Overview
overview
3Static
static
3ryns-realm....0.zip
windows10-2004-x64
1ryns-realm....0.zip
windows11-ltsc_2024-x64
1Images/Cli...ve.png
windows10-2004-x64
1Images/Cli...ve.png
windows11-ltsc_2024-x64
1Images/aasettings.png
windows10-2004-x64
1Images/aasettings.png
windows11-ltsc_2024-x64
1Images/add.png
windows10-2004-x64
1Images/add.png
windows11-ltsc_2024-x64
1Images/als...gs.png
windows10-2004-x64
1Images/als...gs.png
windows11-ltsc_2024-x64
1Lib/RapidO...nx.dll
windows10-2004-x64
1Lib/RapidO...nx.dll
windows11-ltsc_2024-x64
1Lib/RapidO...ut.ahk
windows10-2004-x64
3Lib/RapidO...ut.ahk
windows11-ltsc_2024-x64
3Lib/RapidO...r.onnx
windows10-2004-x64
3Lib/RapidO...r.onnx
windows11-ltsc_2024-x64
3Lib/RapidO...r.onnx
windows10-2004-x64
3Lib/RapidO...r.onnx
windows11-ltsc_2024-x64
3Lib/RapidO...r.onnx
windows10-2004-x64
3Lib/RapidO...r.onnx
windows11-ltsc_2024-x64
3Lib/RapidO...v1.txt
windows10-2004-x64
1Lib/RapidO...v1.txt
windows11-ltsc_2024-x64
1Lib/Theme.ahk
windows10-2004-x64
3Lib/Theme.ahk
windows11-ltsc_2024-x64
3Lib/Toggles.ahk
windows10-2004-x64
3Lib/Toggles.ahk
windows11-ltsc_2024-x64
3Lib/Tools/...xt.ahk
windows10-2004-x64
3Lib/Tools/...xt.ahk
windows11-ltsc_2024-x64
3Lib/Tools/Image.ahk
windows10-2004-x64
3Lib/Tools/Image.ahk
windows11-ltsc_2024-x64
3Lib/Tools/...cr.ps1
windows10-2004-x64
3Lib/Tools/...cr.ps1
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 21:50
Static task
static1
Behavioral task
behavioral1
Sample
ryns-realm-anime-adventures-free-v.0.3.0.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
ryns-realm-anime-adventures-free-v.0.3.0.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Images/Clicktomove.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Images/Clicktomove.png
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Images/aasettings.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Images/aasettings.png
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Images/add.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Images/add.png
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Images/als_settings.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Images/als_settings.png
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Lib/RapidOcr/64bit/RapidOcrOnnx.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Lib/RapidOcr/64bit/RapidOcrOnnx.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Lib/RapidOcr/ImagePut.ahk
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Lib/RapidOcr/ImagePut.ahk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Lib/RapidOcr/models/ch_PP-OCRv3_det_infer.onnx
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Lib/RapidOcr/models/ch_PP-OCRv3_det_infer.onnx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Lib/RapidOcr/models/ch_PP-OCRv3_rec_infer.onnx
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Lib/RapidOcr/models/ch_PP-OCRv3_rec_infer.onnx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Lib/RapidOcr/models/ch_ppocr_mobile_v2.0_cls_infer.onnx
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Lib/RapidOcr/models/ch_ppocr_mobile_v2.0_cls_infer.onnx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Lib/RapidOcr/models/ppocr_keys_v1.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Lib/RapidOcr/models/ppocr_keys_v1.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Lib/Theme.ahk
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Lib/Theme.ahk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Lib/Toggles.ahk
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Lib/Toggles.ahk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Lib/Tools/FindText.ahk
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Lib/Tools/FindText.ahk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Lib/Tools/Image.ahk
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Lib/Tools/Image.ahk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Lib/Tools/RapidOcr.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Lib/Tools/RapidOcr.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target Images/add.png
- Size 167KB
- Sample261026-1p2wysca68
- SHA256 0246b3b4b84608d19c80be279ba96d77d9071b6811e2983c9aa5fee8d05ae920
- MD5 06e6a0e85aa914df4f1c072eefa0b09e
- SHA1 4dd4d7f3a6a020f07c6a3796dafe10b15eb14c04
- SHA512 c15c5b345567cd7f8e097a6dc03964e003321ce2f669dbb34c9d681f2b1fca1d96445d09060891a63ba1399073e74229fe3278f9df5ce43d74ce3b712f020ad0
- SSDEEP 3072:k1th6b0knWMrQyxo0npNnvrqhyG279LZ47bS9OS7ayjOE/YGhRowzSWpO9h:MtTkn1q0njjqhyGuLmK9OSxjnNRkL3
- TLSH T1E0F312C9A2173E8FE83F4035937D76A8224152B79C4A4653BD8F0B6D4AF7526B433822
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4048 mspaint.exe 4048 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4048 mspaint.exe 4048 mspaint.exe 4048 mspaint.exe 4048 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Images\add.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3768