lucastealer | hxxps://github[.]com/aslostar9/Vedani-Crypter/archive/refs/heads/main[.]zip

Analysis

max time kernel
110s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2023 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/aslostar9/Vedani-Crypter/archive/refs/heads/main.zip

Score

10^/10

lucastealer pyinstaller stealer upx

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6656071336:AAHleJy38tLJcU8izz7pqYuatRUiofd0IDo

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/1924-285-0x00007FF6076A0000-0x00007FF607AF5000-memory.dmp	family_lucastealer

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	Vedani-Crypter.exe

Executes dropped EXE 6 IoCs

pid	Process
1924	Cryptor.exe
3676	Vedani-Crypter.exe
772	Vedani-Crypter.exe
5072	VedaniCrypter.exe
5044	MkHelper.exe
3960	MkHelper.exe

Loads dropped DLL 51 IoCs

pid	Process
772	Vedani-Crypter.exe
772	Vedani-Crypter.exe
772	Vedani-Crypter.exe
772	Vedani-Crypter.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023279-227.dat	upx
behavioral1/files/0x0007000000023279-282.dat	upx
behavioral1/files/0x0007000000023279-283.dat	upx
behavioral1/memory/1924-284-0x00007FF6076A0000-0x00007FF607AF5000-memory.dmp	upx
behavioral1/memory/1924-285-0x00007FF6076A0000-0x00007FF607AF5000-memory.dmp	upx
behavioral1/files/0x00060000000232dc-433.dat	upx
behavioral1/files/0x00060000000232dc-434.dat	upx
behavioral1/memory/3960-436-0x00007FFBEDDD0000-0x00007FFBEE23E000-memory.dmp	upx
behavioral1/files/0x00060000000232c8-439.dat	upx
behavioral1/files/0x00060000000232d6-444.dat	upx
behavioral1/files/0x00060000000232c8-443.dat	upx
behavioral1/files/0x00060000000232d6-446.dat	upx
behavioral1/files/0x00060000000232de-456.dat	upx
behavioral1/memory/3960-457-0x00007FFC05D20000-0x00007FFC05D2F000-memory.dmp	upx
behavioral1/files/0x00060000000232de-458.dat	upx
behavioral1/memory/3960-445-0x00007FFBF3050000-0x00007FFBF3074000-memory.dmp	upx
behavioral1/files/0x00060000000232c7-461.dat	upx
behavioral1/files/0x00060000000232c7-462.dat	upx
behavioral1/memory/3960-468-0x00007FFBF0970000-0x00007FFBF099E000-memory.dmp	upx
behavioral1/files/0x00060000000232dd-467.dat	upx
behavioral1/files/0x00060000000232cb-463.dat	upx
behavioral1/files/0x00060000000232dd-469.dat	upx
behavioral1/memory/3960-470-0x00007FFBF3030000-0x00007FFBF3049000-memory.dmp	upx
behavioral1/memory/3960-471-0x00007FFBF0880000-0x00007FFBF093C000-memory.dmp	upx
behavioral1/files/0x00060000000232cb-464.dat	upx
behavioral1/files/0x00060000000232e2-473.dat	upx
behavioral1/files/0x00060000000232e2-472.dat	upx
behavioral1/memory/3960-474-0x00007FFBF0940000-0x00007FFBF096D000-memory.dmp	upx
behavioral1/memory/3960-475-0x00007FFBF0850000-0x00007FFBF087B000-memory.dmp	upx
behavioral1/memory/3960-476-0x00007FFBF0820000-0x00007FFBF0849000-memory.dmp	upx
behavioral1/memory/3960-477-0x00007FFC00D00000-0x00007FFC00D0B000-memory.dmp	upx
behavioral1/memory/3960-479-0x00007FFC00C70000-0x00007FFC00C7B000-memory.dmp	upx
behavioral1/memory/3960-481-0x00007FFBFC770000-0x00007FFBFC77B000-memory.dmp	upx
behavioral1/memory/3960-480-0x00007FFBFD8A0000-0x00007FFBFD8AC000-memory.dmp	upx
behavioral1/memory/3960-482-0x00007FFBFC3A0000-0x00007FFBFC3AC000-memory.dmp	upx
behavioral1/memory/3960-483-0x00007FFBFB0B0000-0x00007FFBFB0BC000-memory.dmp	upx
behavioral1/memory/3960-484-0x00007FFBF0810000-0x00007FFBF081C000-memory.dmp	upx
behavioral1/memory/3960-496-0x00007FFBF07B0000-0x00007FFBF07BD000-memory.dmp	upx
behavioral1/memory/3960-495-0x00007FFBF07E0000-0x00007FFBF07EB000-memory.dmp	upx
behavioral1/memory/3960-494-0x00007FFBF07F0000-0x00007FFBF07FB000-memory.dmp	upx
behavioral1/memory/3960-497-0x00007FFBF0790000-0x00007FFBF07A2000-memory.dmp	upx
behavioral1/memory/3960-498-0x00007FFBF0760000-0x00007FFBF077F000-memory.dmp	upx
behavioral1/memory/3960-499-0x00000131810E0000-0x0000013181251000-memory.dmp	upx
behavioral1/memory/3960-500-0x00007FFBFB3B0000-0x00007FFBFB3BB000-memory.dmp	upx
behavioral1/memory/3960-503-0x00007FFBF2850000-0x00007FFBF285E000-memory.dmp	upx
behavioral1/memory/3960-504-0x00007FFBF0800000-0x00007FFBF080C000-memory.dmp	upx
behavioral1/memory/3960-502-0x00007FFBF2E80000-0x00007FFBF2E8D000-memory.dmp	upx
behavioral1/memory/3960-505-0x00007FFBF07D0000-0x00007FFBF07DC000-memory.dmp	upx
behavioral1/memory/3960-508-0x00007FFBEDDD0000-0x00007FFBEE23E000-memory.dmp	upx
behavioral1/memory/3960-509-0x00007FFBF07C0000-0x00007FFBF07CC000-memory.dmp	upx
behavioral1/memory/3960-510-0x00007FFBF0780000-0x00007FFBF078C000-memory.dmp	upx
behavioral1/memory/3960-511-0x00000131810E0000-0x0000013181251000-memory.dmp	upx
behavioral1/memory/3960-513-0x00007FFBF3050000-0x00007FFBF3074000-memory.dmp	upx
behavioral1/memory/3960-512-0x00007FFBEB9E0000-0x00007FFBEBC32000-memory.dmp	upx
behavioral1/memory/3960-514-0x00007FFBEDDA0000-0x00007FFBEDDAD000-memory.dmp	upx
behavioral1/memory/3960-517-0x00007FFBEDDB0000-0x00007FFBEDDC9000-memory.dmp	upx
behavioral1/memory/3960-518-0x00007FFBECA10000-0x00007FFBECA3E000-memory.dmp	upx
behavioral1/memory/3960-519-0x00007FFBEC930000-0x00007FFBEC944000-memory.dmp	upx
behavioral1/memory/3960-516-0x00007FFBEC950000-0x00007FFBECA08000-memory.dmp	upx
behavioral1/memory/3960-520-0x00007FFBEDD90000-0x00007FFBEDD9D000-memory.dmp	upx
behavioral1/memory/3960-521-0x00007FFBF0970000-0x00007FFBF099E000-memory.dmp	upx
behavioral1/memory/3960-515-0x00007FFBE8590000-0x00007FFBE8905000-memory.dmp	upx
behavioral1/memory/3960-522-0x00007FFBF0880000-0x00007FFBF093C000-memory.dmp	upx
behavioral1/memory/3960-523-0x00007FFBEB9B0000-0x00007FFBEB9D3000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
102	ipapi.co
101	ipapi.co

Detects Pyinstaller 8 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0006000000023283-287.dat	pyinstaller
behavioral1/files/0x0006000000023283-288.dat	pyinstaller
behavioral1/files/0x0006000000023283-300.dat	pyinstaller
behavioral1/files/0x0006000000023286-334.dat	pyinstaller
behavioral1/files/0x000700000002329a-340.dat	pyinstaller
behavioral1/files/0x000700000002329a-345.dat	pyinstaller
behavioral1/files/0x000700000002329a-346.dat	pyinstaller
behavioral1/files/0x000700000002329a-432.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 289810.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
932	msedge.exe
932	msedge.exe
3892	msedge.exe
3892	msedge.exe
968	identity_helper.exe
968	identity_helper.exe
2240	msedge.exe
2240	msedge.exe
2208	msedge.exe
2208	msedge.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe
3960	MkHelper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeRestorePrivilege	4544	7zG.exe
Token: 35	4544	7zG.exe
Token: SeSecurityPrivilege	4544	7zG.exe
Token: SeSecurityPrivilege	4544	7zG.exe
Token: SeDebugPrivilege	3960	MkHelper.exe
Token: SeIncreaseQuotaPrivilege	3944	WMIC.exe
Token: SeSecurityPrivilege	3944	WMIC.exe
Token: SeTakeOwnershipPrivilege	3944	WMIC.exe
Token: SeLoadDriverPrivilege	3944	WMIC.exe
Token: SeSystemProfilePrivilege	3944	WMIC.exe
Token: SeSystemtimePrivilege	3944	WMIC.exe
Token: SeProfSingleProcessPrivilege	3944	WMIC.exe
Token: SeIncBasePriorityPrivilege	3944	WMIC.exe
Token: SeCreatePagefilePrivilege	3944	WMIC.exe
Token: SeBackupPrivilege	3944	WMIC.exe
Token: SeRestorePrivilege	3944	WMIC.exe
Token: SeShutdownPrivilege	3944	WMIC.exe
Token: SeDebugPrivilege	3944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3944	WMIC.exe
Token: SeRemoteShutdownPrivilege	3944	WMIC.exe
Token: SeUndockPrivilege	3944	WMIC.exe
Token: SeManageVolumePrivilege	3944	WMIC.exe
Token: 33	3944	WMIC.exe
Token: 34	3944	WMIC.exe
Token: 35	3944	WMIC.exe
Token: 36	3944	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3944	WMIC.exe
Token: SeSecurityPrivilege	3944	WMIC.exe
Token: SeTakeOwnershipPrivilege	3944	WMIC.exe
Token: SeLoadDriverPrivilege	3944	WMIC.exe
Token: SeSystemProfilePrivilege	3944	WMIC.exe
Token: SeSystemtimePrivilege	3944	WMIC.exe
Token: SeProfSingleProcessPrivilege	3944	WMIC.exe
Token: SeIncBasePriorityPrivilege	3944	WMIC.exe
Token: SeCreatePagefilePrivilege	3944	WMIC.exe
Token: SeBackupPrivilege	3944	WMIC.exe
Token: SeRestorePrivilege	3944	WMIC.exe
Token: SeShutdownPrivilege	3944	WMIC.exe
Token: SeDebugPrivilege	3944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3944	WMIC.exe
Token: SeRemoteShutdownPrivilege	3944	WMIC.exe
Token: SeUndockPrivilege	3944	WMIC.exe
Token: SeManageVolumePrivilege	3944	WMIC.exe
Token: 33	3944	WMIC.exe
Token: 34	3944	WMIC.exe
Token: 35	3944	WMIC.exe
Token: 36	3944	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4672	3892	msedge.exe	39
PID 3892 wrote to memory of 4672	3892	msedge.exe	39
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 2636	3892	msedge.exe	87
PID 3892 wrote to memory of 932	3892	msedge.exe	86
PID 3892 wrote to memory of 932	3892	msedge.exe	86
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88
PID 3892 wrote to memory of 5112	3892	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/aslostar9/Vedani-Crypter/archive/refs/heads/main.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x48,0x108,0x7ffc00f446f8,0x7ffc00f44708,0x7ffc00f44718
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2192,9979347087788868524,8939879189438071666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5100

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Vedani-Crypter-main\" -spe -an -ai#7zMap1254:100:7zEvent3004
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Users\Admin\Downloads\Cryptor.exe
"C:\Users\Admin\Downloads\Cryptor.exe"
1⤵
- Executes dropped EXE
PID:1924

C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\Vedani-Crypter.exe
"C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\Vedani-Crypter.exe"
1⤵
- Executes dropped EXE
PID:3676
- C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\Vedani-Crypter.exe
  "C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\Vedani-Crypter.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:772
- - C:\Users\Admin\AppData\Roaming\vedani\VedaniCrypter.exe
    "C:\Users\Admin\AppData\Roaming\vedani\VedaniCrypter.exe"
    3⤵
    - Executes dropped EXE
    PID:5072
- - C:\Users\Admin\AppData\Roaming\registerCash\MkHelper.exe
    "C:\Users\Admin\AppData\Roaming\registerCash\MkHelper.exe"
    3⤵
    - Executes dropped EXE
    PID:5044
  - - C:\Users\Admin\AppData\Roaming\registerCash\MkHelper.exe
      "C:\Users\Admin\AppData\Roaming\registerCash\MkHelper.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        5⤵
        
        PID:5052
      - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9f534b70db6a944e66007ad9116f4c2d

SHA1
65eb280205d967a4436e9b47aa0bca30736957d7

SHA256
49e894b8d6d441e9aab26fe77d2536d942706ed7bf801a87c90d0bde16e506a5

SHA512
09c71979fc8aed9f0c605fc57ac40c7258b9359078f0ad5932940d45fef04bdd03ba96e0c17afbd2d3de4212d4aaeb1183da2b95de63a4367695deeaebb060bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
468f3906a52fe9434dbc1f19b2c5b85a

SHA1
dba1265942489ebf81c6101ca2e508a343abe224

SHA256
223ecb7e721a0e30a7fa5756da63acc61b355affb7cee889c3f92543d9b7b419

SHA512
33e680e404f29b19b30d38c0f7910c2c97a7cdaf2621ff1cd617281f70c4ac50368c3b509678d8d3c95c4cdd04cd40b5468c339261f57f367128326861956096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
014d190c635b1a337ac7f9f6032b7232

SHA1
d195f5a9222ef942f0c23988098ede77be03d6cf

SHA256
aac2a2878db5528e69ba91a7ca2b09e02c07b0a17f8503021e16db1728b26588

SHA512
4336887ab555484415c52886874282e79f12fcf2b92bab66f57938adb0bc4c5a3170eef8629f150a863b9aac5c0b740bfab012c2c72b2888e7f2c907075608a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0dcfefd7505c5932000d70228744d534

SHA1
cf2fa60f2f2479d85c280eb75486a04e7166f0f6

SHA256
0e22384dd233ee066554ba4fe2cf384c3d9a54d45619050adaf3c286c6bec509

SHA512
3a9e07cc31c64de319f17c7b586786714d465b4ce22753d9b414f8ea59f2b2ef7bbacb0ab1cc2f5007121bbd72a8a1ceb94e94025fbc377f25143162ac655e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3cef402ca31e9d0875457aa5248e1866

SHA1
7e06a31767280f6b64f768964a1e79207199b207

SHA256
e972acbd772a143b3fbbdd5df1848079efb08814e0e3a19cfd7f8ce29947e639

SHA512
db3ebfd4aad22e544450d87ac2568cc7ff66d39542f859abeeff0cbf3f83f6d53c0a142bb1153c3d5c9d1a32823e8af51e7377b65263cd274ae61cbf01ee4cea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c747530aade1689adb23c113b7e44256

SHA1
5710b4e2cee1c10903c54994669c6a52ed9d59a4

SHA256
1a066423ab7ab0af1c55beb28debd3673366d15fd049fe469af8d5d56ba81a4b

SHA512
c4f62bfb4dc50d7107cbd3704c605c4e332d4921dcaa8ed14bed93548b33f32a4ccdc0abc214782506af3908215d4d9b53e8f42f909b23f3f46b1459576990cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ec73a47aac15032e75e9d2e9353e3838

SHA1
f05c4257db9d0413252057bccac3648192ce6d93

SHA256
195a67f41d18b897070cf63f1f5a45e4c48a5f8386ae609941a9eb28655c6f53

SHA512
76f36b27239747bdf3e01a90fb649ca120cff31e1c92321669ff30eef85bb44d14455a829b1d21f6bfa4a2ec52c1e6fc55ef99a7275d77694f28062ec8fa10f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5839e7.TMP

Filesize
371B

MD5
5b3566f6c2294aa12b910646e528ef44

SHA1
4d951c0bc3688b20bfb48251e00fa3c30a61c631

SHA256
0720e4a2437d97df6b1c51367e8ad08d405f37e630956b0c197da7eca807a6d3

SHA512
89743ac2de09b87d788e3149f96173a35ec412bde85e9e68a9341c50f9b3128dcc71b0e3d7808554419277b5ad32625766fb334efc45e740701d2ac1923b0a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7cb2e8b-ccad-4db0-8bf8-82dc71740e1b.tmp

Filesize
24KB

MD5
10f5b64000466c1e6da25fb5a0115924

SHA1
cb253bacf2b087c4040eb3c6a192924234f68639

SHA256
d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b

SHA512
8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
45a175f274b7746f0b60b5b989e0343c

SHA1
eccf7d9850ef8b548f81cc83c500a7915405d57d

SHA256
60f7e5e2ab4119acf6cc8da9f111f3e7bff674ceb58e5097614d1943a9ce83b0

SHA512
421a79c9bdb8c682a4f3d2fae0db88378f3f3e1f350a1d6643ab66cd886466b0ae4e384becff3334067a44ddd8cd8d8467268139957af5596bd35ca3b2ef8fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
20e13702b22ac7bbffc5b1c4dd016762

SHA1
b80d261335fc9b3438cb5fd8f70089f807b2580b

SHA256
535205f167f708c374fbed64a6a12fa6d746f89cb2fdab9bb28d9f43235dad66

SHA512
31a9fdccc0bde26aa7f4f82778084a0e2241ad8eadeee3c0af154449887de2509f09c0dfc1459744d86d50dd759b713fdab2f959ef094bd637243a6586f1a4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36762\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36762\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36762\_bz2.pyd

Filesize
81KB

MD5
bbe89cf70b64f38c67b7bf23c0ea8a48

SHA1
44577016e9c7b463a79b966b67c3ecc868957470

SHA256
775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

SHA512
3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36762\_bz2.pyd

Filesize
81KB

MD5
bbe89cf70b64f38c67b7bf23c0ea8a48

SHA1
44577016e9c7b463a79b966b67c3ecc868957470

SHA256
775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

SHA512
3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36762\_lzma.pyd

Filesize
153KB

MD5
0a94c9f3d7728cf96326db3ab3646d40

SHA1
8081df1dca4a8520604e134672c4be79eb202d14

SHA256
0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31

SHA512
6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36762\_lzma.pyd

Filesize
153KB

MD5
0a94c9f3d7728cf96326db3ab3646d40

SHA1
8081df1dca4a8520604e134672c4be79eb202d14

SHA256
0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31

SHA512
6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36762\base_library.zip

Filesize
812KB

MD5
fbd6be906ac7cd45f1d98f5cb05f8275

SHA1
5d563877a549f493da805b4d049641604a6a0408

SHA256
ae35709e6b8538827e3999e61a0345680c5167962296ac7bef62d6b813227fb0

SHA512
1547b02875f3e547c4f5e15c964719c93d7088c7f4fd044f6561bebd29658a54ef044211f9d5cfb4570ca49ed0f17b08011d27fe85914e8c3ea12024c8071e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36762\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36762\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\VCRUNTIME140_1.dll

Filesize
48KB

MD5
bba9680bc310d8d25e97b12463196c92

SHA1
9a480c0cf9d377a4caedd4ea60e90fa79001f03a

SHA256
e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab

SHA512
1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\VCRUNTIME140_1.dll

Filesize
48KB

MD5
bba9680bc310d8d25e97b12463196c92

SHA1
9a480c0cf9d377a4caedd4ea60e90fa79001f03a

SHA256
e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab

SHA512
1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\_bz2.pyd

Filesize
47KB

MD5
758fff1d194a7ac7a1e3d98bcf143a44

SHA1
de1c61a8e1fb90666340f8b0a34e4d8bfc56da07

SHA256
f5e913a9f2adf7d599ea9bb105e144ba11699bbcb1514e73edcf7e062354e708

SHA512
468d7c52f14812d5bde1e505c95cb630e22d71282bda05bf66324f31560bfa06095cf60fc0d34877f8b361ccd65a1b61d0fd1f91d52facb0baf8e74f3fed31cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\_bz2.pyd

Filesize
47KB

MD5
758fff1d194a7ac7a1e3d98bcf143a44

SHA1
de1c61a8e1fb90666340f8b0a34e4d8bfc56da07

SHA256
f5e913a9f2adf7d599ea9bb105e144ba11699bbcb1514e73edcf7e062354e708

SHA512
468d7c52f14812d5bde1e505c95cb630e22d71282bda05bf66324f31560bfa06095cf60fc0d34877f8b361ccd65a1b61d0fd1f91d52facb0baf8e74f3fed31cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\_ctypes.pyd

Filesize
56KB

MD5
6ca9a99c75a0b7b6a22681aa8e5ad77b

SHA1
dd1118b7d77be6bb33b81da65f6b5dc153a4b1e8

SHA256
d39390552c55d8fd4940864905cd4437bc3f8efe7ff3ca220543b2c0efab04f8

SHA512
b0b5f2979747d2f6796d415dd300848f32b4e79ede59827ac447af0f4ea8709b60d6935d09e579299b3bc54b6c0f10972f17f6c0d1759c5388ad5b14689a23fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\_ctypes.pyd

Filesize
56KB

MD5
6ca9a99c75a0b7b6a22681aa8e5ad77b

SHA1
dd1118b7d77be6bb33b81da65f6b5dc153a4b1e8

SHA256
d39390552c55d8fd4940864905cd4437bc3f8efe7ff3ca220543b2c0efab04f8

SHA512
b0b5f2979747d2f6796d415dd300848f32b4e79ede59827ac447af0f4ea8709b60d6935d09e579299b3bc54b6c0f10972f17f6c0d1759c5388ad5b14689a23fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\_lzma.pyd

Filesize
84KB

MD5
abceeceaeff3798b5b0de412af610f58

SHA1
c3c94c120b5bed8bccf8104d933e96ac6e42ca90

SHA256
216aa4bb6f62dd250fd6d2dcde14709aa82e320b946a21edeec7344ed6c2c62e

SHA512
3e1a2eb86605aa851a0c5153f7be399f6259ecaad86dbcbf12eeae5f985dc2ea2ab25683285e02b787a5b75f7df70b4182ae8f1567946f99ad2ec7b27d4c7955

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\_lzma.pyd

Filesize
84KB

MD5
abceeceaeff3798b5b0de412af610f58

SHA1
c3c94c120b5bed8bccf8104d933e96ac6e42ca90

SHA256
216aa4bb6f62dd250fd6d2dcde14709aa82e320b946a21edeec7344ed6c2c62e

SHA512
3e1a2eb86605aa851a0c5153f7be399f6259ecaad86dbcbf12eeae5f985dc2ea2ab25683285e02b787a5b75f7df70b4182ae8f1567946f99ad2ec7b27d4c7955

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\base_library.zip

Filesize
812KB

MD5
fbd6be906ac7cd45f1d98f5cb05f8275

SHA1
5d563877a549f493da805b4d049641604a6a0408

SHA256
ae35709e6b8538827e3999e61a0345680c5167962296ac7bef62d6b813227fb0

SHA512
1547b02875f3e547c4f5e15c964719c93d7088c7f4fd044f6561bebd29658a54ef044211f9d5cfb4570ca49ed0f17b08011d27fe85914e8c3ea12024c8071e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\libffi-7.dll

Filesize
23KB

MD5
b5150b41ca910f212a1dd236832eb472

SHA1
a17809732c562524b185953ffe60dfa91ba3ce7d

SHA256
1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a

SHA512
9e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\libffi-7.dll

Filesize
23KB

MD5
b5150b41ca910f212a1dd236832eb472

SHA1
a17809732c562524b185953ffe60dfa91ba3ce7d

SHA256
1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a

SHA512
9e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\python3.DLL

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\python3.dll

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\python3.dll

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\pythoncom310.dll

Filesize
193KB

MD5
9051abae01a41ea13febdea7d93470c0

SHA1
b06bd4cd4fd453eb827a108e137320d5dc3a002f

SHA256
f12c8141d4795719035c89ff459823ed6174564136020739c106f08a6257b399

SHA512
58d8277ec4101ad468dd8c4b4a9353ab684ecc391e5f9db37de44d5c3316c17d4c7a5ffd547ce9b9a08c56e3dd6d3c87428eae12144dfb72fc448b0f2cfc47da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\pythoncom310.dll

Filesize
193KB

MD5
9051abae01a41ea13febdea7d93470c0

SHA1
b06bd4cd4fd453eb827a108e137320d5dc3a002f

SHA256
f12c8141d4795719035c89ff459823ed6174564136020739c106f08a6257b399

SHA512
58d8277ec4101ad468dd8c4b4a9353ab684ecc391e5f9db37de44d5c3316c17d4c7a5ffd547ce9b9a08c56e3dd6d3c87428eae12144dfb72fc448b0f2cfc47da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\pywintypes310.dll

Filesize
62KB

MD5
6f2aa8fa02f59671f99083f9cef12cda

SHA1
9fd0716bcde6ac01cd916be28aa4297c5d4791cd

SHA256
1a15d98d4f9622fa81b60876a5f359707a88fbbbae3ae4e0c799192c378ef8c6

SHA512
f5d5112e63307068cdb1d0670fe24b65a9f4942a39416f537bdbc17dedfd99963861bf0f4e94299cdce874816f27b3d86c4bebb889c3162c666d5ee92229c211

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\pywintypes310.dll

Filesize
62KB

MD5
6f2aa8fa02f59671f99083f9cef12cda

SHA1
9fd0716bcde6ac01cd916be28aa4297c5d4791cd

SHA256
1a15d98d4f9622fa81b60876a5f359707a88fbbbae3ae4e0c799192c378ef8c6

SHA512
f5d5112e63307068cdb1d0670fe24b65a9f4942a39416f537bdbc17dedfd99963861bf0f4e94299cdce874816f27b3d86c4bebb889c3162c666d5ee92229c211

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\win32api.pyd

Filesize
48KB

MD5
561f419a2b44158646ee13cd9af44c60

SHA1
93212788de48e0a91e603d74f071a7c8f42fe39b

SHA256
631465da2a1dad0cb11cd86b14b4a0e4c7708d5b1e8d6f40ae9e794520c3aaf7

SHA512
d76ab089f6dc1beffd5247e81d267f826706e60604a157676e6cbc3b3447f5bcee66a84bf35c21696c020362fadd814c3e0945942cdc5e0dfe44c0bca169945c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50442\win32api.pyd

Filesize
48KB

MD5
561f419a2b44158646ee13cd9af44c60

SHA1
93212788de48e0a91e603d74f071a7c8f42fe39b

SHA256
631465da2a1dad0cb11cd86b14b4a0e4c7708d5b1e8d6f40ae9e794520c3aaf7

SHA512
d76ab089f6dc1beffd5247e81d267f826706e60604a157676e6cbc3b3447f5bcee66a84bf35c21696c020362fadd814c3e0945942cdc5e0dfe44c0bca169945c

Download Submit
C:\Users\Admin\AppData\Roaming\registerCash\MkHelper.exe

Filesize
12.7MB

MD5
0811fe184692fe70d40265aa7e1be94b

SHA1
d8c1c47e269370c9904d0e095981d1da4772277f

SHA256
8d32d76c805b9841a47ce65545d9acf2f2eb680962628f6940df8c2568c84c59

SHA512
77472687c13e86319bde8b1dbdb0ad4d3b854a9aff339f60ede50aa18694df0c4fad43ff1eef2ed5f95e28fd0733cfbc4dac6633934206bea480a28faca9fc73

Download Submit
C:\Users\Admin\AppData\Roaming\registerCash\MkHelper.exe

Filesize
12.7MB

MD5
0811fe184692fe70d40265aa7e1be94b

SHA1
d8c1c47e269370c9904d0e095981d1da4772277f

SHA256
8d32d76c805b9841a47ce65545d9acf2f2eb680962628f6940df8c2568c84c59

SHA512
77472687c13e86319bde8b1dbdb0ad4d3b854a9aff339f60ede50aa18694df0c4fad43ff1eef2ed5f95e28fd0733cfbc4dac6633934206bea480a28faca9fc73

Download Submit
C:\Users\Admin\AppData\Roaming\registerCash\MkHelper.exe

Filesize
12.7MB

MD5
0811fe184692fe70d40265aa7e1be94b

SHA1
d8c1c47e269370c9904d0e095981d1da4772277f

SHA256
8d32d76c805b9841a47ce65545d9acf2f2eb680962628f6940df8c2568c84c59

SHA512
77472687c13e86319bde8b1dbdb0ad4d3b854a9aff339f60ede50aa18694df0c4fad43ff1eef2ed5f95e28fd0733cfbc4dac6633934206bea480a28faca9fc73

Download Submit
C:\Users\Admin\AppData\Roaming\registerCash\MkHelper.exe

Filesize
12.7MB

MD5
0811fe184692fe70d40265aa7e1be94b

SHA1
d8c1c47e269370c9904d0e095981d1da4772277f

SHA256
8d32d76c805b9841a47ce65545d9acf2f2eb680962628f6940df8c2568c84c59

SHA512
77472687c13e86319bde8b1dbdb0ad4d3b854a9aff339f60ede50aa18694df0c4fad43ff1eef2ed5f95e28fd0733cfbc4dac6633934206bea480a28faca9fc73

Download Submit
C:\Users\Admin\AppData\Roaming\vedani\VedaniCrypter.exe

Filesize
5.2MB

MD5
e7b448f71bfabbcf84fc5f7c8cc219a6

SHA1
fe5f861a03207da4fe6b4093bbdc5588e6a0fe07

SHA256
522497cf6abdb91e9d64e0bc2f0ddedab87f74eefccb43a9fe222cf4bba570f0

SHA512
c1a5f8008b5a421db803447d7b443c99bf081920347be1fa417279b3c1857362e262d32bab1b893684daa0cbb8a26735090d28efb188f81351889b7f56a48b06

Download Submit
C:\Users\Admin\AppData\Roaming\vedani\VedaniCrypter.exe

Filesize
5.2MB

MD5
e7b448f71bfabbcf84fc5f7c8cc219a6

SHA1
fe5f861a03207da4fe6b4093bbdc5588e6a0fe07

SHA256
522497cf6abdb91e9d64e0bc2f0ddedab87f74eefccb43a9fe222cf4bba570f0

SHA512
c1a5f8008b5a421db803447d7b443c99bf081920347be1fa417279b3c1857362e262d32bab1b893684daa0cbb8a26735090d28efb188f81351889b7f56a48b06

Download Submit
C:\Users\Admin\AppData\Roaming\vedani\VedaniCrypter.exe

Filesize
5.2MB

MD5
e7b448f71bfabbcf84fc5f7c8cc219a6

SHA1
fe5f861a03207da4fe6b4093bbdc5588e6a0fe07

SHA256
522497cf6abdb91e9d64e0bc2f0ddedab87f74eefccb43a9fe222cf4bba570f0

SHA512
c1a5f8008b5a421db803447d7b443c99bf081920347be1fa417279b3c1857362e262d32bab1b893684daa0cbb8a26735090d28efb188f81351889b7f56a48b06

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Cryptor.exe

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 289810.crdownload

Filesize
2.4MB

MD5
28727dfa612feae2550d53b2c2667a8b

SHA1
5decdf62190057c77cee932e1f7eae5c21ccb8c7

SHA256
6412a0081efe5e2dcfcfb501c0a1b87e20d8cba9677e3acda99152a1a0206eec

SHA512
bf5b9bf8ef48c795e2ae5c92d31d65e1c66d5d194d2c333f00e0968e0e2d71b1525498db86ab2f1bb9e5185c470218d969f44ab4bdce0d22d4da22d6f38e84c4

Download Submit
C:\Users\Admin\Downloads\Vedani-Crypter-main.zip

Filesize
30.0MB

MD5
97223f6b70147f52c007e2eaba2954dd

SHA1
0943d6f5d1caa63b45cb2ef85a0b9fd5a99589e3

SHA256
d07c4be1329f43849d57aab05d096345a4d7dfc68e2dd82ca45ecf606b6e3534

SHA512
427dde72315e0dcc431a35f3c302036376cd5b2e6fc1fcd4876ef23675beb8e9de165edcb5d84f984a5431b6e3d0d154ad87032dfacf0f3af0a38f64af2f473d

Download Submit
C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\Vedani-Crypter.exe

Filesize
6.2MB

MD5
f982e40c831cac8ad143723b49990772

SHA1
e50f97163936e22cf9012b883f73a0eeaf4d90ad

SHA256
13a169db433164fda1023703b80b6dba5fbd1bb1b2fa37a71a0749024f783c2b

SHA512
6c1de77ae2e5376515ad278abdd2d539e9200b3bf1640174e721fef9a9bb2e8f87766b1d62e54917aaea331b839bcba798ca50ba06fa4f0602f12a75bcd63cc7

Download Submit
C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\Vedani-Crypter.exe

Filesize
6.2MB

MD5
f982e40c831cac8ad143723b49990772

SHA1
e50f97163936e22cf9012b883f73a0eeaf4d90ad

SHA256
13a169db433164fda1023703b80b6dba5fbd1bb1b2fa37a71a0749024f783c2b

SHA512
6c1de77ae2e5376515ad278abdd2d539e9200b3bf1640174e721fef9a9bb2e8f87766b1d62e54917aaea331b839bcba798ca50ba06fa4f0602f12a75bcd63cc7

Download Submit
C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\Vedani-Crypter.exe

Filesize
6.2MB

MD5
f982e40c831cac8ad143723b49990772

SHA1
e50f97163936e22cf9012b883f73a0eeaf4d90ad

SHA256
13a169db433164fda1023703b80b6dba5fbd1bb1b2fa37a71a0749024f783c2b

SHA512
6c1de77ae2e5376515ad278abdd2d539e9200b3bf1640174e721fef9a9bb2e8f87766b1d62e54917aaea331b839bcba798ca50ba06fa4f0602f12a75bcd63cc7

Download Submit
C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\XanderUI.dll

Filesize
185KB

MD5
b7498196f0a200cc729703e6127eb3cb

SHA1
1fb5e3127987b38c1e9309f7a65dd2f45a5f5754

SHA256
cdf2ff8c0970f4144500c81c5678055ded70c05285ba3d3ff04e44fa78d9ce64

SHA512
0922ebc190c7af93655c833b8e3ba3f98d49011dbbc822f633813d2e47db8b7f1a6a22fbfcb08d5fcebc11bd90a9d3392fe1c40af7391048c70d273ef17a86f1

Download Submit
C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\libs\obsfucation.dat

Filesize
12.7MB

MD5
0811fe184692fe70d40265aa7e1be94b

SHA1
d8c1c47e269370c9904d0e095981d1da4772277f

SHA256
8d32d76c805b9841a47ce65545d9acf2f2eb680962628f6940df8c2568c84c59

SHA512
77472687c13e86319bde8b1dbdb0ad4d3b854a9aff339f60ede50aa18694df0c4fad43ff1eef2ed5f95e28fd0733cfbc4dac6633934206bea480a28faca9fc73

Download Submit
C:\Users\Admin\Downloads\Vedani-Crypter-main\Vedani-Crypter\libs\source.dat

Filesize
5.2MB

MD5
e7b448f71bfabbcf84fc5f7c8cc219a6

SHA1
fe5f861a03207da4fe6b4093bbdc5588e6a0fe07

SHA256
522497cf6abdb91e9d64e0bc2f0ddedab87f74eefccb43a9fe222cf4bba570f0

SHA512
c1a5f8008b5a421db803447d7b443c99bf081920347be1fa417279b3c1857362e262d32bab1b893684daa0cbb8a26735090d28efb188f81351889b7f56a48b06

Download Submit
memory/1924-285-0x00007FF6076A0000-0x00007FF607AF5000-memory.dmp

Filesize
4.3MB

Download
memory/1924-284-0x00007FF6076A0000-0x00007FF607AF5000-memory.dmp

Filesize
4.3MB

Download
memory/3960-480-0x00007FFBFD8A0000-0x00007FFBFD8AC000-memory.dmp

Filesize
48KB

Download
memory/3960-525-0x00007FFBEC920000-0x00007FFBEC92B000-memory.dmp

Filesize
44KB

Download
memory/3960-445-0x00007FFBF3050000-0x00007FFBF3074000-memory.dmp

Filesize
144KB

Download
memory/3960-470-0x00007FFBF3030000-0x00007FFBF3049000-memory.dmp

Filesize
100KB

Download
memory/3960-471-0x00007FFBF0880000-0x00007FFBF093C000-memory.dmp

Filesize
752KB

Download
memory/3960-457-0x00007FFC05D20000-0x00007FFC05D2F000-memory.dmp

Filesize
60KB

Download
memory/3960-436-0x00007FFBEDDD0000-0x00007FFBEE23E000-memory.dmp

Filesize
4.4MB

Download
memory/3960-574-0x00007FFBEC910000-0x00007FFBEC91A000-memory.dmp

Filesize
40KB

Download
memory/3960-474-0x00007FFBF0940000-0x00007FFBF096D000-memory.dmp

Filesize
180KB

Download
memory/3960-475-0x00007FFBF0850000-0x00007FFBF087B000-memory.dmp

Filesize
172KB

Download
memory/3960-476-0x00007FFBF0820000-0x00007FFBF0849000-memory.dmp

Filesize
164KB

Download
memory/3960-477-0x00007FFC00D00000-0x00007FFC00D0B000-memory.dmp

Filesize
44KB

Download
memory/3960-575-0x00007FFBEB990000-0x00007FFBEB9AC000-memory.dmp

Filesize
112KB

Download
memory/3960-479-0x00007FFC00C70000-0x00007FFC00C7B000-memory.dmp

Filesize
44KB

Download
memory/3960-481-0x00007FFBFC770000-0x00007FFBFC77B000-memory.dmp

Filesize
44KB

Download
memory/3960-571-0x00007FFBEA760000-0x00007FFBEA878000-memory.dmp

Filesize
1.1MB

Download
memory/3960-482-0x00007FFBFC3A0000-0x00007FFBFC3AC000-memory.dmp

Filesize
48KB

Download
memory/3960-483-0x00007FFBFB0B0000-0x00007FFBFB0BC000-memory.dmp

Filesize
48KB

Download
memory/3960-484-0x00007FFBF0810000-0x00007FFBF081C000-memory.dmp

Filesize
48KB

Download
memory/3960-569-0x00007FFBEB9B0000-0x00007FFBEB9D3000-memory.dmp

Filesize
140KB

Download
memory/3960-496-0x00007FFBF07B0000-0x00007FFBF07BD000-memory.dmp

Filesize
52KB

Download
memory/3960-495-0x00007FFBF07E0000-0x00007FFBF07EB000-memory.dmp

Filesize
44KB

Download
memory/3960-494-0x00007FFBF07F0000-0x00007FFBF07FB000-memory.dmp

Filesize
44KB

Download
memory/3960-497-0x00007FFBF0790000-0x00007FFBF07A2000-memory.dmp

Filesize
72KB

Download
memory/3960-498-0x00007FFBF0760000-0x00007FFBF077F000-memory.dmp

Filesize
124KB

Download
memory/3960-499-0x00000131810E0000-0x0000013181251000-memory.dmp

Filesize
1.4MB

Download
memory/3960-500-0x00007FFBFB3B0000-0x00007FFBFB3BB000-memory.dmp

Filesize
44KB

Download
memory/3960-565-0x00007FFBEC950000-0x00007FFBECA08000-memory.dmp

Filesize
736KB

Download
memory/3960-503-0x00007FFBF2850000-0x00007FFBF285E000-memory.dmp

Filesize
56KB

Download
memory/3960-504-0x00007FFBF0800000-0x00007FFBF080C000-memory.dmp

Filesize
48KB

Download
memory/3960-502-0x00007FFBF2E80000-0x00007FFBF2E8D000-memory.dmp

Filesize
52KB

Download
memory/3960-505-0x00007FFBF07D0000-0x00007FFBF07DC000-memory.dmp

Filesize
48KB

Download
memory/3960-508-0x00007FFBEDDD0000-0x00007FFBEE23E000-memory.dmp

Filesize
4.4MB

Download
memory/3960-509-0x00007FFBF07C0000-0x00007FFBF07CC000-memory.dmp

Filesize
48KB

Download
memory/3960-510-0x00007FFBF0780000-0x00007FFBF078C000-memory.dmp

Filesize
48KB

Download
memory/3960-511-0x00000131810E0000-0x0000013181251000-memory.dmp

Filesize
1.4MB

Download
memory/3960-513-0x00007FFBF3050000-0x00007FFBF3074000-memory.dmp

Filesize
144KB

Download
memory/3960-512-0x00007FFBEB9E0000-0x00007FFBEBC32000-memory.dmp

Filesize
2.3MB

Download
memory/3960-514-0x00007FFBEDDA0000-0x00007FFBEDDAD000-memory.dmp

Filesize
52KB

Download
memory/3960-517-0x00007FFBEDDB0000-0x00007FFBEDDC9000-memory.dmp

Filesize
100KB

Download
memory/3960-518-0x00007FFBECA10000-0x00007FFBECA3E000-memory.dmp

Filesize
184KB

Download
memory/3960-519-0x00007FFBEC930000-0x00007FFBEC944000-memory.dmp

Filesize
80KB

Download
memory/3960-516-0x00007FFBEC950000-0x00007FFBECA08000-memory.dmp

Filesize
736KB

Download
memory/3960-520-0x00007FFBEDD90000-0x00007FFBEDD9D000-memory.dmp

Filesize
52KB

Download
memory/3960-521-0x00007FFBF0970000-0x00007FFBF099E000-memory.dmp

Filesize
184KB

Download
memory/3960-515-0x00007FFBE8590000-0x00007FFBE8905000-memory.dmp

Filesize
3.5MB

Download
memory/3960-522-0x00007FFBF0880000-0x00007FFBF093C000-memory.dmp

Filesize
752KB

Download
memory/3960-523-0x00007FFBEB9B0000-0x00007FFBEB9D3000-memory.dmp

Filesize
140KB

Download
memory/3960-524-0x00007FFBEA760000-0x00007FFBEA878000-memory.dmp

Filesize
1.1MB

Download
memory/3960-468-0x00007FFBF0970000-0x00007FFBF099E000-memory.dmp

Filesize
184KB

Download
memory/3960-526-0x00007FFBEC910000-0x00007FFBEC91A000-memory.dmp

Filesize
40KB

Download
memory/3960-527-0x00007FFBEB990000-0x00007FFBEB9AC000-memory.dmp

Filesize
112KB

Download
memory/3960-530-0x00007FFBEDDD0000-0x00007FFBEE23E000-memory.dmp

Filesize
4.4MB

Download
memory/3960-532-0x00007FFC05D20000-0x00007FFC05D2F000-memory.dmp

Filesize
60KB

Download
memory/3960-531-0x00007FFBF3050000-0x00007FFBF3074000-memory.dmp

Filesize
144KB

Download
memory/3960-534-0x00007FFBF3030000-0x00007FFBF3049000-memory.dmp

Filesize
100KB

Download
memory/3960-535-0x00007FFBF0940000-0x00007FFBF096D000-memory.dmp

Filesize
180KB

Download
memory/3960-533-0x00007FFBF0970000-0x00007FFBF099E000-memory.dmp

Filesize
184KB

Download
memory/3960-536-0x00007FFBF0880000-0x00007FFBF093C000-memory.dmp

Filesize
752KB

Download
memory/3960-537-0x00007FFBF0850000-0x00007FFBF087B000-memory.dmp

Filesize
172KB

Download
memory/3960-538-0x00007FFBF0820000-0x00007FFBF0849000-memory.dmp

Filesize
164KB

Download
memory/3960-539-0x00007FFC00D00000-0x00007FFC00D0B000-memory.dmp

Filesize
44KB

Download
memory/3960-540-0x00007FFC00C70000-0x00007FFC00C7B000-memory.dmp

Filesize
44KB

Download
memory/3960-541-0x00007FFBFD8A0000-0x00007FFBFD8AC000-memory.dmp

Filesize
48KB

Download
memory/3960-543-0x00007FFBFC3A0000-0x00007FFBFC3AC000-memory.dmp

Filesize
48KB

Download
memory/3960-545-0x00007FFBFB0B0000-0x00007FFBFB0BC000-memory.dmp

Filesize
48KB

Download
memory/3960-546-0x00007FFBF2E80000-0x00007FFBF2E8D000-memory.dmp

Filesize
52KB

Download
memory/3960-547-0x00007FFBF2850000-0x00007FFBF285E000-memory.dmp

Filesize
56KB

Download
memory/3960-544-0x00007FFBFB3B0000-0x00007FFBFB3BB000-memory.dmp

Filesize
44KB

Download
memory/3960-548-0x00007FFBF0810000-0x00007FFBF081C000-memory.dmp

Filesize
48KB

Download
memory/3960-549-0x00007FFBF0800000-0x00007FFBF080C000-memory.dmp

Filesize
48KB

Download
memory/3960-542-0x00007FFBFC770000-0x00007FFBFC77B000-memory.dmp

Filesize
44KB

Download
memory/3960-550-0x00007FFBF07F0000-0x00007FFBF07FB000-memory.dmp

Filesize
44KB

Download
memory/3960-551-0x00007FFBF07E0000-0x00007FFBF07EB000-memory.dmp

Filesize
44KB

Download
memory/3960-557-0x00007FFBF0760000-0x00007FFBF077F000-memory.dmp

Filesize
124KB

Download
memory/3960-558-0x00000131810E0000-0x0000013181251000-memory.dmp

Filesize
1.4MB

Download
memory/3960-556-0x00007FFBF0780000-0x00007FFBF078C000-memory.dmp

Filesize
48KB

Download
memory/3960-559-0x00007FFBEB9E0000-0x00007FFBEBC32000-memory.dmp

Filesize
2.3MB

Download
memory/3960-555-0x00007FFBF0790000-0x00007FFBF07A2000-memory.dmp

Filesize
72KB

Download
memory/3960-554-0x00007FFBF07B0000-0x00007FFBF07BD000-memory.dmp

Filesize
52KB

Download
memory/3960-553-0x00007FFBF07C0000-0x00007FFBF07CC000-memory.dmp

Filesize
48KB

Download
memory/3960-552-0x00007FFBF07D0000-0x00007FFBF07DC000-memory.dmp

Filesize
48KB

Download
memory/3960-560-0x00000131818A0000-0x00000131818EE000-memory.dmp

Filesize
312KB

Download
memory/3960-561-0x00007FFBEDDB0000-0x00007FFBEDDC9000-memory.dmp

Filesize
100KB

Download
memory/3960-562-0x00007FFBEDDA0000-0x00007FFBEDDAD000-memory.dmp

Filesize
52KB

Download
memory/3960-563-0x00007FFBECA10000-0x00007FFBECA3E000-memory.dmp

Filesize
184KB

Download
memory/3960-564-0x00007FFBE8590000-0x00007FFBE8905000-memory.dmp

Filesize
3.5MB

Download
memory/3960-566-0x00007FFBEC930000-0x00007FFBEC944000-memory.dmp

Filesize
80KB

Download
memory/3960-567-0x00007FFBEDD90000-0x00007FFBEDD9D000-memory.dmp

Filesize
52KB

Download
memory/3960-568-0x00007FFBEC920000-0x00007FFBEC92B000-memory.dmp

Filesize
44KB

Download
memory/5072-501-0x00000210573B0000-0x00000210573C0000-memory.dmp

Filesize
64KB

Download
memory/5072-338-0x000002103C7E0000-0x000002103CD22000-memory.dmp

Filesize
5.3MB

Download
memory/5072-343-0x00007FFBED180000-0x00007FFBEDC41000-memory.dmp

Filesize
10.8MB

Download
memory/5072-478-0x00007FFBED180000-0x00007FFBEDC41000-memory.dmp

Filesize
10.8MB

Download
memory/5072-351-0x00000210573B0000-0x00000210573C0000-memory.dmp

Filesize
64KB

Download
memory/5072-611-0x0000021057330000-0x0000021057364000-memory.dmp

Filesize
208KB

Download
memory/5072-612-0x00000210573B0000-0x00000210573C0000-memory.dmp

Filesize
64KB

Download
memory/5072-613-0x00000210573B0000-0x00000210573C0000-memory.dmp

Filesize
64KB

Download
memory/5072-615-0x00007FFBED180000-0x00007FFBEDC41000-memory.dmp

Filesize
10.8MB

Download