Overview
overview
7Static
static
3Balatro.v1.0.1o.zip
windows10-2004-x64
1Balatro.v1.0.1o.zip
windows11-ltsc_2024-x64
1Balatro.v1...PC.url
windows10-2004-x64
1Balatro.v1...PC.url
windows11-ltsc_2024-x64
1Balatro.v1...up.exe
windows10-2004-x64
7Balatro.v1...up.exe
windows11-ltsc_2024-x64
7Balatro.v1...up.exe
windows10-2004-x64
7Balatro.v1...up.exe
windows11-ltsc_2024-x64
7Balatro.v1...st.exe
windows10-2004-x64
6Balatro.v1...st.exe
windows11-ltsc_2024-x64
6Balatro.v1...64.exe
windows10-2004-x64
4Balatro.v1...64.exe
windows11-ltsc_2024-x64
4Balatro.v1...86.exe
windows10-2004-x64
4Balatro.v1...86.exe
windows11-ltsc_2024-x64
4Balatro.v1...64.exe
windows10-2004-x64
7Balatro.v1...64.exe
windows11-ltsc_2024-x64
7Balatro.v1...86.exe
windows10-2004-x64
7Balatro.v1...86.exe
windows11-ltsc_2024-x64
7Balatro.v1...st.msi
windows10-2004-x64
7Balatro.v1...st.msi
windows11-ltsc_2024-x64
7Balatro.v1...ro.exe
windows10-2004-x64
1Balatro.v1...ro.exe
windows11-ltsc_2024-x64
1Balatro.v1...32.dll
windows10-2004-x64
1Balatro.v1...32.dll
windows11-ltsc_2024-x64
1Balatro.v1...L2.dll
windows10-2004-x64
1Balatro.v1...L2.dll
windows11-ltsc_2024-x64
1Balatro.v1...ps.dll
windows10-2004-x64
1Balatro.v1...ps.dll
windows11-ltsc_2024-x64
1Balatro.v1...ve.dll
windows10-2004-x64
1Balatro.v1...ve.dll
windows11-ltsc_2024-x64
1Balatro.v1...51.dll
windows10-2004-x64
1Balatro.v1...51.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/09/2026, 06:18
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Balatro.v1.0.1o.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Balatro.v1.0.1o.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Balatro.v1.0.1o/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Balatro.v1.0.1o/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Balatro.v1.0.1o/_Redist/dotNetFx40_Full_setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
Balatro.v1.0.1o/_Redist/dotNetFx40_Full_setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
Balatro.v1.0.1o/_Redist/dxwebsetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
Balatro.v1.0.1o/_Redist/dxwebsetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
Balatro.v1.0.1o/_Redist/oalinst.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
Balatro.v1.0.1o/_Redist/oalinst.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
Balatro.v1.0.1o/_Redist/vcredist_2015-2019_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
Balatro.v1.0.1o/_Redist/vcredist_2015-2019_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
Balatro.v1.0.1o/_Redist/vcredist_2015-2019_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
Balatro.v1.0.1o/_Redist/vcredist_2015-2019_x86.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
Balatro.v1.0.1o/_Redist/vcredist_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral16
Sample
Balatro.v1.0.1o/_Redist/vcredist_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral17
Sample
Balatro.v1.0.1o/_Redist/vcredist_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral18
Sample
Balatro.v1.0.1o/_Redist/vcredist_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
Balatro.v1.0.1o/_Redist/xnafx40_redist.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral20
Sample
Balatro.v1.0.1o/_Redist/xnafx40_redist.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral21
Sample
Balatro.v1.0.1o/game/Balatro.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
Balatro.v1.0.1o/game/Balatro.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
Balatro.v1.0.1o/game/OpenAL32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Balatro.v1.0.1o/game/OpenAL32.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Balatro.v1.0.1o/game/SDL2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Balatro.v1.0.1o/game/SDL2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Balatro.v1.0.1o/game/https.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Balatro.v1.0.1o/game/https.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Balatro.v1.0.1o/game/love.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Balatro.v1.0.1o/game/love.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Balatro.v1.0.1o/game/lua51.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Balatro.v1.0.1o/game/lua51.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Balatro.v1.0.1o/_Redist/vcredist_x86.exe
- Size 4.8MB
- Sample260909-g2we6ack5v
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4748 Setup.exe - Loads dropped DLL 5 IoCs
pid Process 4748 Setup.exe 4748 Setup.exe 4748 Setup.exe 4748 Setup.exe 4748 Setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Setup.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Setup.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy Setup.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Setup.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Setup.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Setup.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Setup.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Setup.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Setup.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4748 Setup.exe 4748 Setup.exe 4748 Setup.exe 4748 Setup.exe 4748 Setup.exe 4748 Setup.exe 4748 Setup.exe 4748 Setup.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4748 Setup.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3312 wrote to memory of 4748 3312 vcredist_x86.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Balatro.v1.0.1o\_Redist\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\Balatro.v1.0.1o\_Redist\vcredist_x86.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\ece3c2228547c06e369465eb27\Setup.exec:\ece3c2228547c06e369465eb27\Setup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4748
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\HFI652E.tmp.html
- Size 18KB
- SHA256 3b6c8daa0298376ddd4698c46d75599e60187d285c2c0c0afe23e13326d27245
- MD5 dd60f13020111c6572cf2cada43b4267
- SHA1 2e3f85a6eb645955416094592c4719be3e6b1a59
- SHA512 1d25ede0b1ec1674d5184f778d527417fbdc640700d09bafc2d3aed8e6b712097013cf4c3e516a1c7949f7b919db05651316590ca86d808a1528f832fb5df1c5
- SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjihFR:fdsOT01KcBUFJFEWUxFzvH+TR
- TLSH T17282585327E84244A1B6BF49ABB600750B79BD45AC3CCE7D12A0591E49E3E14F872FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ece3c2228547c06e369465eb27\Setup.exe
- Size 76KB
- SHA256 d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be
- MD5 006f8a615020a4a17f5e63801485df46
- SHA1 78c82a80ebf9c8bf0c996dd8bc26087679f77fea
- SHA512 c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76
- SSDEEP 1536:sYNItbBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUq:sYNAB9NWTZctc/gBJ9oq
- TLSH T141737E027294C035D859163409BBDAB25E7E7D829BB048CB339877EF5F713C26A39356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\1028\LocalizedData.xml
- Size 29KB
- SHA256 a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a
- MD5 7fc06a77d9aafca9fb19fafa0f919100
- SHA1 e565740e7d582cd73f8d3b12de2f4579ff18bb41
- SHA512 466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf
- SSDEEP 384:4Y6C7xfsxMEYgPNRAsy50keJzH7o3oDPnv:MxLJz7
- TLSH T110D2A112AEEB3114F0BAAE19BD3314944EF779905C35C01E10992E4E9BB7FC28965F93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\1031\LocalizedData.xml
- Size 40KB
- SHA256 2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6
- MD5 b83c3803712e61811c438f6e98790369
- SHA1 61a0bc59388786ced045acd82621bee8578cae5a
- SHA512 e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38
- SSDEEP 384:4nF+jpoHnZi8oO0GOJ2+8q6OUjEYJL/ZiITrKv:V03XjZJL/YIy
- TLSH T122139B11AFEA2214F1F6BF59BD7611944EB37E91AC35C40D01992D8E8AB3F81C921F63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\1033\LocalizedData.xml
- Size 38KB
- SHA256 5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9
- MD5 d642e322d1e8b739510ca540f8e779f9
- SHA1 36279c76d9f34c09ebddc84fd33fcc7d4b9a896c
- SHA512 e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d
- SSDEEP 192:4kVKhG9aX0SDpI53/asO0KMv+VXxwVcPIv5COQu4SLbpmQVX5FB0zJOkue6Jjfz3:4MKhJkeZsdlNl9SJOkR6NXaxu
- TLSH T196036602AEFE2154F1BBBE19BD7210954EB7BD915C39C11D00992D8E8AB3F81CD61B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\1033\SetupResources.dll
- Size 16KB
- SHA256 36d0159ed1a7d88000737e920375868765c0a1dd6f5a5acbb79cf7d97d9e7a34
- MD5 9547d24ac04b4d0d1dbf84f74f54faf7
- SHA1 71af6001c931c3de7c98ddc337d89ab133fe48bb
- SHA512 8b6048f4185a711567679e2de4789407077ce5bfe72102d3cb1f23051b8d3e6bfd5886c801d85b4e62f467dd12da1c79026a4bc20b17f54c693b2f24e499d40f
- SSDEEP 192:byk5nUfwTW7JwWp0eW6jp8M+9HS8bC/TJs7kFkzQKPnEtObMacxc8hjeyveCXZBe:pgoTWp0eWB9ygC/TfFkzLXci2jpv8
- TLSH T17272308167FC8105F6F73F74AEB58AB21E39BD825938C71E2581A19D08A1F80DD74B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\1036\LocalizedData.xml
- Size 40KB
- SHA256 43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf
- MD5 e382abc19294f779d2833287242e7bc6
- SHA1 1ceae32d6b24a3832f9244f5791382865b668a72
- SHA512 06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e
- SSDEEP 192:4GrYAOJoFbZZ0eQiFaD4EbJeiI5hJUPu2oBknXoFDYnZCoroUnAJJFHq20/kFR/0:4GZUoRZc5ryx2fHIJR0kbG52gjfVv
- TLSH T193137711ABEA2214F2FABF05BD7610944EBB7D919C35C01D01992D8E8EB3F85C971B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\1040\LocalizedData.xml
- Size 39KB
- SHA256 c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248
- MD5 0af948fe4142e34092f9dd47a4b8c275
- SHA1 b3d6dd5c126280398d9055f90e2c2c26dbae4eaa
- SHA512 d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9
- SSDEEP 384:4hZo3+Ma9e1JzNZNs4fneAEJ0o5H/PuRv:NaudsJ1u
- TLSH T1D6035811AFFA2214F1F7BE09BD3615984EB77E919C35C01D01992D8E8AB3F818961F63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\1041\LocalizedData.xml
- Size 33KB
- SHA256 01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2
- MD5 7fcfbc308b0c42dcbd8365ba62bada05
- SHA1 18a0f0e89b36818c94de0ad795cc593d0e3e29a9
- SHA512 cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649
- SSDEEP 192:4OTOo45ZyAYcou3LDnmUjMFsrHZmxqJOXhNCGYHre3iR7v:4OTOoMhYcRaOXJ6koIv
- TLSH T12BF2D101AEEB3114F0FAAE55BD7310944EF7B9909C35C01D00996D4E9AB7FC58A26FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\1042\LocalizedData.xml
- Size 32KB
- SHA256 cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331
- MD5 71dfd70ae141f1d5c1366cb661b354b2
- SHA1 c4b22590e6f6dd5d39e5158b831ae217ce17a776
- SHA512 5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a
- SSDEEP 192:4cdsW0fwUrh+UgYUDQhGAtPN/2JWCTJSIQvPaLWL2C4oH/Drv:4cdszvrBgYUDQhF5N7IJSIQvkQfLH/Pv
- TLSH T1D6E2A212AEEB3154B0BAAE15BD7314944EF779909C36C01E10992D8E9BB7FC1C921F93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\1049\LocalizedData.xml
- Size 39KB
- SHA256 beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c
- MD5 0eeb554d0b9f9fcdb22401e2532e9cd0
- SHA1 08799520b72a1ef92ac5b94a33509d1eddf6caf8
- SHA512 2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d
- SSDEEP 384:4q0oG/2VrQa0inweNLvSli+CJA3aJW5cGUT3CT+v:DVFJl
- TLSH T19F03D40BFEFA7114B0B6EA55AE3304D109B77A501E35C08D109F2D5D9AA7FB19A21F83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\2052\LocalizedData.xml
- Size 30KB
- SHA256 d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3
- MD5 52b1dc12ce4153aa759fb3bbe04d01fc
- SHA1 bf21f8591c473d1fce68a9faf1e5942f486f6eba
- SHA512 418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623
- SSDEEP 192:4Qn7cJwYTzOnyquEWTOAXUewfMcqQJywXk83GJPupIoxnb/2v:4Qn7cJxTC/uEWTfXUewiQJyoknJY9b+v
- TLSH T1ABE29C12AEEB3114F1BAAE15BD7314944EB779905C35C01E10992E8E9BB7FC28971F83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\3082\LocalizedData.xml
- Size 39KB
- SHA256 f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89
- MD5 5397a12d466d55d566b4209e0e4f92d3
- SHA1 fcffd8961fb487995543fc173521fdf5df6e243b
- SHA512 7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b
- SSDEEP 384:4fgA4Ukd+uYW1HCD1GO/tja2QDu7Jr++dP8z3AzOrv:tUZW1iDDdWCJi8Pg32Y
- TLSH T106032811AEEA2214F1F7BF09BD7614944EB7BD919C39C00D01592E8E8AB3F85C961F63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\DHTMLHeader.html
- Size 15KB
- SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
- MD5 cd131d41791a543cc6f6ed1ea5bd257c
- SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
- SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
- SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
- TLSH T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\ParameterInfo.xml
- Size 8KB
- SHA256 bf787b8c697ce418f9d4c07260f56d1145ca70db1cc4b1321d37840837621e8f
- MD5 66590f13f4c9ba563a9180bdf25a5b80
- SHA1 d6d9146faeec7824b8a09dd6978e5921cc151906
- SHA512 aba67c66c2f3d9b3c9d71d64511895f15f696be8be0eedd2d6908e1203c4b0cf318b366f9f3cd9c3b3b8c0770462f83e6eea73e304c43f88d0cbedf69e7c92b3
- SSDEEP 192:gCwdBdVv3CL021BqG2ahBCw2G2X2BCEj2G2KQ6G2nCw+KFl:kRPGiGPKGPGYCrKFl
- TLSH T19D02788367FE1010B1B61B5CAAB640664E673D511D3DC46D11AC294ECBE3E82D8B2BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\SetupEngine.dll
- Size 788KB
- SHA256 7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd
- MD5 84c1daf5f30ff99895ecab3a55354bcf
- SHA1 7e25ba36bcc7deed89f3c9568016ddb3156c9c5a
- SHA512 e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3
- SSDEEP 24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJj:GS62nlYAltBjPNJIkHST18QsBJ
- TLSH T188053A2267E88135E2FF1372753A676957BAF9A14B30C9CF12815B9E0E356D09C3CB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\SetupUi.dll
- Size 288KB
- SHA256 11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7
- MD5 eb881e3dddc84b20bd92abcec444455f
- SHA1 e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1
- SHA512 5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75
- SSDEEP 3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionv5y/y:HOoMFrz8ygAKWiiIyKf73w
- TLSH T1575439327BE8C574C4EF1374755EA26841AAF1E21BF0C0CB2B451BAE8E336D15D34A96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\SetupUi.xsd
- Size 29KB
- SHA256 222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
- MD5 2fadd9e618eff8175f2a6e8b95c0cacc
- SHA1 9ab1710a217d15b192188b19467932d947b0a4f8
- SHA512 a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca
- SSDEEP 768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
- TLSH T1B6D227C631D1CA0007374831AD223B0DFEE5A57382D83D61B5DCA637BB76AC62967279
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\Strings.xml
- Size 13KB
- SHA256 e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca
- MD5 332adf643747297b9bfa9527eaefe084
- SHA1 670f933d778eca39938a515a39106551185205e9
- SHA512 bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0
- SSDEEP 384:VAZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VAB
- TLSH T12B52934376FB2018B1B23ACA6FFBC1B4CF6675D00976462F0159204B87D7C1B6AA2776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\UiInfo.xml
- Size 35KB
- SHA256 0d36a884a8381778bea71f5f9f0fc60cacadebd3f814679cb13414b8e7dbc283
- MD5 812f8d2e53f076366fa3a214bb4cf558
- SHA1 35ae734cfb99bb139906b5f4e8efbf950762f6f0
- SHA512 1dcc3ef8c390ca49fbcd50c02accd8cc5700db3594428e2129f79feb81e4cbbeef1b4a10628b2cd66edf31a69ed39ca2f4e252ad8aa13d2f793fca5b9a1eaf23
- SSDEEP 768:S4UR0d5v0SguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjT5fuPkfuS:S4UR0d5v0QYQLIN/6Fmhvk71sO0Nep3q
- TLSH T1ECF216535BEB0118E2F6AA4D69B304705F5B7A45093AD13C04EC354DEFE7E628CA07AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\graphics\print.ico
- Size 1KB
- SHA256 ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
- MD5 7e55ddc6d611176e697d01c90a1212cf
- SHA1 e2620da05b8e4e2360da579a7be32c1b225deb1b
- SHA512 283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e
- TLSH T1CF21CC8173E10968D9898771135997616F8AFE00C1100B9330E3BA0BBC3E3B79453246
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\graphics\save.ico
- Size 1KB
- SHA256 ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
- MD5 7d62e82d960a938c98da02b1d5201bd5
- SHA1 194e96b0440bf8631887e5e9d3cc485f8e90fbf5
- SHA512 ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67
- TLSH T1F521EF7A71902420D0AA08794693C56516C5FEAAC824089672D93AFF6DF9C523023786
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\graphics\setup.ico
- Size 35KB
- SHA256 288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
- MD5 3d25d679e0ff0b8c94273dcd8b07049d
- SHA1 a517fc5e96bc68a02a44093673ee7e076ad57308
- SHA512 3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255
- SSDEEP 384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
- TLSH T1BCF28D89B250D9E4C89C11318C67CEF61F947D1AED840A4733EABF5F2FB23923125894
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\graphics\stop.ico
- Size 9KB
- SHA256 b499e1b21091b539d4906e45b6fdf490d5445256b72871aece2f5b2562c11793
- MD5 5dfa8d3abcf4962d9ec41cfc7c0f75e3
- SHA1 4196b0878c6c66b6fa260ab765a0e79f7aec0d24
- SHA512 69a13d4348384f134ba93c9a846c6760b342e3a7a2e9df9c7062088105ac0b77b8a524f179efb1724c0ce168e01ba8bb46f2d6fae39cabe32cab9a34fc293e4a
- SSDEEP 96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLt:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYR
- TLSH T1BE222BC2B30B61D7C41D0A31490B2FB40A294CB56A91DB6B52BD3B6FBDB13E36503479
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ece3c2228547c06e369465eb27\sqmapi.dll
- Size 141KB
- SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
- MD5 3f0363b40376047eff6a9b97d633b750
- SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
- SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
- SSDEEP 3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
- TLSH T1BAE34C18F7B695F2C56322300E0E72BAEB7DD92C3E99BE872380F6567430580D729756
- MD5 SHA1 SHA512 SSDEEP TLSH