHA256 22099a01381408ae5720c269245309d24d501792957e75e2bced88b98b0f793f
- MD5 dc07bd46c12cbb85a099ee7cdd037267
- SHA1 f795f83ebdfd9490f4ebffad3c68a35ef058d4d3
- SHA512 5c3a1b925a89fc489483cf52878953fb8450953c7b605adea9da21033e387b86df220fbbb74efaa6aee5ab34c963ac3b8714169c55d079e9a4b9f1465e7d26b1
- SSDEEP 12288:lP1VNNJPqXu9D8xeLoCzG4JsZGS5ld/YlmQAuYvyRnsBsoj89C29hE:lPXJPq+9QeLpDpmQ/YJBseS9hE
- TLSH T132156E27AA544966D476C034C9828603CDB27C921725B5DF03685B19BF6BFF83B3CB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GMZZLauncher\诡秘之主.exe
- Size 1.8MB
- SHA256 e0a22389a89f2263aa8652cb2b635c8a4bfbd4e52f3994113fa7dcfeda88bbba
- MD5 fe55b5104cc14e347aee0beb31f3a398
- SHA1 1318e09abdcd1293aa877856692e21c0fa6c9e9e
- SHA512 50e0ac0c237638ed276518e65635a0b3e1dc99a8b984c2d535742f767f02a2c688b81956ab75fe017091675bb036bd61e2a07cabb6090f8c8a4d0261a521cfed
- SSDEEP 49152:h9ekTAyQ6GlGmyClXJ0j28H2OUvdKK8qH:WyC0PH3UvdKjS
- TLSH T1D1959E06F3900AE5E127C274C9DEE636D77079B10B25D68B1AA5EA0A1F337C15E3B325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\诡秘之主\诡秘之主.lnk
- Size 1013B
- SHA256 8820e43daa2f95add40e41e621f8c270e91ce25de755756fee0368e8d8cf2590
- MD5 164ccf99cb49cbf60c1c7373321333ab
- SHA1 d49e0c96f290dc92ab5817a5d4cc70d4ea8436a7
- SHA512 382dc4abe30c2b712c21f894767a5046204e9d16125bec90ffc22e14cdf86baf7f9ae2944ff77d81313d9c5ce21e5553e4fcac0f009f3f8b35bede7674d1ff4c
- TLSH T1FC116FA80BC13736E775C637965117125F63FC01FB770F3A00E583C64996716A948E1E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\b327faaae42d3dfd\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 b4b47b5c8fdef6d1ea1b9ea3fef2fec38be2dc9a371c00ff5f7f0803051b2479
- MD5 364638fa115901f7f65decf268bc0a5e
- SHA1 2f9eca772e6fcb4ba0a987884e6590bbae0dbb97
- SHA512 d6cd9cc3d86be595ccb05bb6720d535dc426334cec1d7a39572e9a763e22bd2fbc599e82fee260f6b343b3d1436e870b957fb929f6bd075740ccbd56c7afb657
- SSDEEP 3:XkllGlll/l/lXp9ZjrPBY0dlSltl31DP:Ul0dPBY0Sr
- TLSH T11053228033C30A2FCC23033088CF0BE03CB8E20803C302A283F08330E8ACB2000A02C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\b327faaae42d3dfd\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\b327faaae42d3dfd\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 960B
- SHA256 e075a60bbb9ec2cf51ed82b06117d40abbda524f8e3c234242190472cc5019d5
- MD5 39a5415c7baa5c4d2c7d5e73ec87f9fe
- SHA1 c456dd67a7ba7c4a095c6022c2b87c21a2f8bdcc
- SHA512 eb40fde68d7070c84d00bf3610c1825bd516c86b3691ed63ffe7047c4fae0607048f3cbf1953c8becd3110c200c9f5661a1e8b309ebe0fae1d367924c7df44d0
- TLSH T13D112B3233820CF8F3361F305530405412C3F10308C001284088C2668F30508D028BB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\诡秘之主\Network\Network Persistent State
- Size 526B
- SHA256 67ab6c6612b0480a8f0b81e463db7671f18e1d108d751ab644f59cfa38ad933f
- MD5 5a7a5d82daafe4cf859529b5786089a0
- SHA1 49e58bfe9db805c8953a5e7fd160d6d8467dfd81
- SHA512 ea5ec4b011759c655cf64f9c35c1a657bae2d83d650c92994cdf6f59066c112ed930225cfadff4a4c7569a93beaa293877796d1e61e73840a38f0b7138ae600b
- TLSH T10DF059D6C7E8497E46A653F01F253923C5FE051C53583C4288D4EF5E57E1879560044F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\诡秘之主\Network\Network Persistent State~RFe59e46b.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\诡秘之主\Network\TransportSecurity
- Size 203B
- SHA256 43705f804260f0147e949de16884adb3b76cdd575069bc68e176aab25796c7c0
- MD5 26a91b95faf7b95959c8452c919c2f9d
- SHA1 ceacf641468c4d9dd707602ef468a1667d6b14fd
- SHA512 746549785d1de64e035a9180f1ef4753f5f0a4799142607c62866f13db419df760bc5b4010a7c3877bfbd172446ffaccda0f2242a3a33ddce7a304ff964ed509
- TLSH T1D7D022A2806EF8B310BC0A252E90EF06AE7EA4340181ACEC99E3823C90440B74913003
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\诡秘之主\Network\TransportSecurity~RFe59641f.TMP
- Size 203B
- SHA256 0624da34785374d9b25fa35b6f02417ce77b65437cfe65b0a2c9248a619d2a5f
- MD5 242fd3eca1011ff9ea9641943d28b3be
- SHA1 b04ad66068c98b268ce6f6e51c9a361a8ab4ad7b
- SHA512 f475f78f811178c703cee603fae9b1b16655dfe336df58b1cc3aa216b6e8808d9bd7b0d6f6f8bddfd514e2f225303cce7714e66c405291114a89b6729782f0f6
- TLSH T108D022B2817EE53310B80E218980FE45AEB6B434018168F8DAE2832CB9C40AB860B803
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\诡秘之主.lnk
- Size 995B
- SHA256 3d1eed4c9f9cf3aa438134300fe4381cbe65428b8920d6888fe42f910c9a44f6
- MD5 f3e0762ebc3db22fb5da08a303f3baf7
- SHA1 1c11e8791b97dc380e5540b9f32d567d17633e71
- SHA512 2220919bf1a5c414b1f79e030cb61a574cfca0b3ccc0fef96b72662e4e391767e180f55e96d8494465de06daf24017cab6a2922a8ab91e0fe1606c6041df5cdb
- TLSH T1291182A50BC23536E776C637965166014F67F805F7264E3B00F5838648D6706A958F1D
- MD5 SHA1 SHA512 TLSH