fd4878aa365ee905fe6b71847a39a9ef9025018fe5508fdd1123f63d0daff1e4

Analysis

user interaction
yes
max time kernel
134s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_hacknet_5.069_(15083).exe
Size 258.7MB
Sample260907-pdt67agg46
SHA256 fd4878aa365ee905fe6b71847a39a9ef9025018fe5508fdd1123f63d0daff1e4
MD5 f940ba06b6a9b3e3f07846f71d0f8d09
SHA1 36cbd4da3168c96df1cc3fc3b549d5e2ee9f4de0
SHA512 5b0a4bf597109d51162807e727590fd8bc7ade390df7501025b2063ae12d95f36fdfa8863c164130243525fc0011fe9c39cf618ebb16242ab6d46c52c6c01cd0
SSDEEP 6291456:iquF0Tz4TDiJu+epS/bPVgtEkqtLYC22uN/oHu4QHYkGxC:huF448uNpSmtEkL2uNACHYkG
TLSH
T122D83380D88B5CD8E26D32F44897E3495EED0C7EC3C8D9874AE6B44C667C92129BF54B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4424	setup_hacknet_5.069_(15083).tmp

Loads dropped DLL 5 IoCs

pid	Process
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_hacknet_5.069_(15083).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_hacknet_5.069_(15083).tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral4/memory/5780-0-0x0000000000400000-0x0000000000437000-memory.dmp	innosetup
behavioral4/memory/5780-133-0x0000000000400000-0x0000000000437000-memory.dmp	innosetup

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	setup_hacknet_5.069_(15083).tmp

Modifies registry class 41 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	setup_hacknet_5.069_(15083).tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	setup_hacknet_5.069_(15083).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	setup_hacknet_5.069_(15083).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	setup_hacknet_5.069_(15083).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	setup_hacknet_5.069_(15083).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	setup_hacknet_5.069_(15083).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	setup_hacknet_5.069_(15083).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	setup_hacknet_5.069_(15083).tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	setup_hacknet_5.069_(15083).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	setup_hacknet_5.069_(15083).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	setup_hacknet_5.069_(15083).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	setup_hacknet_5.069_(15083).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	setup_hacknet_5.069_(15083).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	setup_hacknet_5.069_(15083).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	setup_hacknet_5.069_(15083).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	setup_hacknet_5.069_(15083).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	setup_hacknet_5.069_(15083).tmp
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	setup_hacknet_5.069_(15083).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	setup_hacknet_5.069_(15083).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	setup_hacknet_5.069_(15083).tmp

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp
4424	setup_hacknet_5.069_(15083).tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 4424	5780	setup_hacknet_5.069_(15083).exe	89

C:\Users\Admin\AppData\Local\Temp\setup_hacknet_5.069_(15083).exe
"C:\Users\Admin\AppData\Local\Temp\setup_hacknet_5.069_(15083).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\is-F7RPH.tmp\setup_hacknet_5.069_(15083).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-F7RPH.tmp\setup_hacknet_5.069_(15083).tmp" /SL5="$50266,270643175,185856,C:\Users\Admin\AppData\Local\Temp\setup_hacknet_5.069_(15083).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1207666123_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\1207666123_english.jpg
Size 227KB
SHA256 4300bf3e338f1e7b2de6a45bbc5de3ef7f39777a0ca43ef1fde14e61738058de
MD5 1a677c716fe1500c5d9e0307d5ad1943
SHA1 e1732c60fc274bf698b281f09073d6a101c1efea
SHA512 38d1841a165fb7b6164eea7075c498a0db93ce239a0bef032892d6fef87ce3ce8cdff1a964c8b115704119c5f24b83ac5ef20b0749bcd28ddb03cb5b1404e20d
SSDEEP 6144:NMt8Kgiem0l19En/LDmLrpCM284ujOisB7rdZC:S2Kg9r9EneLNFTLjkddZC
TLSH
T18234132B5777E31205B387EA10FB4D43412F6F65C6A5406E42418BAF7DE48BBAEE080D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1453126104_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\1453126104_english.jpg
Size 261KB
SHA256 bd77f69e17504c61797f935d48d4bdc52910dcf7595089566e583a33bd203159
MD5 4f4b7b749d1aa774ef125dbde1dc5df5
SHA1 3ff36106dd475260cf5d140b0f508abd073425b1
SHA512 1a59b3db4f728974c7342d7a2b0f37fb6a24a0061159b02134a493367205c9786f323acc37b09ed01fcb5dd8fc07f6d6ea8427a2b5a78ca77522199064fae429
SSDEEP 6144:pmYPh4aWeDw+3KOF4L1p3O1BgWEfMO2DQZHBzzX82Eu:BbWekkKqg1pe1Gbf085BXX8Q
TLSH
T15C441269F4E50BD3CA7D0AD5D4DC51E2BFC1ABA5E8198ED3CA940FB03A69043019CB6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BigOK.png

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\BigOK.png
Size 3KB
SHA256 59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a
MD5 5b43a5d975a53f4fc1da67ce9f7784c1
SHA1 8543fa1e471030049942252b23cb22e0880c3af5
SHA512 5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5
TLSH
T17B614DD1323C683EC7F40B2CA1881A5EC1AB1340654B66A852CF64580798A79B77A777
MD5 SHA1 SHA512 TLSH

Submit Download

EULAAccepted.png

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\EULAAccepted.png
Size 2KB
SHA256 0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c
MD5 461dfeb75927bdb39f9db5348612a611
SHA1 b7893b1fff6801e37ee7337d876962a09184941e
SHA512 68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b
TLSH
T1BC512BEFF5921C02C255B8E918E9A6939EE5C9C58DD1542578CFC08B14794B4006A2CF
MD5 SHA1 SHA512 TLSH

Submit Download

EULAShow.png

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\EULAShow.png
Size 1KB
SHA256 6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462
MD5 c596bc9111edc702bbbb29b70984254f
SHA1 d4712c7b91ff4f8994e7907d31357c42eb47c738
SHA512 db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a
TLSH
T19C31B5C9F640B801C245ECD028E9A4328D7E9D805AE1BDA9F8CFE4C745365F8142C1CB
MD5 SHA1 SHA512 TLSH

Submit Download

background.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\background.jpg
Size 346KB
SHA256 fa0f941f7e0a9fb7e13f3c817839adc1e21bfb2d73793fc6b83295b49a645bec
MD5 cfb2bab626b30c725b57fcf6d4795a8e
SHA1 af796b1141937cb80e0c4a9af2d05b89387834b3
SHA512 5d9a387f0b38bde6b166cc86e6f590b3045bb89ceeb4e5ce47cb1a00579314790a4d7aa72d70ce741aa58c12cb11147352bb1766d9077302ac8994091f9c62f1
SSDEEP 6144:80LQsfl8u6e9cMFj/cowIKj4mulwVvZJi3fU/y89ShHwULmQ7Ed2JTIgGwPC:HFmemMV/c9IM4VaZI3uy89SLT7EdGhGX
TLSH
T1DB740217CD41165A999C03B8BE03CDAF3A111F5C6CD566B98220CEDF9A7910F4EEE18E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
TLSH
T180F26B51D9A1C031C085DEBD6D31E21A936F3A201FD64B691A6E5ACCEE4FF03952C2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btn_md5.png

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\btn_md5.png
Size 8KB
SHA256 b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47
MD5 3befe9739354ee24a0b1ea8df05ce274
SHA1 ab0bda986a8c46aa19f57b75a2b7b22445a3c625
SHA512 ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd
SSDEEP 192:+CgAPOTLq6/bkYNuQJA6hcxuGcjMTch2kmBm/5o:+IPOTLq6oAANOjTh2kmE/S
TLSH
T119029FD4E3E5CD10C688BB8B1DCA8526E80C1593E7A6C7C2F536E4029A3327826D97C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crcdll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\crcdll.dll
Size 69KB
SHA256 23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec
MD5 1d51fac9e2384eeb674199cfd5281d7d
SHA1 861dfdc121357d605d0cc3793266713788109eb2
SHA512 921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda
SSDEEP 768:tCrczqrdE7n1KuGUlKTs3RLflC7ZWL/sebzx7jMKkkg8dODMh1MK/N58n:tCrczqJ8U5s3R7lYZWbzx7jPgRE5
TLSH
T1EC637C207951D176C08A6835551AC3B11A7DB8322AF9C983BF971B7E9F203D1F63B34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error.png

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\error.png
Size 726B
SHA256 142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b
MD5 df10adc25b673e74e19971c17bee5a98
SHA1 ee16fb1cf9491f5e611282f0574b27d76fede412
SHA512 dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f
TLSH
T11401946FF800FAA8AD7A1DDA97752550C4FE877D66A200D0B4D2C44831822680F17789
MD5 SHA1 SHA512 TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ok.png

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\ok.png
Size 1KB
SHA256 0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e
MD5 103c1368e60806b1b7995a0894eacf87
SHA1 971392527f6e4b655044773132505c901a6b5469
SHA512 652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a
TLSH
T10A21B7FC167568EA76B543B9428B0D65C9BAEE2D640D730AB076CCB45C43491C6DCF60
MD5 SHA1 SHA512 TLSH

Submit Download

slideshow.ini

Path C:\Users\Admin\AppData\Local\Temp\is-C3P0T.tmp\slideshow.ini
Size 272B
SHA256 95d160e446e7675ae48fefd3eafd509c18d141870c6a09785771549011c81b9b
MD5 a83580e6a67f4c467a6cea10c6208432
SHA1 84fe8700c85f986208e106d075060d6f0464f397
SHA512 67434c9e4e2ef7e6285f198167e180d3b2985cbd833485829174dd9eafd0664c88ee5ed9fc39be1f4d64dc02ff196cf3d44676696ade6ce36c8c9855028f5dff
TLSH
T135D02B8C120F3089FEE4DB32B2A1A1C07ED135A051D1F0A0F3C2450A1491017BC1F56E
MD5 SHA1 SHA512 TLSH

Submit Download

setup_hacknet_5.069_(15083).tmp

Path C:\Users\Admin\AppData\Local\Temp\is-F7RPH.tmp\setup_hacknet_5.069_(15083).tmp
Size 1.2MB
SHA256 1ee1f17e60e6c39ca0b84f73b962961a96ce837c6690f0b8961a38f78479467e
MD5 137207137f47ce259cca65e7d991aeaa
SHA1 ac38b22771006fa852d5ed21c0ed1fa90f5ce7db
SHA512 73b186c423b5bd9d52f2fc99111584c15bd146fa7849a344838141c5bd1ec2c5ec730c8482f1a090f029932601aea8174505cb558d57b09ae63419990e9e37ca
SSDEEP 24576:/68QxqJVXFmK5u99HOENBLyO9ZKaveoGXCrIIEXsa5p8a1OP1rt1NCSTx9V:ivlHHjLDFI9zp+Pg0
TLSH
T1DE455B22A3D14437D4732F755D6BC2946C367E202EA4D88A7EF99E0C1E39B90BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gog_eula.txt

Path C:\Users\Admin\Documents\gog_eula.txt
Size 44KB
SHA256 84fdb60388616d87d7c39b6bfd0a333ae8b1d0fe9fe87b4e1f35f1bf9d864107
MD5 b7a505c5dea33d82df106d9c46fa6b0a
SHA1 e3e04a410a3143adc41e933ed836fb3e3a4e33ce
SHA512 011b5ce354b259230fab0aa1fb0167c1c52075885f05daed1f4440b553c0bae3fdce3d020e87bdd8a26975952284ec0910c2f1263e28d2c10ace3fdd3a32b190
SSDEEP 768:oCw3tVVQwf0NtFN+ZmrHKr0iKfG16WI0yXqIeV4XmmlEn:oqjdr2hWvXmmlEn
TLSH
T1F223EB6FE34A137115E203623A067AD6F72E807A7356999034BC816C27F6F5C837B6E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4424-141-0x0000000003550000-0x000000000355E000-memory.dmp

Download

memory/4424-6-0x0000000002320000-0x0000000002321000-memory.dmp

Download

memory/4424-12-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-191-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-137-0x0000000002320000-0x0000000002321000-memory.dmp

Download

memory/4424-136-0x0000000003550000-0x000000000355E000-memory.dmp

Download

memory/4424-135-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-134-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-140-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-190-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-139-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-145-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-144-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-149-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-150-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-154-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-153-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-160-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-159-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-164-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-163-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-168-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-169-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-172-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-173-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-57-0x0000000003550000-0x000000000355E000-memory.dmp

Download

memory/4424-177-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-178-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-181-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-182-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/4424-186-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4424-187-0x00000000034D0000-0x00000000034E5000-memory.dmp

Download

memory/5780-0-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/5780-133-0x0000000000400000-0x0000000000437000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads