Analysis
- user interaction
yes - max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/10/2026, 04:26
Behavioral task
behavioral1
Sample
ScriptPlayer-Debug-1.2.3.463.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target ScriptPlayer-Debug-1.2.3.463.exe
- Size 4.1MB
- Sample261011-e2vshsez81
- SHA256 269cc6f62878987edb0cb7d724ce72e4c7297267a66c36012e2342c66d4dfc0c
- MD5 8e2c43fe09abfdd624c31b8f0be18a20
- SHA1 88193d756809832c1e2f278fa4022cc51d9fb71c
- SHA512 58a8dd227b0ac3b30f54c99bf98dc40d392630deba7a1750411515a3db0e147053c926ca36fd11b90cf353805d264ea5bc6daebc88b839e872c054f5662d5e8d
- SSDEEP 98304:VOBedfNzokzM20qlKkx6nGjrhTjMzAJbuPpzRnmlqLxjX:SolkWW+KM6G/FUSKPzQqLxj
- TLSH T1DF16331373C70072E5259A358A6B8410AD37BA7A09F9709E1FF5E81E1EBE7828D71F44
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4900 ScriptPlayer-Debug-1.2.3.463.tmp 4048 ScriptPlayer.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: ScriptPlayer.exe File opened (read-only) \??\J: ScriptPlayer.exe File opened (read-only) \??\T: ScriptPlayer.exe File opened (read-only) \??\V: ScriptPlayer.exe File opened (read-only) \??\W: ScriptPlayer.exe File opened (read-only) \??\X: ScriptPlayer.exe File opened (read-only) \??\A: ScriptPlayer.exe File opened (read-only) \??\K: ScriptPlayer.exe File opened (read-only) \??\B: ScriptPlayer.exe File opened (read-only) \??\E: ScriptPlayer.exe File opened (read-only) \??\H: ScriptPlayer.exe File opened (read-only) \??\L: ScriptPlayer.exe File opened (read-only) \??\M: ScriptPlayer.exe File opened (read-only) \??\O: ScriptPlayer.exe File opened (read-only) \??\Q: ScriptPlayer.exe File opened (read-only) \??\R: ScriptPlayer.exe File opened (read-only) \??\N: ScriptPlayer.exe File opened (read-only) \??\P: ScriptPlayer.exe File opened (read-only) \??\S: ScriptPlayer.exe File opened (read-only) \??\U: ScriptPlayer.exe File opened (read-only) \??\Y: ScriptPlayer.exe File opened (read-only) \??\Z: ScriptPlayer.exe File opened (read-only) \??\G: ScriptPlayer.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ScriptPlayer\Licenses\is-OIGT9.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\Microsoft.Win32.Registry.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\Octokit.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\Microsoft.WindowsAPICodePack.Shell.dll ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-SPGI3.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\NAudio.Midi.dll ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-EFOGT.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-EALNV.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-LSGLA.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-8VO6N.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\NAudio.WinMM.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.Shared.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\System.Buffers.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\spcli.exe ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-JRBAB.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-32DE7.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-370BF.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\System.Runtime.CompilerServices.Unsafe.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\System.Security.AccessControl.dll ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-0FPG3.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-M5JLV.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-9G12K.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-Q64I0.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-QTHR7.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\NAudio.Wasapi.dll ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-L5DPJ.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-L70HO.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\Licenses\is-SAUA6.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\Licenses\is-CG39M.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\Licenses\is-1QV0T.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\Google.Protobuf.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\NAudio.Asio.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\System.Numerics.Vectors.dll ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-RHF6B.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\Licenses\is-87UGS.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\HtmlAgilityPack.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\MK312WifiLibDotNet.dll ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-J9QG6.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-ETJVF.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-MC1P7.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-SH55O.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\JetBrains.Annotations.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\MediaInfo.Wrapper.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\Microsoft.WindowsAPICodePack.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\NAudio.Core.dll ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\Licenses\is-00EP4.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\Licenses\is-I3UPA.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\Licenses\is-7MLFB.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.HandyApi.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\spcon.exe ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\unins000.dat ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-F94CG.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-T5ERD.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-FQDQ8.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-FIOB8.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\unins000.dat ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-1HAB0.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\Licenses\is-0HTSP.tmp ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.Ipc.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\NAudio.dll ScriptPlayer-Debug-1.2.3.463.tmp File opened for modification C:\Program Files (x86)\ScriptPlayer\Newtonsoft.Json.dll ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-VM55O.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-P2KVB.tmp ScriptPlayer-Debug-1.2.3.463.tmp File created C:\Program Files (x86)\ScriptPlayer\is-TSCR7.tmp ScriptPlayer-Debug-1.2.3.463.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScriptPlayer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScriptPlayer.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScriptPlayer-Debug-1.2.3.463.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScriptPlayer-Debug-1.2.3.463.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/2832-0-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral1/memory/2832-171-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral1/memory/2832-175-0x0000000000400000-0x0000000000428000-memory.dmp innosetup - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ScriptPlayer.exe\AppID = "{6F331F84-6C70-4E9F-AAFF-8527663E68A5}" ScriptPlayer-Debug-1.2.3.463.tmp Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{C8B9B617-754D-49C4-858D-A9132F837DB6} svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6F331F84-6C70-4E9F-AAFF-8527663E68A5} ScriptPlayer-Debug-1.2.3.463.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6F331F84-6C70-4E9F-AAFF-8527663E68A5}\AccessPermission = 010004801400000024000000000000003400000001020000000000052000000020020000010200000000000520000000200200000200880006000000000014000700000001010000000000050a00000000001400030000000101000000000005120000000000180007000000010200000000000520000000200200000000180003000000010200000000000f020000000100000000001400030000000101000000000005130000000000140003000000010100000000000514000000 ScriptPlayer-Debug-1.2.3.463.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ScriptPlayer.exe ScriptPlayer-Debug-1.2.3.463.tmp - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 55 ScriptPlayer/1.2.3 (Win32NT 6.2.9200; amd64; en-US; Octokit 0.51.0+908f9e6d73e4217130558f596b28f5537535d5a3) - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4900 ScriptPlayer-Debug-1.2.3.463.tmp 4900 ScriptPlayer-Debug-1.2.3.463.tmp - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 4048 ScriptPlayer.exe Token: SeCreatePagefilePrivilege 4048 ScriptPlayer.exe Token: SeShutdownPrivilege 4048 ScriptPlayer.exe Token: SeCreatePagefilePrivilege 4048 ScriptPlayer.exe Token: SeDebugPrivilege 4048 ScriptPlayer.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4900 ScriptPlayer-Debug-1.2.3.463.tmp 4048 ScriptPlayer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4048 ScriptPlayer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2832 wrote to memory of 4900 2832 ScriptPlayer-Debug-1.2.3.463.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScriptPlayer-Debug-1.2.3.463.exe"C:\Users\Admin\AppData\Local\Temp\ScriptPlayer-Debug-1.2.3.463.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\is-RIFSL.tmp\ScriptPlayer-Debug-1.2.3.463.tmp"C:\Users\Admin\AppData\Local\Temp\is-RIFSL.tmp\ScriptPlayer-Debug-1.2.3.463.tmp" /SL5="$70054,3886673,121344,C:\Users\Admin\AppData\Local\Temp\ScriptPlayer-Debug-1.2.3.463.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4900
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:1992
-
C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.exe"C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4048
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\ScriptPlayer\Buttplug.dll
- Size 126KB
- SHA256 01efd410c0a646c68d6939a679a45a889acefe70e7272c8ab7a8f0e37c770187
- MD5 bb35497711c3a91904d3aeac5da5e0ea
- SHA1 f035b5382cb928106f4cbaf4ff4f396a5ec11a1a
- SHA512 16e57fa156ae78441955ea473e47ea8176487737119af04324e9ba570ec5bd2e0e8963af4cef89438c88c795bf1e98d26ea81824c6029809b23eabdfc1432fc0
- SSDEEP 1536:4DlmbNlNPYvRL+CmuuErUAKExCTFkOo6mtXEBpxke2sPi8Kj2H6vzNxXrqDmsSJ:4D4b/lYpJtUS6aDtFEj2TsPi8K0d2
- TLSH T1B1C31928259D0E6AD78F6FB8F8E0564887B1F217340BE7AE894456F389037D0DD5227B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScriptPlayer\FMUtils.KeyboardHook.dll
- Size 11KB
- SHA256 13b1b76b3abdc5c075dcd1cdc5d22501d9bca76327a169bbac92c40480b4d006
- MD5 25e688adff329a92ca6f66fb6eb95f1d
- SHA1 1c12a9d0324d856d806d5e8cd0155be87998f64d
- SHA512 bb68d3314e4fc96a3c8b52df2af81de5f3dca051fbea970265a5ac60ba2cc556412802ab4d94d134471a28c7eabe41d644e09de996a436e120de6f6ccbcbf15d
- SSDEEP 192:+nJZl0ZxQuU27+W8n6epwDZa3Dxf1skYILoE+1:eJz0rAWubpkS1sk5Lo11
- TLSH T1A632F819972C432FCEBA873E9823362B0174960A6D43DFDA6608935E6F1930C1DD3BD5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScriptPlayer\Licenses\is-NHVID.tmp
- Size 9KB
- SHA256 1860a1eaf2db999a6653c78f438046b33998f8c66da168de502e93a23552b069
- MD5 20b3a556e3e74740ed4a8db241eab785
- SHA1 d6e7fd77979ea1aab5717945f896006f3e032d2d
- SHA512 e7d41bdeec14b0829050b5fd7d6f187214ee077024bbf35a8283a6b8c4c1b7ab53cdbc9ed5a4b416f57708515064560d098299d3af77fbedca18e9a122a4c613
- SSDEEP 192:J6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh5:J9vlKM1zJlFvmNz5Vr7
- TLSH T18222522FBB48037B06C20162A79764CBF31E903F3B552568314CD1781F5B96593FB6AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScriptPlayer\Octokit.dll
- Size 1006KB
- SHA256 69b3dff39c6e7fefeea9b5c250e201e1345a8ead742f9e15e44e7526f5ed7bde
- MD5 050ef11676c32e6f285f86eecf683afd
- SHA1 d9037d7f716ab8c101a881617bb8f7f1c2c5da09
- SHA512 40a98ccb7a2a29cdd0f7a6457acad6f884c8eb526e8c19ff1026eb8be4635b1853090216e86e341b61a25182f50ef8ae11c72df5236ff2b3caa42834b590aa9d
- SSDEEP 12288:Sqp2GkscVOlkQT7eGI5U4JTaT5G02xQxuOEQT7eGI5U4tTdG0RQxXOFG5KXPe6Wj:zp2GksWOlW/e6WDo3cS5wVRRFHV8Kpm
- TLSH T1DE252940BBA8DAEBD29E1635A520C7298631D1CF2F66E76F0F3D98252CD6B415C43237
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.HandyApi.dll
- Size 64KB
- SHA256 7bdbf620edf506d1665dc70fe66aa069a00db088f608c85bef8c730ab9426689
- MD5 c76c5d3d233fa05bff528b6c11347cc6
- SHA1 d385a94ebcb750042dc91a497e4ba79a286f44b9
- SHA512 d846f698b6103537bdca8d7539c964f2d748f926d4c37434bdb6173af14288a45d01aba43d2b20b8fe8df014845e21e226970c4330f3d21de32d8a7f327334c3
- SSDEEP 1536:GJ2HewZH9pNTafpU/JAIQTO9GcN7bOHgXzt5jv:GkHdZ7NTafKBAIZ9Gq7bOSz7
- TLSH T153532B1406ADC776DA6F5BBDE0355A164FFCA2DAB202E75D8F48F48E2C1235049387A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.Ipc.dll
- Size 9KB
- SHA256 3f4050d7505e9656ae3fc7e9d1f7119e7c3ac62dadc7ad9c0185446e2183a88f
- MD5 0f2a6efa2e0ad2124560fb7b72d47604
- SHA1 815f9ae9c71c25cfa4aacef1096a897155603655
- SHA512 28ea323b45d8c1b10c81491df46d9920fd4e1bf8b9b91c45e4fa975511240b11892712171dbf5fbf405fff7abf8fec164b159dad917614a2c16a3433c4f904d2
- SSDEEP 192:wIvitA5V0ryqfeHTz6thSrshKGROQt9exL5gD1QHaEE/usaeC63hs:FitQ0+ueH844h7ROQt81g1Q6EE/u5iRs
- TLSH T1A912D915BBE8C225F8FE0E7A5C73524087B1F651DD33DB2F28A8645B6E336041A70BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.Shared.dll
- Size 4.8MB
- SHA256 e60c5df1e90ed2c91b0648bf1b447625c60064373db04c91b8b09f1d3557028e
- MD5 2c04e4d6a704058346ffd5876a33df03
- SHA1 2859e0e04ef0a62152e8d1a227e04e0ce34a4aef
- SHA512 c707c411eec65c74d836d287308ba6847cdc3ab75e175623721606332f481cc2ab597a404c9129268b0e53e5136c8439c9bbd10cc573b9974e959373fa2e7470
- SSDEEP 24576:fliC5cUm3QV1VJVSTMIN11s628fs//26//lOlPbHMpY9P0g6P/Mzk6A/MBn/MBYs:NzDV1VJVS+WfG
- TLSH T11D36DE3C592587636279D16BE0C8690BF9A10587F1354F4E61CB9B897A0BA033FC9F9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.exe
- Size 916KB
- SHA256 17bcb95d9f602b70460effd94f64bce6ab05803023a20477213bf06c85759a8f
- MD5 3e13637b3fcfa5a38c3490ce3a30242d
- SHA1 23619279a33489cbe538549bf5d824b1d1a535b1
- SHA512 833b05b1c524acc2f42ea3d2433556d63542b976dc851d5c5b7cae096adc4e457684f842822e8644453b05fcdc4e7beaf9144909a0220c96a0529b98ec193e88
- SSDEEP 12288:v9OgE9K6UPTBGDNlfsl96H/JdyRVicowYuSz/B1LsH0sU:v9Og8/UPTiNZdKicow5c/B1LsH0sU
- TLSH T1C2155BB035F0809AC9FE8775E861C02477BD660CB5CCA30A7AB77E5D68C33825A4E756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScriptPlayer\ScriptPlayer.exe.config
- Size 1KB
- SHA256 e2c38977a287d2c36386bc66b9504a59aa2f8ccae7e7fc104cd5cc9ec0f3f081
- MD5 8a956d8c8a78c608a929970a72eefa99
- SHA1 a554cd83a0d407166c2259e12320021390c11469
- SHA512 8a1f73799bb42f6a19bf3ca892ea72f8f0440007631cb113eeec4f5b18407d6b459b5947d4c3be4570306a5aad08b65f5dc8904da878ef65fd069ee38e489066
- TLSH T18931401191E8FFA54F5606F23EA528248FED03B76A8C014DB0AE7DC9CF04A5A57032B5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-RIFSL.tmp\ScriptPlayer-Debug-1.2.3.463.tmp
- Size 1.1MB
- SHA256 821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
- MD5 90fc739c83cd19766acb562c66a7d0e2
- SHA1 451f385a53d5fed15e7649e7891e05f231ef549a
- SHA512 4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
- SSDEEP 24576:RtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt:PqTytRFk6ek1L
- TLSH T198453A22A3D24437D5732F759C6BC2946C367E202EA4E54A7EF99E0C0E39B41BD35392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Videos\Captures\desktop.ini
- Size 190B
- SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
- MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
- SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
- SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
- TLSH T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
- MD5 SHA1 SHA512 TLSH