- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
f99c12933c36ac9b9d33340145434a7d68f1688a7805ca325379a4b927521c99- SHA1
c733f9e98bed9bde335bb36efedfb2010132e050- MD5
7aa9b25a26dea6c18eb6f12bd12fb3b0- Filename
- f99c1293_inspectre(1).exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 147640
- Compile time
- 2018-04-11T18:14:57Z
- PE platform
- x86 32-bit
- PE sections
- 2
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
13 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context13 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
5shown
55%
critical
rar
17010726 bytes
drops
Filename
be7f3782_resident evil requiem crack only beta hypervisor v3.0.rar.bin
Family
tedy
Type
trojan
File type
rar
MIME
application/vnd.rar
52%
critical
7zip
11778151 bytes
contains
Filename
8b49e76b_resident.evil.requiem.hypervisor.v3-kirigiri.7z.bin
Family
efiguard
Type
trojan
File type
7zip
MIME
application/x-7z-compressed
55%
high
rar
18632951 bytes
drops
Filename
8b42542f_re9 v3 crack.rar.bin
Family
lazy
Type
trojan
File type
rar
MIME
application/vnd.rar
55%
critical
rar
17013550 bytes
contains
Filename
88b1d0ce_residhypervisor.v3.rar.bin
Family
efiguard
Type
trojan
File type
rar
MIME
application/vnd.rar
43%
high
rar
604119 bytes
drops
Filename
708ee35d_except_kirigiri_09-mar-26.rar.bin
Family
dllinjector
Type
trojan
File type
rar
MIME
application/vnd.rar
Dropped / child files
Files dropped, bundled, or created by the queried file.
3shown
0%
1332 bytes
contains
Filename
dde83ae2_as_b100.tmp.bin
MIME
application/octet-stream
Size
1332
SHA1
4200b1b32b87d91673100eb9d7cf4763f31c9388
First seen
2020-12-18T01:36:18Z
0%
xml
808 bytes
contains
Filename
4440b7a3_as_e8fa.tmp.bin
File type
xml
MIME
application/xml
Size
808
SHA1
b1a8ea30d3fd288a9092afd979bc71a63e5bb4c2
0%
peexe
3584 bytes
drops
Filename
e637669462a427f90ccf3e074b7e9850b7f56719c89e65286218bed0efad9504-dropped.bin
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
3584
Compile time
2018-01-26T23:30:32Z
Related domains
Domains associated with this indicator.
5shown
0%
.com
communicates
Root
identrust.com
TLD
com
Subdomain
secure
First seen
2025-02-03T22:47:57Z
Last seen
2026-05-13T11:09:54Z
0%
.com
communicates
Root
grc.com
TLD
com
Subdomain
www
First seen
2023-09-30T19:06:08Z
Last seen
2026-11-14T02:05:32Z
0%
.com
communicates
Root
grc.com
TLD
com
First seen
2023-10-01T02:11:35Z
Last seen
2026-11-08T06:25:19Z
0%
.com
communicates
Root
identrust.com
TLD
com
Subdomain
validation
First seen
2023-09-29T19:56:23Z
Last seen
2026-11-10T15:01:57Z
0%
.com
communicates
Root
office.com
TLD
com
Subdomain
svc.ha-teams
First seen
2023-09-30T20:38:17Z
Last seen
2026-11-15T07:49:33Z
Analysis details
exepecompactfile-overlayself-deletesigned
Freshness: Fresh · Last seen today.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
f99c12933c36ac9b9d33340145434a7d68f1688a7805ca325379a4b927521c99- SHA1
c733f9e98bed9bde335bb36efedfb2010132e050- MD5
7aa9b25a26dea6c18eb6f12bd12fb3b0- Filename
- f99c1293_inspectre(1).exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 147640
- Compile time
- 2018-04-11T18:14:57Z
- PE platform
- x86 32-bit
- PE sections
- 2
- Import libraries
- 1
- TLSH
T1EBE3D08127703805DE524E31A4E4DB383A3C7D45AF0089BB325BF78F9B73781B95A269- SSDEEP
3072:zxxPGrlqO+NDWQ+WMqoQpFWzqSlxmW6PrbFSr:FUrrQ+WMMFWzqSnsXFa- Imphash
09d0478591d4f788cb3e5ea416c25237- Richhash
3f4fae7d17b04d7f425d131af6b39986- First seen
- 2026-02-25T05:22:46Z
- Last seen
- 2026-11-14T17:02:05Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
13 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
14 timestamped observations are arranged from 2018-01-26 to 2026-03-14. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
3 relationship group(s) provide pivot and infrastructure context.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- f99c1293_inspectre(1).exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 147640
- Compile time
- 2018-04-11T18:14:57Z
- PE platform
- x86 32-bit
- Entry point
- 5883
- Sections
- 2
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A file with an unusual extension was attempted to be loaded as a DLL.
- Binary may include packed or encrypted code
- Classification label
- Creates RWX memory
- Creates a process in suspended mode (likely to inject code)
5 shown
View MITRE ATT&CK details · 5 shown
View MBC details · 5 shown
- CommunicationObjectives: OC0006
- ExecutionObjectives: OB0009
- C0002 — HTTP CommunicationObjectives: OC0006
- B0023 — Install Additional ProgramObjectives: OB0009
- C0005.001 — InternetConnectObjectives: OC0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
DNS request activity1
- 1 DNS requests observed
- 1 unique queries
- 0 response IPs
View details · 1 shown
- Query
- svc.ha-teams.office.com
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit2 sections
- Platform: x86 32-bit
- Sections: 2
- Entry point: present
- Compile time: 2018-04-11T18:14:57Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 5883
- Sections
- 2
- Compile time
- 2018-04-11T18:14:57Z
PE sections2
2 sections
- 2 PE sections
- Common permissions: rwx
- 2 unique section names
View details · 2 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 163840
- Raw size
- 17408
- Permissions
- rwx
- Entropy
- 7.99
- Name
- .rsrc
- Virtual address
- 167936
- Virtual size
- 102400
- Raw size
- 102400
- Permissions
- rwx
- Entropy
- 6.27
Imports1
1 DLL groups
- 1 import DLL groups
- 4 imported functions summarized
View details · 1 shown
- Library
- kernel32.dll
- Functions
- GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_ICON, RT_ACCELERATOR, RT_CURSOR, RT_GROUP_CURSOR, RT_GROUP_ICON
View details · 5 shown
- Type
- WAVE
- Language
- ENGLISH US
- Type
- RT_CURSOR
- Language
- ENGLISH US
- Type
- RT_ICON
- Language
- ENGLISH US
- Type
- RT_ACCELERATOR
- Language
- ENGLISH US
- Type
- RT_RCDATA
- Language
- ENGLISH US
5 shown
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates5+
5+ issuers
- Example subject: Gibson Research Corporation
- Issued by: DigiCert EV Code Signing CA (SHA2)
- Validity period (UTC): 2019-04-15 – 2022-04-20
View details · 5 shown
- Subject
- Gibson Research Corporation
- Issuer
- DigiCert EV Code Signing CA (SHA2)
- Valid from
- 1555286400.0
- Valid to
- 1650456000.0
- Fingerprint
- CE068EA21AA7C935AB9D3589BBDFB17610EAF717
- Subject
- DigiCert EV Code Signing CA (SHA2)
- Issuer
- DigiCert High Assurance EV Root CA
- Valid from
- 1334750400.0
- Valid to
- 1808049600.0
- Fingerprint
- 60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3
- Subject
- DigiCert
- Issuer
- DigiCert High Assurance EV Root CA
- Valid from
- 1163116800.0
- Valid to
- 1952035200.0
- Fingerprint
- 5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
- Subject
- DigiCert SHA2 Timestamp Responder
- Issuer
- DigiCert SHA2 Assured ID Timestamping CA
- Fingerprint
- 400191475C98891DEBA104AF47091B5EB6D4CBCB
- Subject
- DigiCert SHA2 Assured ID Timestamping CA
- Issuer
- DigiCert Assured ID Root CA
- Fingerprint
- 3BA63A6E4841355772DEBEF9CDCF4D5AF353A297
5 shown