54a0854ddeda27352f185a9f2c52ebc7fff7ae7fa8af68248dbb8f99452c9343

Analysis

user interaction
yes
max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1.8MB
Sample260828-dthybabf87
SHA256 54a0854ddeda27352f185a9f2c52ebc7fff7ae7fa8af68248dbb8f99452c9343
MD5 6bcb0de45c0b9d4cf7891073e418389b
SHA1 fc628117317a5857cdd45775262149cc481cd6fb
SHA512 8218f0887c63871ff5b7d15afc19f795c482d856af82c82df75b8427d10bfdc425cd6cb71d76adffb8f63295b353872ee5e56730376c12dfa0bea03b90a8a9b4
SSDEEP 49152:sXsHE7PB0gCAfx2U/kRyOJH3WrIwUxiWck76:gskGgCLYgyS03WcR
TLSH
T19295020927D28B36D2A01FB4A460E3355E266DDAFCD253096EF1FD8F3B3831558B2664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3612	Setup.tmp
5468	unins000.exe
1764	_iu14D2N.tmp

Loads dropped DLL 8 IoCs

pid	Process
3612	Setup.tmp
3612	Setup.tmp
3612	Setup.tmp
3612	Setup.tmp
3612	Setup.tmp
3612	Setup.tmp
3612	Setup.tmp
3612	Setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Setup.tmp
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\T:	Setup.tmp
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Q:	Setup.tmp
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\M:	Setup.tmp
File opened (read-only)	\??\S:	Setup.tmp
File opened (read-only)	\??\U:	Setup.tmp
File opened (read-only)	\??\W:	Setup.tmp
File opened (read-only)	\??\X:	Setup.tmp
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\O:	Setup.tmp
File opened (read-only)	\??\R:	Setup.tmp
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\K:	Setup.tmp
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	Setup.tmp
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\A:	Setup.tmp
File opened (read-only)	\??\B:	Setup.tmp
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\H:	Setup.tmp
File opened (read-only)	\??\L:	Setup.tmp
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\G:	Setup.tmp
File opened (read-only)	\??\I:	Setup.tmp
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	Setup.tmp
File opened (read-only)	\??\D:	Setup.tmp
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Y:	Setup.tmp
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	2164	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_iu14D2N.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5824-0-0x0000000000400000-0x0000000000472000-memory.dmp	innosetup
behavioral1/memory/5824-51-0x0000000000400000-0x0000000000472000-memory.dmp	innosetup
behavioral1/memory/5824-112-0x0000000000400000-0x0000000000472000-memory.dmp	innosetup

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	_iu14D2N.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3612	Setup.tmp
3612	Setup.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3612	Setup.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3132	unregmp2.exe
Token: SeCreatePagefilePrivilege	3132	unregmp2.exe
Token: SeShutdownPrivilege	2164	wmplayer.exe
Token: SeCreatePagefilePrivilege	2164	wmplayer.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3612	Setup.tmp
3612	Setup.tmp
1764	_iu14D2N.tmp
2164	wmplayer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 3612	5824	Setup.exe	89
PID 3612 wrote to memory of 5468	3612	Setup.tmp	91
PID 5468 wrote to memory of 1764	5468	unins000.exe	92
PID 2164 wrote to memory of 3424	2164	wmplayer.exe	95
PID 3424 wrote to memory of 3132	3424	unregmp2.exe	96

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Users\Admin\AppData\Local\Temp\is-FFN75.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FFN75.tmp\Setup.tmp" /SL5="$4009E,1305563,424448,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Ultra Street Fighter 4\unins000.exe
    "C:\Ultra Street Fighter 4\unins000.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Ultra Street Fighter 4\unins000.exe" /FIRSTPHASEWND=$B014E /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:1764

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 3528
  2⤵
  - Program crash
  PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2164 -ip 2164
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LAN.lnk

Path C:\Ultra Street Fighter 4\LAN.lnk
Size 699B
SHA256 1c8f532ba424020b004f7f963da47f0ee77b5b31a6bc195a91e0df016ba1a8ed
MD5 8a1c4a89b296fb89b0a4d86761262eac
SHA1 c4ca7bcb5d97cd59b42a43f3fd44e5db544052a1
SHA512 a3f5d6767c49c4f007ef0a2f6c69829a79ede4e9da93a7e263e368d161d19ebfd1c267675de9e0181c9757c1c9282520d1e4f5ff92cd6151e7f283781471eda5
TLSH
T1F70130544FD92168F3FBCBB2067E27508B5179DB8679C30C0444D24E7035910AA55F73
MD5 SHA1 SHA512 TLSH

Submit Download

NickName Changer.lnk

Path C:\Ultra Street Fighter 4\NickName Changer.lnk
Size 685B
SHA256 a491f053140f1ecc6d788b4588593ab36749666a7b0cde6436ea8c38c272faff
MD5 d8f4648fe7643a1374c9b68e1848b82e
SHA1 306f1312ee49bb319509d38d547a4772ab565b01
SHA512 278a22a081a3b0a6079d65fe6e7c8fe292efc9951a03648a87778172a1134a25d155e635bb598fd6ddd60cb5ec2600c7b3d9b19f099f72bd06ba5d8f243b7100
TLSH
T18C01A0148FC9112DF3FACBB2067A57449B11BCE3866EC34C0444D00E30326009B49F33
MD5 SHA1 SHA512 TLSH

Submit Download

Steam.lnk

Path C:\Ultra Street Fighter 4\Steam.lnk
Size 709B
SHA256 2fa7a91ec53687b60eabe9c6590b4912360bff9288acec3c91ddd6e9ed249cb1
MD5 b0db01c350ee95828a330465bee8a63d
SHA1 decc93e466b8400ae8edac9dcbb1ebaa594d3422
SHA512 d4fbf97e1c21ff9a76deea2ae6cdfe052b55214670d4c2ccdbbba7d702dbc9b857b8e3ae0fac8963342aeb80a51eb929a40e1872d3f999deba10a6371115f816
TLSH
T18501A0104FD911A8F3FBCB71027F27409B11B8978679C71C0445D14E7035900DA08F33
MD5 SHA1 SHA512 TLSH

Submit Download

unins000.dat

Path C:\Ultra Street Fighter 4\unins000.dat
Size 72KB
SHA256 18ea10c0cb6f7bb0a33fef4f10bacf5b9d619d2fd3f67fa69e39d71a4b67f288
MD5 dad821d468d37e9fad876064c33c6b38
SHA1 7f66d4cf6d3f34249385e292294e2bc86fe86244
SHA512 8c1d65d8f2b23d763191c654998e087cf902bc140145cc1d646502c112ed38e0078796a061b0cb561e787350adbe5e567291b22dd6016d0855f591d88b667cbe
SSDEEP 768:PqzwvtTzukowBqzGthKng2/ynHdje7H1X8ogk42HoafMOUJaUd:TvZz5t8GthK7BoRLb
TLSH
T15073531CEEBC5C25C69DD235D9E7426C37317EC4A256D72A2BCF4E3A2403B8958CB261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path C:\Ultra Street Fighter 4\unins000.exe
Size 2.0MB
SHA256 d4d2f1742678608a155831a3eb3761e642d971a52c7937957cab4a1b7ad47c77
MD5 3ba6b9ad9ab76e6dde2197bba8e62e86
SHA1 a0b315fe9424b9f32d46ad329c06ecb097c15f7a
SHA512 db3a54693c3c66ac6c223fc487e2dd659423643a008c9ca8fd48faef055b537a5f75271ca5d963e0b5d452a770d44f7fa8ffe6d4286f3c9c0c1b43e25495d17f
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKk97BMHEM0:cIEJxCWluyZ8UbMWsHEMsHE2n
TLSH
T193A56B16A2E18937D1722F749C26C26469327D64BE20968B3FF46E0E3F38740BD35766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 704KB
SHA256 8ab1e356f55eec06be5f177aa26c3b78d8b21a6c92b429ee5a00e997f8f8a604
MD5 f5e3f69cb31613cca2b47a2b828d0fa9
SHA1 36fbc3439f211f372b6f5cc4a91a409e4b1b7840
SHA512 8174cd9c5cde6bdb1415698209812574ac2ecc5a82f4901d391d15ff92f04355fd94b7ffc0017b9b46e15258faef5aef703c45a831e5feac599ef9fe1e456c4f
SSDEEP 768:Df0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr3UzfEwPRzitFrzAqUmNKX0AooJIX:DNpZZ9tjYpktMGAKSohZCDX
TLSH
T115E43F379560A088DF3C35B1E1AC6F0CBE72A00A12E012425F75A67F7A633DD9D175EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 768KB
SHA256 949940b05af1e4f5bbc04aa3750fcabf0195c07c8b66ea253f7ecfdf2b01e19b
MD5 fe5bfd64046db1ee5fbd9895177c3f71
SHA1 10ec2291b25a5e1174a3d07b9340a3c0ed8092d3
SHA512 5c7514800e24661e0e126f6558bf7bd13248b2ea8ec8e194c5c5d7fc005e7a2eab2867485d2a20ed4a0c1cc3642bdd856fa3f1e5e69111628ab1918c5808ad37
SSDEEP 768:rf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzAqUmNKX08oJImdu:r69ZP6YlHtMPeqWra/t1Ylh
TLSH
T13AF42137D160B085DE2C75B1E5ED5F0C7E32B10B12E042425FB8A67E7A633C9991B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 b37211c7d67c76b934c241a6d99c4e8452b97406b2ead2d0fe0be275521199fc
MD5 557b009c3fae10569a32a60f603b7abc
SHA1 09e7dea679b71a2b34dbd1f8efd00290e11f0a9b
SHA512 da4b03a8180dc22823f75709682a458ba11424d72242d600e69f39e85553d999d59b48ac51cf8fefb13da4a47876229fff66149ed75ace3d280b7fa8f064a2ce
SSDEEP 768:G0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaZ:oZP2tFP3vqY8CqEM6TaBacg
TLSH
T1E5257437D190B0C5CE2CB171E9ED8F09BA33A10B11A052465FF8A57A7A533D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 1a3631d8bf29f7d03a839c5685f3ba8e6f59f942a9be80825a4bd2d7ab8d75cf
MD5 d4563c36813d80e013cbd79e263eedd1
SHA1 e79f14c99763f52bff9a39d2b222b69a52b3cf50
SHA512 9de1bc0afa2cf0226467d6d67871b47cce6d4c3019ccdb70bf122c484d9af79f99793800767ef15adea68d392b41abedf78b2a3a24368bcfa19b52098b0aeda3
SSDEEP 96:f1O1e0ltONXtrUMUstT7XtIUMbstKyUMlstoOXtxL2t2LXtytNAtLt:tO1knSnvyna
TLSH
T12A63262192E416A9F3FB2E707AF5A51B2EBA78E1EE39D11D0204535D0D71F18ED31B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B2P.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0GJOL.tmp\B2P.dll
Size 46KB
SHA256 89ff2808ec92b072f347c10d30d1cde0441925ee626d0c192ec4ba86f0e8398e
MD5 dae5ed5f828c64e0a2adc0a98a08ca46
SHA1 5edb2b599e174eeb4bf64da8cbbc8a2950551fec
SHA512 01db144904f413f170dc699f99f686c09d471406f73d1b423896201c7eb0e84afabbbb7386827db4bdd67ed393297ec774947654c6de20c8c1a43d4d0c466442
SSDEEP 768:0Y7BbvjHP9gLS965xWmUOixo+uhEFw0Ib8s5VEDSn22NDgys:0ulyoGVEFUIGx9Xs
TLSH
T1E5234C4163518033D2EA573428E99F72597EBC011BF0819B3FB726AD9EB13C1A639317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0GJOL.tmp\Botva2.dll
Size 37KB
SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
MD5 67965a5957a61867d661f05ae1f4773e
SHA1 f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA512 c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP 768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
TLSH
T125034961E9E2D030C096DAFE7D34E224E76F3D201E264AFD5E996ACCDE5BE02141C167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CallbackCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0GJOL.tmp\CallbackCtrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
TLSH
T1F281BB43B3F81059F5B75BB07EE39B8729BAFD315E39C61E0A50011A2830A55AD36B33
MD5 SHA1 SHA512 TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0GJOL.tmp\ISDone.dll
Size 452KB
SHA256 bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
MD5 4feafa8b5e8cdb349125c8af0ac43974
SHA1 7f17e5e1b088fc73690888b215962fbcd395c9bd
SHA512 d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
SSDEEP 6144:QdFS9nBbvESTi3qakl6j+vn+nLE4FZZHYnf9ketkqOGzgsgmInbAKf3:R9BUqmvLE4FZKf6eDOG8sgmInk4
TLSH
T147A4BE23B6D2C572C00B92308D16D7F5A679BA209F2886C3B7D8DF6D6E351D05A3934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinTB.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0GJOL.tmp\WinTB.dll
Size 27KB
SHA256 88160915cd065e25bc0b9b89099663ccbcca606a5707a28a5df12e9c118d4f16
MD5 39a339e9c9ecc529202508c9c89a9956
SHA1 92e697882abb90cba6a783aef98d3d05deb8e4b9
SHA512 b96e3bac6da4e3812f09d21d575642beac47338c026f3bc116d42b09cfb492b1e51cc74cbb9d1724e744ec2129619b196247ca1ddc03d8c0a27a2613890cbef3
SSDEEP 384:GYHBKGLgPK/ij7m+1IdrqJ1xrkKMQPJhaXXuJl6X7IGOSj2LUn4+mqzTjdDZ9X:FHZL6K/ija+1I0JfRjPamls0+mKPdt9
TLSH
T1BFC27E57E6C0C032F8A1F278993A6209DBBE7E710525B47E55E9DCCECEA9AD0101C31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-71JQ8.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-FFN75.tmp\Setup.tmp
Size 2.0MB
SHA256 678d02cc80cf70dd4730424c1d6a00c46c4a821e164c6013e11c093b066b0214
MD5 62982b403d29d8dccad6efaceb7217f6
SHA1 cb32e3a1648569d233c1fa37142ee8cd3bd56fb5
SHA512 dce08a789ddd66b40467d44d5fe696a59d6185cedc114ec19827d6b95b8167c518275833c85ff38c571fbae0575475fee605b147ca19b85b6dadde0b6becd560
SSDEEP 24576:MH9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKk97BMHEMS:UIEJxCWluyZ8UbMWsHEMsHE2z
TLSH
T11FA57B15A2E18937D1722F749C26C36469327D64BE20968B3FF46E0E3F38740BD257A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 94108e8bcccdbcbe8e3a997ba1a1869b8da7eadc187d1a71b1c409013e1ac4b9
MD5 ca0231f05c09a8530d1430ee3fc0560d
SHA1 fa52f750d6431879b1e6ef7ebc3b88d102cde180
SHA512 53b2ab4329f63e9f55d8cd5ee81f71c788887f7399b62506b2beeddfe2d5e54f08d37c83a36dbc622a0afabb2809b1a7becba218c31d64b5dbbcae852bcccf32
TLSH
T1DD215C574A0AE4B5CD6287B358CC8A2773B6A7CF5354D026B38AE05A491513F133D17D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 775a32c18c2da943e9b911135b33bba1f4fe9c62f431ed3c45f8300e8073e1a2
MD5 d88de961915790226915805ba58ea721
SHA1 e94921276d17e43223e8c093de956646d041542e
SHA512 6da4b156cfb16a399726c7580ea17dac50818f16905e3181381338210d96a78270acf944407cc6fcc9a717768d7f0fb41a17663161f1f008afa997263a05c49c
TLSH
T1F471F1506BE5214AE1E28533F8776F05AF31B846B70DC31E068D520A0C65D00B9BB76B
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 43d021664f02ed8c497a1b2b4f2d326d65d7316a777e4813834097e7dc0f91bf
MD5 b72cb93943bbf4f7346b858d7ff86e3e
SHA1 ca746aed6b6f2f0a42ffbc37ba090b72ddb3faa2
SHA512 787c8ec36fde1845f20b62707fd87226b1f263364d47b637dc681015c23f72afef970e5a4a18ec3582312216bd23e0ba1e37d7b1e0be4131482e79ec655cb558
TLSH
T1FE31EF506BD5224AE0E38433FC376F056B71F846A70DC71A168D520A0C65D047A7BBBB
MD5 SHA1 SHA512 TLSH

Submit Download

NickName Changer.lnk

Path C:\Users\Admin\Desktop\NickName Changer.lnk
Size 745B
SHA256 a09e7994c0254d08ae01325b729053d81a57c38d66873337856cc4190a3de4f4
MD5 6803c25a1a85effa92a158d05be61198
SHA1 fe909fa3a0243e877d00ddacfd220db423c5c48f
SHA512 d4566579fa645e209fa78c2ea1740bf8fbbd0a4c277bfde066849686ff38fdffc7178d288434c3ca283efd8cbefed173ab5f505503818ba10002d02b37188932
TLSH
T1DA0134148FD91629F3FACBB2167A1B589B21BCE7D67EC38C0488904E30366009B49F33
MD5 SHA1 SHA512 TLSH

Submit Download

Ultra Street Fighter 4.lnk

Path C:\Users\Admin\Desktop\Ultra Street Fighter 4.lnk
Size 759B
SHA256 7c814901929513331d13f8f91e4cfe76c8f71191e413d85074235901f6e91cf8
MD5 17123258254d975f12844486ff4d201b
SHA1 b785124f35f3af53f1bd3abf53fb7e3954982452
SHA512 10a2649638d0a77db58ed6f4bfa63ced48f97ece869f35a274a63856d5703c00e8ee8b418d31b5f6eaa9ff665fe460f3914af364bc81f3996e34916dc18c912a
TLSH
T149015E144FD92668F3FACBB1067E175047527D9B967DC34C0488D28E70396009A15F32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1764-110-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/2164-182-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-188-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-203-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-202-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-200-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-201-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-199-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-198-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-195-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-197-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-196-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-193-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-194-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-192-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-191-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-190-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-189-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-187-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-185-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-184-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-146-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-183-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-148-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-181-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-151-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-152-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-154-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-155-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-156-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-158-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-157-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-161-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-160-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-162-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-164-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-163-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-166-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-168-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-167-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-169-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-170-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-172-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-174-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/2164-173-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-176-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-175-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-178-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-179-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2164-180-0x00000000080D0000-0x00000000080E0000-memory.dmp

Download

memory/3612-8-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/3612-50-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/3612-18-0x0000000003D60000-0x0000000003DD7000-memory.dmp

Download

memory/3612-31-0x0000000006D00000-0x0000000006D10000-memory.dmp

Download

memory/3612-40-0x0000000006E50000-0x0000000006E5F000-memory.dmp

Download

memory/3612-45-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/3612-76-0x0000000003D60000-0x0000000003DD7000-memory.dmp

Download

memory/3612-49-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/3612-13-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/3612-59-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/3612-111-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/3612-75-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/3612-78-0x0000000006E50000-0x0000000006E5F000-memory.dmp

Download

memory/3612-55-0x0000000006E50000-0x0000000006E5F000-memory.dmp

Download

memory/3612-54-0x0000000006D00000-0x0000000006D10000-memory.dmp

Download

memory/3612-53-0x0000000003D60000-0x0000000003DD7000-memory.dmp

Download

memory/3612-56-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/3612-57-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/5468-92-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/5468-109-0x0000000000400000-0x0000000000604000-memory.dmp

Download

memory/5824-0-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5824-51-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5824-112-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5824-2-0x000000000041E000-0x000000000041F000-memory.dmp

Download