e8b11fb730a478e31602bfce18f1a79957a40dd0cb7a2929502c58db86d4c954

Analysis

user interaction
yes
max time kernel
148s
max time network
121s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 14.5MB
Sample261023-2wfsqset9s
SHA256 e8b11fb730a478e31602bfce18f1a79957a40dd0cb7a2929502c58db86d4c954
MD5 3764c0391372a1797b91a06a2e8b1458
SHA1 aeb5ee9e4c662c2bce834f1ccd40dfe0b627274a
SHA512 39d397b6832dce52d1e91110cf87e648ca634bb414190896c7d0da1eaf372dad1086ccaf298965d4ca2e7946cd9e855c06e8fda937e2e0d59070fc1226c4d67e
SSDEEP 393216:ALmVm+8VBapNAnLmVmUTkFYyNgMk2QJfpERT:2/BYNWya+Mk2Q9qV
TLSH
T1B0E6336EF4B081F8C17DD13C0F552BE8219DA9B35EB08B576C2D9A8B8A7F3441472B84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3352	setup.exe.tmp
3636	Hypersonic.exe
4172	Hypersonic.exe

Loads dropped DLL 26 IoCs

pid	Process
3352	setup.exe.tmp
3352	setup.exe.tmp
3352	setup.exe.tmp
3352	setup.exe.tmp
1128	regsvr32.exe
5028	regsvr32.exe
5028	regsvr32.exe
5028	regsvr32.exe
3636	Hypersonic.exe
3636	Hypersonic.exe
3636	Hypersonic.exe
3636	Hypersonic.exe
3636	Hypersonic.exe
3636	Hypersonic.exe
3636	Hypersonic.exe
3636	Hypersonic.exe
3636	Hypersonic.exe
4172	Hypersonic.exe
4172	Hypersonic.exe
4172	Hypersonic.exe
4172	Hypersonic.exe
4172	Hypersonic.exe
4172	Hypersonic.exe
4172	Hypersonic.exe
4172	Hypersonic.exe
4172	Hypersonic.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\is-6JBB9.tmp	setup.exe.tmp
File created	C:\Windows\SysWOW64\is-23N5T.tmp	setup.exe.tmp
File created	C:\Windows\SysWOW64\is-KV098.tmp	setup.exe.tmp
File created	C:\Windows\SysWOW64\is-HSRH4.tmp	setup.exe.tmp
File created	C:\Windows\SysWOW64\is-KSGCQ.tmp	setup.exe.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\WINMMBASE.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\ucrtbase.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\dciman32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\WINMMBASE.pdb	Hypersonic.exe
File created	C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\is-HOSLG.tmp	setup.exe.tmp
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\combase.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\wuxtheme.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\guad.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\DLL\cryptbase.pdb	Hypersonic.exe
File created	C:\Program Files (x86)\Steinberg\Hypersonic 2\is-KHP53.tmp	setup.exe.tmp
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\Hypersonic.LOG	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\DLL\comctl32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\bcryptprimitives.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\msvcp71.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\shell32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\msvcp71.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\guad.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\dxgi.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\devobj.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\wgdi32full.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\shcore.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\ws2_32.pdb	Hypersonic.exe
File created	C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\is-LJF84.tmp	setup.exe.tmp
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\advapi32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\ksuser.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\DLL\SYNSOEMU.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\DLL\MMDevAPI.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\wgdi32full.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\wgdi32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\twinapi.appcore.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\msvcr71.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\TextInputFramework.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\cfgmgr32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\version.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\msimg32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\msvcp71.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\version.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\wntdll.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\midimap.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\cfgmgr32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\wgdi32full.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\oleaut32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\avrt.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\bcryptprimitives.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\midimap.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\msvcr71.pdb	Hypersonic.exe
File created	C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\is-96GKO.tmp	setup.exe.tmp
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\Uninstall\RCX7328.tmp	setup.exe.tmp
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\DXCore.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\Hypersonic.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\wwin32u.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\version.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\sechost.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dxgi.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\bcryptprimitives.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\shcore.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\CLBCatQ.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\wsock32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\DLL\msimg32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\msvcr71.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\symbols\dll\wgdi32.pdb	Hypersonic.exe
File created	C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\is-LB40C.tmp	setup.exe.tmp
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\ole32.pdb	Hypersonic.exe
File opened for modification	C:\Program Files (x86)\Steinberg\Hypersonic 2\dll\Hypersonic.pdb	Hypersonic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2624	3636	WerFault.exe	87
3824	4172	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hypersonic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hypersonic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe.tmp

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3E4F948-603F-4B13-9602-1155876E2B37}\InprocServer32\ = "C:\\Program Files (x86)\\Steinberg\\Hypersonic 2\\Hypersonic.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3E4F948-603F-4B13-9602-1155876E2B37}\CLSID = "{D3E4F948-603F-4B13-9602-1155876E2B37}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3E4F948-603F-4B13-9602-1155876E2B37}\FilterData = 02000000000020000200000000000000307069330000000000000000010000000000000000000000307479330000000060000000600000003170693308000000000000000100000000000000000000003074793300000000600000006000000000000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3E4F948-603F-4B13-9602-1155876E2B37}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3E4F948-603F-4B13-9602-1155876E2B37}\ = "Steinberg Hypersonic"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3E4F948-603F-4B13-9602-1155876E2B37}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MfxSoftSynths\{D3E4F948-603F-4B13-9602-1155876E2B37}\Description = "Steinberg Hypersonic"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MfxSoftSynths\{D3E4F948-603F-4B13-9602-1155876E2B37}\HelpFilePath	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3E4F948-603F-4B13-9602-1155876E2B37}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3E4F948-603F-4B13-9602-1155876E2B37}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5DCD8AA-9CC4-4860-A20D-E4C69A7ED880}\ = "Hypersonic Editor"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5DCD8AA-9CC4-4860-A20D-E4C69A7ED880}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3E4F948-603F-4B13-9602-1155876E2B37}\FriendlyName = "Steinberg Hypersonic"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MfxSoftSynths\{D3E4F948-603F-4B13-9602-1155876E2B37}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MfxSoftSynths	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MfxSoftSynths\{D3E4F948-603F-4B13-9602-1155876E2B37}\HelpFileTopic	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5DCD8AA-9CC4-4860-A20D-E4C69A7ED880}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5DCD8AA-9CC4-4860-A20D-E4C69A7ED880}\InprocServer32\ = "C:\\Program Files (x86)\\Steinberg\\Hypersonic 2\\Hypersonic.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5DCD8AA-9CC4-4860-A20D-E4C69A7ED880}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3352	setup.exe.tmp
3352	setup.exe.tmp
3352	setup.exe.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3352	2300	setup.exe	82
PID 3352 wrote to memory of 1128	3352	setup.exe.tmp	84
PID 3352 wrote to memory of 5028	3352	setup.exe.tmp	85

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\is-BP8K1.tmp\setup.exe.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BP8K1.tmp\setup.exe.tmp" /SL5="$502AC,14445912,104448,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Steinberg\Hypersonic 2\HypersonicReWire.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1128
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Steinberg\Hypersonic 2\Hypersonic.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5028

C:\Program Files (x86)\Steinberg\Hypersonic 2\Hypersonic.exe
"C:\Program Files (x86)\Steinberg\Hypersonic 2\Hypersonic.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 1260
  2⤵
  - Program crash
  PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3636 -ip 3636
1⤵
PID:988

C:\Program Files (x86)\Steinberg\Hypersonic 2\Hypersonic.exe
"C:\Program Files (x86)\Steinberg\Hypersonic 2\Hypersonic.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 1232
  2⤵
  - Program crash
  PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4172 -ip 4172
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hyper Modules Demo Manual.pdf

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\Hyper Modules Demo Manual.pdf
Size 2.0MB
SHA256 30627515d4e64ef7c46df7b92234c08e224b125e7cca96a9d41cd9d066d748fe
MD5 c8a97987a166d9a28df5897bcd35937a
SHA1 397b6de39faf798d035314bfeb89abeff0aba6ae
SHA512 7fcfbf3dacea448bb0f1e47b66d1b5def2e95804c72d332388f89206ff35b369a7c79293c3772740a0d3d77beae5857eadaae56691c557c1939fa6c0ad8454e8
SSDEEP 49152:Cfd7viSxnURRBWMpvkYrE3w+9XwcWK6rJvy8CTXMS:CdiFRzI9ScWv68CTXMS
TLSH
T16CA5F17765C79C8CF8D3CAC1670C668E4F0EB2533AEB659214BD974AC633852D9C7A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hypersonic User Manual.pdf

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\Hypersonic User Manual.pdf
Size 2.5MB
SHA256 09e4cbf9f1236dd94568fb020c891f76c318b6cece807153351375c3f7bdfe36
MD5 a605ce8004110a53a77f841c8f399f1b
SHA1 487d6c58c2bea6a73bd85750da7d8f0c9a6a49f7
SHA512 4fb6bd9626882245fafec466ada8d43b0131ab2ad44354b30e61d558afaed49e92fab176660293697922d823f0d087e083f25af742405e38d1408a93ff4c19ea
SSDEEP 24576:KGqc2HoCEe4eqzFSCciG6PkUAqjtjbqomhtjsu4Z0t7K9yEnB3e9FTJTpDhy9yHC:KGCHEezDHi/qoO4ZK7e1YTVpzPOr
TLSH
T1FAC52AB7B0C55C4CF883D6855F1C9BAA9B1DB5532BFBF986547CAA4EC13340299C3A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Issues and Solutions Hypersonic 2.pdf

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\Issues and Solutions Hypersonic 2.pdf
Size 104KB
SHA256 20794d3e4b31548d7fb521f15a5cef1364e746798456875c76a6be21cf8e9ba8
MD5 ca254f2d207a30ba68db7c1169e58974
SHA1 905b3608ca6e2907958670c12f8ef6f272399df2
SHA512 ff7989fa56eef018a5653f297897a4a6c551429d3bf3797514891002957fe627718f0b52c9d702650ce9f141f3659776a5068a8b523734910acf99c42a2711c5
SSDEEP 3072:lECsanlOYJDNWQE7HUdpga6lhg2YdUecB9ss:yQceDNZE7doXlcBus
TLSH
T12EA3026396D5D9EEDAD7EE10C6BF3A2C443E356A44C71ED817344F28319246DF1222E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadMe Hypersonic 2.rtf

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\ReadMe Hypersonic 2.rtf
Size 7.8MB
SHA256 4c6c4756b8a2d312ef0957349e8e63456e19d08ddf8bf710ba7916f22b2feebe
MD5 0c81bdb16965c9d5c0206ebd1691c288
SHA1 d42aa7e5d3e5cb83247e947aaa7c9529c619acad
SHA512 19994557ab6e16b9cfea1cbf5ef1cade117cc33a18b51d4c7ecc7e6e9b4c95de9c5c32c9460705e20a7c63dd22ba5e8ffdabd2988fa317dd09bebd572e7a28aa
SSDEEP 24576:4FQk1PCvI8ut5FQk1PCvI8utRNB1lx/P6wL0NEaZgxjVqokFVyNi+SA/vEE13GpV:H
TLSH
T177868370E41F3981F5E5B3CF8B5B7D490A61F6110EC68A8BDFBBD0B22861D58CA59C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

The Mod Page.pdf

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\The Mod Page.pdf
Size 275KB
SHA256 2b6ff3d3f075e4841ab329cb73d2cbf9383ea29d3442616e3c45116d460ee7ad
MD5 b8799aaf93afd3b03a562ad326cd642e
SHA1 14c84467c7488770372ee8e3abf6eb39c69ab465
SHA512 1cfb8a0179075a3911c8613b29e162aa7bb71717c916fea57af82a8f32edacc95354ba29b198d2df0a4a6d994cb495204bf21def5cfe4258d8d47b7a77e92c60
SSDEEP 6144:0hSB9KvRtMHt+gRitVAA0MQ60eKit3+F+I2yU6Df/pN/ltkJ5ESr:00BEtMHqu33UJYR9U6Df/pNdtG5E6
TLSH
T126540179C9932CCCF8838727976A3E2D4C7D721787E9349211748B49E488D14EBA76E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Whats new in Hypersonic 2.rtf

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\Documentation\Whats new in Hypersonic 2.rtf
Size 4.4MB
SHA256 bf43e33cce1e11b5808f01af9409d642040c85d1e5fb3f50e43fbeac37cfda7d
MD5 2dd9e4cbca4744c09a2b87694fa41ea1
SHA1 772977fd8e40bf8fc9f3c8ff04655be302939632
SHA512 dd2ec8972fe9c7b90d787103a687d1fab5644aca5c556c7f000725f13f91ec51d51ef8071586f4ed37b7692b1c8e40e2a049eec164a12a5f9c56ca78aab82909
SSDEEP 12288:APL5Qk1veQCvXB5NA5l1ZZAZRRa8HrzJ8tibwPL5Qk1veQCvXB5NA5l1ZZAZRRaF:AFQk1PCvI8utdFQk1PCvI8ut7
TLSH
T16126FD70F94F7E965618F3C4992F128E0849D7281E56A2C9E3FFEAB27D23556CB08C50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hypersonic.LOG

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\Hypersonic.LOG
Size 3KB
SHA256 619a768e66126623e8cfc176e82a8eb623b7df1ed6500b9d49724a22455a824a
MD5 e5f122f899ff8ee3100ef635ff662bd5
SHA1 fad172259308c7cd554f0665d3c3daca2cabea78
SHA512 b33a286b453fe6302d872e36cebf33e26ef3291f336990ff363b6d1e0bbce889879c985416eaf2639e7f57c1c3489ac8a5ace838201b779edb3e07f70a813394
TLSH
T1357148208E16C280F209D7452BA8B5CFD25D7D5733EC54A2336C83DAD452BA9E2DE70D
MD5 SHA1 SHA512 TLSH

Submit Download

Hypersonic.exe

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\Hypersonic.exe
Size 2.5MB
SHA256 52ba9feb4f633e9fc7a5d150c2096538caba5c7e85f6f21c35dd1aaf743c0932
MD5 e78c8b1da17a7f09850791f868c2cc32
SHA1 b4b0db5c5cf00be149bb2d7ed0559f29245b6a22
SHA512 ec1d468d3b9e96a65acea559713fc869f1a0c498cca3fe48e021c89951cb000a101810de3fa566984a5f9c16d4327fe2eb8ebd040560dfe6faab4cad1c610653
SSDEEP 49152:PsACDVziypornIbbIWYuJrpWVZiJAVGsK/8k:CDVz5MUbXrSZiKVGsK/8k
TLSH
T1DBC56B11713183BAEB9B21718E7D3E0D905DDB980B246EC3769C1D2D0CB6BD29A371AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HypersonicReWire.dll

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\HypersonicReWire.dll
Size 100KB
SHA256 3a6bc880cae74d6c2313957c7f9d9113b6f1682dad5f4815335beeb9faede916
MD5 f5e36bb47f2cd10664bd400ccfac536a
SHA1 39a01a3b810268dd6cf6cee1127a1339f3452ff4
SHA512 a0deb968a9ecee14ee3aa0d786b6b6f2620e8ead4f021df30cf76993a36fe04ff40fdf62d9fcfc65b2b33f50befa258aac4f339f5e46d0c175f044474933a515
SSDEEP 1536:6qRmUGD2OOAH31gFb1hOvyWHtvE6OLgwGyBYSM3aEOWo8tJV4lATzPf3D:6d2gaW6p6G5OtJV4lif
TLSH
T1F8A38F1274D2C270D49B15BE058E1B11AB7FA5208BF18DC37F542DADAF362D0AD3638A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HypersonicReWire.rwdef

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\HypersonicReWire.rwdef
Size 2KB
SHA256 f1a6db766c88b6bf5b2006df101d39e2119f9ef2f343727049fa6a7f3780bdaa
MD5 3f507aa1aaa180deafc7bd0cf5a3c895
SHA1 23962ecd175be78d5d660a0954e0cdae4453ddf7
SHA512 3a7b2c5c8448783c6eca115e1f92c3f4700ef242e69f429a6de6a599a9c605ed41074b5def1e0f4e944b17818d453441c0516dd658af08e292110aacaed80c8f
TLSH
T1A1411D84E6346F654B84B0EFB9F06D0B524BBE25E158E878B79CB9339777283E045C24
MD5 SHA1 SHA512 TLSH

Submit Download

is-4DI84.tmp

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\Uninstall\is-4DI84.tmp
Size 1.6MB
SHA256 2b8101991b7fe7a137d082abad711b89054916008a9b68f62f3055959af84f97
MD5 60ce5e33b6ec3f2051f9021b4186a5f6
SHA1 b34dac31d9e87ff365c0fce0c40e8027adff9101
SHA512 c60b10ad51db3cce2885a6aed430117257f7f09fcf48edc60b94d5c981e5db060ec098237da99ce9e8fb7598833522573474e412995de9313c7e4bc9de0a42cc
SSDEEP 24576:hytnFssBcmEBTBTEgaBP7kNw0+X/B4LIkVOZdbhh7Zil+FKQTeGCp1mT3IHjT6xb:hygsBmD+viLJOZdbh3c+/omTS6b
TLSH
T1DD759D22F3918477D5671A381C1BA7B96539BE201F38ADCB3BE4EE4C1E352813536297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-67PBF.tmp

Path C:\Program Files (x86)\Steinberg\Hypersonic 2\is-67PBF.tmp
Size 7.3MB
SHA256 929dccbf96b8f42eb9a58ce8283b29a452b876b765a97d1c896d4154ffa1d8ff
MD5 063ccd47c5c3076120ea91a342c905f3
SHA1 87d5b0ba2733f1d6a26f2c4bfd4b688f8bc47819
SHA512 9b2e3cae864aa8bcbcd903ec55c260bde1f35d974dd3416a7fb02a381c80ffd63b28323cab7ce7ceb03d63847f9ccf953b2d171f4a66dc0e88bffae6dd77265b
SSDEEP 98304:KR6r2idCqMrDN62XHrYWYvrMKrMWFwvDroOpBfxvzzq7YdBYHVlKPvHcP:qifMrDc2XcndcJBYb88P
TLSH
T15276F201FA02DA98F58014FDDE72B92C4358BD44679C6AEBB9D6BA4BD0971F11D323B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-BP8K1.tmp\setup.exe.tmp
Size 1.6MB
SHA256 09178384f340b88f258bafa5a7af3dc2c2864004df8a33a71900b12d13fe84ac
MD5 c3189bdbce1b62bb3003ed25d7d42300
SHA1 5cc03d97a60f8afc7095faefcb6032a1a0108df8
SHA512 5e1440f5b24c692e9346bcccfe331af00a8d09e2099fd2c528f0c07c4e2275d87ec29559c74e976d2ca762884587008a92072537f8c0ca40356a9c30d0149292
SSDEEP 24576:5ytnFssBcmEBTBTEgaBP7kNw0+X/B4LIkVOZdbhh7Zil+FKQTeGCp1mT3IHjT6x6:5ygsBmD+viLJOZdbh3c+/omTS66
TLSH
T100759D22F3918477D5671A381C1BA7B96539BE201F38ADCB3BE4EE4C1E352813536297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdiplus.dll

Path C:\Users\Admin\AppData\Local\Temp\is-VI0U9.tmp\gdiplus.dll
Size 1.7MB
SHA256 5f25405d991a2118dffcaa4929aa94e44a8692916e363a84011555f4c8c4c423
MD5 c5ea2d4f8f7ac5188a98c6a9efaddc26
SHA1 fe5c1e41d2eaa24e2af4770c1d507c6fba08dbe3
SHA512 197bc8083c6d8a1ac6f5f48ec17d0128b08e09926162abdd73a1b0b8f0921a5ac050e8429c93d15612964dd217036382139ee57f4157b89436feefa0b14455fe
SSDEEP 24576:fjYLltJx99q8QiLl5Bb1/QB/vwQjiDHER8uSSvqrhdewD2XgfegLcvRbleESOdL:fc7JBb1/QSQho3yggh
TLSH
T1F985BF62F593D039C46356B1AA56333AB3F99B31003D8A4A7ED51D0DEAB1C42CB39367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpE583DCF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE583DCF.tmp
Size 492KB
SHA256 f047d2371f204ad9709b891c5e2b59b8c0e13b6899746b2b449529e7375016ba
MD5 07cd14db0608fc557c4fb35d5606d7f6
SHA1 0f3c9b916c2dea3ed83907c776709d6217ad5763
SHA512 44577784e45ca24c3029570fe312812d1467273651ce5822a0e33e88581a736ec81962c112a9b5878da708f2a79826e82630ad0000153272a1b16b83af5f9bae
SSDEEP 6144:hBre+vbTVY58yfen7Ttqe0jGbrHt0bGuV9Y+vYogIoAFxlFVauqYhATBlInxIY8F:hFvS/4TejGnCT9YLulFhfhAT3IHc6
TLSH
T170B47D01FAE340F7DA0B2634242D7B7AA27D9AA54B38EBC36755FE3D39310C1413A656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpMME583DDF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpMME583DDF.tmp
Size 90KB
SHA256 d98cd5d6ed9c4a95701684aa83777cefd5d8096e14c836493f67159d68161c01
MD5 0be4a226874eccb9f8bfe3d8dced0c09
SHA1 00ef65d450c195b3c790a87c2b6e350829ebbbd0
SHA512 fc7d885414de92707bb20deeb45189b340a4503f379ff98503266d69b197fd450b71585a16a8de40f16428595ff38a3ae9ed7a3738286b9995cebcb91c14a85e
SSDEEP 1536:U+iZiDjuo02SaDLyXHpb+0zeiDaMuK/R0aMMP8747r+vs9zWyijxuCvWUB:3vV02vDLeHp60a45pAJExEBB
TLSH
T1409302FABA091ED7CE83023498E223F276E199AC8473EBEE544171489CF3BD55D19B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GuaD.dll

Path C:\Windows\SysWOW64\GuaD.dll
Size 2.7MB
SHA256 1d299dc7efa6a7cc78aa85c0ff55b9c40b0051d8c380963bfacabbb0b9f58c65
MD5 248e5b82028bb3d27486a3515643965f
SHA1 add0a38b7e98b22ad46c9754cf83c68c5d2d5de1
SHA512 d609f5818ebeff5ee8b125dd26af48ef6386f9c542ecb21c0b3641d877a9d1d54d95d9302bd9a438b960ea66fb87aa975ee81212a7d1c93aca5e0fd58178c7fb
SSDEEP 24576:to88OwhF+YGSil/uFClAAoFjWcHHnhpd0PHx9FL9F7nEn7Fk/08Gcb1zZWuml6m+:qUApfhf0PR9dI7FzZcWuml6m8hXz
TLSH
T10DD53102935D3E53F7590B3820BD0B0AE6369D16372B8FD7E915761EDE6A2C22B9035C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP71.dll

Path C:\Windows\SysWOW64\MSVCP71.dll
Size 488KB
SHA256 df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
MD5 561fa2abb31dfa8fab762145f81667c2
SHA1 c8ccb04eedac821a13fae314a2435192860c72b8
SHA512 7d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
SSDEEP 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
TLSH
T17BB4D71377434AF2E086B3F576C6032297F6FC654A25B31392DFE4642F9A38951B3A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR71.dll

Path C:\Windows\SysWOW64\MSVCR71.dll
Size 340KB
SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
MD5 86f1895ae8c5e8b17d99ece768a70732
SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
TLSH
T10374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReWire.dll

Path C:\Windows\SysWOW64\ReWire.dll
Size 360KB
SHA256 2129e05055106f1655036f5acae0fa348da2d602297c24a43b8af6a2ba115e2f
MD5 99d104981f9d3dbee1bd84121e7a9ff5
SHA1 71e16f25b35a5baad6a32a5f12dd2b5c639130e7
SHA512 82e7f81f7c7d19dfd661e95bf36ab1b224f7333103e6a4ee3a88578eb8871044c317806a11e708c44b6480f649a304838f3d4e82680bbdd9121885a50c386a3b
SSDEEP 6144:YpidD+fR+Re2EqVQAF6U3HHlXu7X1VX0jAObPMth:cidifR+6kXHFYZ0j
TLSH
T13A743A21F66AC172CB8F02753D6CAF9D267DA9845FE08AC3B3942F6E4D232C1543615E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SYNSOEMU.DLL

Path C:\Windows\SysWOW64\SYNSOEMU.DLL
Size 2.3MB
SHA256 f6038dc65ab4c96b7dc20303a300d3453904ed6a7fa21a603c9885a0252bf593
MD5 e277befbb047351f51e9c3e6c3375a31
SHA1 e69efb416b1bbb8a98c3f58edc083c733b1d3b88
SHA512 7e1b667982b347fe87390a0cae905f9e874d3d9926a99bbd2696e6e8fc7d60bd8d8bcf6b7456fea4dac5e24102dbb17bf5fce733663f578b6ff647cb6a94e4d1
SSDEEP 49152:8XlZ8syUIscSF7HUp8i38t2m22Qsfh6/O:qnI/8bt24TSO
TLSH
T1E0B5F103E7548A33C46F93BAC56B171E93799342BB879B0F4019A1156D8339B7BA339C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2300-38-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2300-132-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2300-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2300-2-0x0000000000418000-0x0000000000419000-memory.dmp

Download

memory/3352-35-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/3352-18-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/3352-37-0x0000000002960000-0x00000000029A0000-memory.dmp

Download

memory/3352-36-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/3352-10-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/3352-19-0x0000000002960000-0x00000000029A0000-memory.dmp

Download

memory/3352-20-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/3352-131-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/3636-140-0x0000000007230000-0x000000000798A000-memory.dmp

Download

memory/3636-147-0x0000000007A90000-0x0000000007CEB000-memory.dmp

Download

memory/3636-153-0x0000000007CF0000-0x0000000007FA2000-memory.dmp

Download

memory/3636-155-0x0000000007CF0000-0x0000000007FA2000-memory.dmp

Download

memory/3636-152-0x0000000007CF0000-0x0000000007FA2000-memory.dmp

Download

memory/4172-166-0x0000000007AA0000-0x0000000007CFB000-memory.dmp

Download

memory/4172-170-0x0000000007D00000-0x0000000007FB2000-memory.dmp

Download

memory/4172-160-0x0000000007240000-0x000000000799A000-memory.dmp

Download

memory/4172-172-0x0000000007D00000-0x0000000007FB2000-memory.dmp

Download

memory/4172-174-0x0000000007D00000-0x0000000007FB2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads