edcee4944a48003adaf274ed6dae061496c3c44a3a75184df87fd63e93e223d3

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 09:11

Target
HD2CheatMenu_2.6.6.0.rar
Size 1.4MB
Sample260925-k5tbracg79
SHA256 edcee4944a48003adaf274ed6dae061496c3c44a3a75184df87fd63e93e223d3
MD5 2658c08232acb781f57ac6bcc77ec8af
SHA1 d7eeb4d367f5c7d1af9833bcb72ccf9ab3964382
SHA512 95fa7cc8a3fc8eb49d71ad38499a6b4e0d753bcbf93da75d90a45c345950ec49f1ba5b99b2f02669932cc9e8002bf511a1a2a73ad7812315f6dc5db3ec44034c
SSDEEP 24576:ui0BS9b2nfgnBFAe9sWFxqUyCRWuJoYBD+ChcAlGts6+xUWYoXms4fD5V5V:ucbkfgjoqoUjar2GtsFxUZ+JEt
TLSH
T1766502DEE77D1E97F67349D0A66612866B013ABBF5DADA3C020D9B4D7804F308211F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
972	GGBypass.exe
1676	GGBypass.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4948	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 972	4948	7zFM.exe	99
PID 4948 wrote to memory of 1676	4948	7zFM.exe	108

GGBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO453A60C8\GGBypass.exe
Size 429KB
SHA256 161a77096d5cff88350467525a6011ee98fce856eac8d2ae96a8497ce5353657
MD5 be372fa2480788653768cdbd13a983bd
SHA1 f0240826fc59feeed977393d7267be45dc97a331
SHA512 992c202c8d434f6af8fc3cb1d975aab30b8d29cff1313de84b3904ec312e7998128cce7547b0bf58dcd494e012222a6b3fcdccd1e26c36d7148cbf87ee966850
SSDEEP 12288:gLoLzfm/BMHqMUcpw0Iph0lhSMXliCZY:FjYcKTh0lhSMXl1
TLSH
T142949D12F7A480FDE1678675C8970A06E7727C890751DADF036C99A26F236D25E3EF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download