Overview

overview

8

Static

static

1

RogueKiller_setup.exe

windows11-21h2-x64

8

Resubmissions

14-01-2024 02:19

240114-csct8sachp 8

31-12-2023 19:07

231231-xsrnlscfdj 8

Analysis

  • max time kernel
    438s
  • max time network
    437s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-01-2024 02:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RogueKiller_setup.exe

  • Size

    45.6MB

  • MD5

    cfecd53411665143798a57b8986c46dc

  • SHA1

    156213b283a4785cb703faf2cbf5652ef534e36d

  • SHA256

    c6ba4aed326371d060de64f65b0093af955059b75fbe1f07975d9065bb14a459

  • SHA512

    3e2417f5555d692a7ecd9872be83c35f8ef1b0abdae29ea3f75b59902dc8cd762b53bff2ccb768eade33caf0d5977000f8e05d6baa554c93c52353c9d52108f2

  • SSDEEP

    786432:KHrkPtFKzg9pIv/VuicHlALX1hnyRgZBqFZCcOvz/hGkpjbgi7WP7ywDcgiMjizi:KsIz4aVhcqbS4BqFpOvz/tpj8P7yw9Oi

Score
8/10
bootkitdiscoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 13 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Users\Admin\AppData\Local\Temp\is-7P8TL.tmp\RogueKiller_setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7P8TL.tmp\RogueKiller_setup.tmp" /SL5="$A00DC,47471103,136192,C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Program Files\RogueKiller\RogueKillerSvc.exe
        "C:\Program Files\RogueKiller\RogueKillerSvc.exe" -accept_eula
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2776
  • C:\Program Files\RogueKiller\RogueKillerSvc.exe
    "C:\Program Files\RogueKiller\RogueKillerSvc.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Executes dropped EXE
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Program Files\RogueKiller\RogueKiller64.exe
      -minimize
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Modifies data under HKEY_USERS
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: LoadsDriver
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\RogueKiller\roguekillershell.dll"
        3⤵
        • Loads dropped DLL
        • Registers COM server for autorun
        • Modifies registry class
        PID:1240
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4888
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffa8b183cb8,0x7ffa8b183cc8,0x7ffa8b183cd8
        2⤵
          PID:232
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
          2⤵
            PID:944
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1936
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
            2⤵
              PID:2364
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
              2⤵
                PID:3176
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                2⤵
                  PID:2124
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
                  2⤵
                    PID:4656
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
                    2⤵
                      PID:2860
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
                      2⤵
                        PID:844
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
                        2⤵
                          PID:3024
                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:224
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
                          2⤵
                            PID:2028
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:776
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                            2⤵
                              PID:3292
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
                              2⤵
                                PID:1900
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
                                2⤵
                                  PID:2744
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5712 /prefetch:8
                                  2⤵
                                    PID:844
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12526597460734147050,2283312150838466748,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4868 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4696
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1648
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4332
                                    • C:\Windows\System32\zdfhcz.exe
                                      "C:\Windows\System32\zdfhcz.exe"
                                      1⤵
                                        PID:976
                                      • C:\Windows\system32\taskmgr.exe
                                        "C:\Windows\system32\taskmgr.exe" /0
                                        1⤵
                                        • Checks SCSI registry key(s)
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:1472

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files\RogueKiller\RogueKiller64.exe
                                        Filesize

                                        308KB

                                        MD5

                                        bccf4f8e65082200d22ea1d2505eca65

                                        SHA1

                                        991d9d7e3c79b3ff29cf3c5c28c4edd8d562f766

                                        SHA256

                                        d8a566d748d6c7feaaaffe8882eef3b90f25cdcfa6564d34ebc0085912d2837f

                                        SHA512

                                        e4d7d628bcba783a5ba46aebef16d87c0fcf8163579baaa2aa738f913d2e11b8b4553e1b32e5abdf02a8fa0ad98be44d3a3f41388779135ed4dfddfc6e637721

                                        Download Submit

                                      • C:\Program Files\RogueKiller\RogueKiller64.exe
                                        Filesize

                                        4.6MB

                                        MD5

                                        c1c13d8e6ad72c6148bfafc4b86a5fde

                                        SHA1

                                        d387187ca13e3f29fb157b01e7e4b30823b65e65

                                        SHA256

                                        ae5bfa751203624e62ad4881f4cc9750c975ceb277bfe5ad77ac74514a01a95c

                                        SHA512

                                        81d1795ca8d9e90d99c1aa3053fe81186dec2b28c84be19919dfb232a76d71c26316506722c36bed97504256bcecdf641140455c2f0e7cbaf9137adb0f8bf40e

                                        Download Submit

                                      • C:\Program Files\RogueKiller\RogueKiller64.exe
                                        Filesize

                                        720KB

                                        MD5

                                        9572a23e87e60ff7d4f1821619da041a

                                        SHA1

                                        7631538c7b72f1318597de443bf6ad3819f0daa7

                                        SHA256

                                        2ef4fb539770f83e599ff3640cc0ddcb6d32692f7cc455be77c4a76eeb6ad5aa

                                        SHA512

                                        e1d8a8c501cb47025548f4facae55a7c653a22985dafd3fe5af19fa4d0b29456c4c3d9f254a3ce7c324acfa729a2214e99af9a3b6347dc0762473a1c85bffcbb

                                        Download Submit

                                      • C:\Program Files\RogueKiller\RogueKillerDLL.dll
                                        Filesize

                                        4.4MB

                                        MD5

                                        a34cb6d026e066fd1734461a4be16af1

                                        SHA1

                                        4de92321b816aa71db11b903ef90860999b076d6

                                        SHA256

                                        85f6474f06ff66f3624684d33a4a24ac741a727bbf8da713d99e432440f77acd

                                        SHA512

                                        de63a329f91dfc39555fcac0cf20cc048ad6db5264d6821ac61c7281b2471f382d33f47f3221abeb40f35222bd49288aaa5ee79bf2078807ef0dc6cc6aa305c5

                                        Download Submit

                                      • C:\Program Files\RogueKiller\RogueKillerShell.dll
                                        Filesize

                                        319KB

                                        MD5

                                        1805ffc7fb690c6cdeb209d110e2abfe

                                        SHA1

                                        d5e7a5b5d79da416287977e24508b15f75195c38

                                        SHA256

                                        e4cc5a282f8be156c04a9a297c255c479154308a7a5b369e9da67d036ce26178

                                        SHA512

                                        274bdb239af0f66c89762d7146ab802f61216fa8577f71d5f2a30bcec5de7907d2902091eb81b33fd7984d4735598fe02fe490a9b5e3d4269490035ff6fc232c

                                        Download Submit

                                      • C:\Program Files\RogueKiller\RogueKillerSvc.exe
                                        Filesize

                                        143KB

                                        MD5

                                        b4422e97acb36e727ccb4e1a65fc80ec

                                        SHA1

                                        6b8ec27e89266adff9afe9030d7f95f2dba9f289

                                        SHA256

                                        89ea1e27837cac33772f2ffa0c82b0a51c33e0eb838e241eddcd7a75b186a2a9

                                        SHA512

                                        5cc8d40c2e00fe8d723c9a3efa7ad017e081cc9caac465b27adf81e783b035bcfab41b0819412ec49aabbc11093e77829cbdc9d5bbac6a02c64217e39a36da67

                                        Download Submit

                                      • C:\Program Files\RogueKiller\RogueKillerSvc.exe
                                        Filesize

                                        617KB

                                        MD5

                                        2ecdd15533bf481a32be64dae0eb7b4d

                                        SHA1

                                        816392ed6617121fac0937ad4590ed459883dd7a

                                        SHA256

                                        a0c22494e60f82f16294e32361a9b0d2539129838d60afea88974352ccbebd62

                                        SHA512

                                        1fac93615ebf89bea31db65bf12b870fce2a88a4a7c73d2918c4f9816b56cab47acf4f42721c0f75d2952204987f7fa72a82935f347eb4d73fddfcace89d8307

                                        Download Submit

                                      • C:\Program Files\RogueKiller\RogueKillerSvc.exe
                                        Filesize

                                        718KB

                                        MD5

                                        7d30d98728cb75594743f6104aac93f6

                                        SHA1

                                        128c9d59a2bbe5df44970bccc1bad2cdc3304e5a

                                        SHA256

                                        03a6c70fa7b57d471624c9a128755a2122df5fca6166b64994e8758d99f3d02a

                                        SHA512

                                        cd7a4c704e4fc52f937244336986535c8851fd69264b9ffe0fef32e44f62b19ad496c8f774b5de9fa093640dd5bd0d89eb4c8a8b9b2b719a8719ef02299d772a

                                        Download Submit

                                      • C:\Program Files\RogueKiller\RogueKillerSvc.exe
                                        Filesize

                                        644KB

                                        MD5

                                        bcd40aa70807f30a16d5db7718949c8d

                                        SHA1

                                        f091f68294f2697df78444af90e4b80bbd87dd55

                                        SHA256

                                        1358dbb29e954e4bfb18ec9961ad6f44789fdc8526fc9291b8fa47641bfc48db

                                        SHA512

                                        a7b4dcfdf65cfc1287cc22dfdbf494358f9d6a25fc307814831a0175d15683b76cb880527f0979330f5cb6943e9995c5a3a79585931f26889ccc3d8d5cb407ac

                                        Download Submit

                                      • C:\Program Files\RogueKiller\roguekillershell.dll
                                        Filesize

                                        1KB

                                        MD5

                                        275d90366680a6fb60e8241c7450363c

                                        SHA1

                                        9290cf9140809d8b8f0d737f11cd6a395016e145

                                        SHA256

                                        833140f75c44ac81d0eb39117aa6328cd2d9a0cd4f1e849cffada650b7dad7d8

                                        SHA512

                                        6f806836a735063ccf4e1a91d6f00eb5a442d70294b6268fa5537bc2fbcb54509b55127db7f77dbcb0e009facecd4828177644ea838bcd787f48e13df7c6ab9e

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\Debug\RogueKiller Anti-Malware_debug.log
                                        Filesize

                                        5KB

                                        MD5

                                        26e3871d391e94b0f3ef86308628ba0e

                                        SHA1

                                        dd2a56605e4f14c90b30bbd4fbb0a3aed7abe70e

                                        SHA256

                                        f3778fd70976fb4a585ee5c62790d151a89dea445f206fe642b461f6b09e7bf9

                                        SHA512

                                        997e7e42073229ab338ba2786c2578c85d103bc2dbccccb1398ae63b25b01145e6ccb27667edffbe02d126fb470094bcb4e963daf4cb862104a5c1fcb7735381

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\Debug\RogueKillerSVC_debug.log
                                        Filesize

                                        7KB

                                        MD5

                                        1320770d6b2f9997a144138aaa3186bc

                                        SHA1

                                        242583ef52012b9baa8b4799dc719adbe9567767

                                        SHA256

                                        e376eea34376b9b97cca2a994b9a2cbcbf8e81c2594085d4eb61ca0faec30c80

                                        SHA512

                                        938399711fd29d0aa3496b84ac03c378118ffeb2e017871a73c132f769c42e5f3da944a29014e5d08a9d82b81e01b53c1229de36117128c933ce32d57391183b

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\Debug\RogueKillerSVC_debug.log
                                        Filesize

                                        10KB

                                        MD5

                                        696ec39e7c32cdd195741d650eba3ad8

                                        SHA1

                                        282651c9a802d52e8550c6004e2c703ea360b427

                                        SHA256

                                        d4ea2e4ad6c559afce343d1177ec5b0d37e275f632982777a2c4857002c43201

                                        SHA512

                                        b5f8d9c070c281c4c5ad23610ddfdcce0f71d3db13e754fafad5ccbceb7ae61f642c1fe4481b3f505d01b37ad8c95f2d29a5512b7b951c8bb222532a51bcc4fa

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\Debug\RogueKillerSVC_debug.log
                                        Filesize

                                        78B

                                        MD5

                                        b7fd3968499adf8f0a6c607677117b8a

                                        SHA1

                                        032e848b2c9630c524e9cb65899731451692bb6a

                                        SHA256

                                        8978ea3d8d19732cdab00f7e9f8b302ff43bd66cbe0129bd61bc6764d9ba1ba1

                                        SHA512

                                        5278349a039ce6cbcaf0b44f0f20c49361a68d96eb64fddbc264045a550dd78861e40d87cd1bcfe52c4eb0d007f5374ffcfe4f704754f5680d806792d82b1862

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\Debug\RogueKillerSVC_debug.log
                                        Filesize

                                        250B

                                        MD5

                                        2b034780eb97072130d60989931580c9

                                        SHA1

                                        ee32d6543561e689d6b3f68dfa4ab4a0e6d8aafd

                                        SHA256

                                        659857f9086d95f836719b06d563eb23f08be4530eca3dd80c3029337f6ac505

                                        SHA512

                                        70e8a23d07b129681cfedaa96a5198db64a089ea62bc2cc772519c3e898fa3cbdc47de5530025186443f953a9a45f133d0dcd2e51c280407466231d38e751401

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\Debug\RogueKillerSVC_debug.log
                                        Filesize

                                        1KB

                                        MD5

                                        6acfa8f6425ee85e5399ec3750ac4fd9

                                        SHA1

                                        21941b18f5b886e98200f4ff956e09b83944f836

                                        SHA256

                                        ad5447fe5d63b15e29da5ee6656f3737d77ea67962971b34c78ac10d3dc41702

                                        SHA512

                                        84cb33a737f872ebb3879c60b90318275b5b129ebe0b7dc3e62aae5c048933415ca26bdaa2d52cb01b8bb97067a8f882db67ae7d44292c6342b332b9e420bd6c

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\config.ini
                                        Filesize

                                        2KB

                                        MD5

                                        c402d9753e6a06c2d1e3fdfcf85f75f9

                                        SHA1

                                        2a05ad0b707018c280e787966ebfd511093f9a43

                                        SHA256

                                        9e6df6dc051ae4fc9be7f88feb73e500741bbbb33d1e2af981118211b140a618

                                        SHA512

                                        49c5870c80818ee36f734a95e6d6e7d523fdfbdefc3edca11162eb8033e7748a4a5f6bca5f75aabf633dfbfff466b83974c27afce8a475787a6889ab66fd52cc

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\config.ini
                                        Filesize

                                        2KB

                                        MD5

                                        889db71f11425fb438cd5df8e9b9d1a7

                                        SHA1

                                        e1f606ae1df9b4a8eabdd53e723f4f5fc893d3b6

                                        SHA256

                                        504f02e48d19f860c32df196ff8e9ae733fa1ef32dc3d237e1e6ff47f56d8581

                                        SHA512

                                        5bc0d27b8908fffd19f300715d225dd9c30dc0c18787f08f7a1b850acacc031b27dde6e0f113020835c73cfe6fac68fc3dc7bcc1540544c22a45961c8f0bd9de

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\config.ini
                                        Filesize

                                        2KB

                                        MD5

                                        071a4d2bf2d3c47066f21c2917d227e9

                                        SHA1

                                        6166f533d92a3a8da0ab09a76a43777aa8847538

                                        SHA256

                                        a9b75093a0858be53279f3538c18eb50c9e21b982d1e34d26a93b89dfbee83bf

                                        SHA512

                                        62bf00d553abb3bef3391dedc43aafc03019ea02c37a497d4b3f27779a105bdbedddd2d3656afba3437ba7e4de3d2534491f3c0cec0f53cee7f29aac11c299cd

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\config.ini
                                        Filesize

                                        2KB

                                        MD5

                                        9bdc8df4e75d74ed447b1e4a7f107112

                                        SHA1

                                        2e2bf6b8ee5531614020f7a3b239ec0d96aa9347

                                        SHA256

                                        d448eb6be0b931957883c1519a787d898bb97de17238dec5f58c1f63364571d0

                                        SHA512

                                        83a55fd798fbf21ab553a6102cfc282620f61feac5bc41762e71c6888b92bf54dd85e43776812691f71721c02ad75299909364457416b171d4fd61c0db95523d

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\config.ini
                                        Filesize

                                        1KB

                                        MD5

                                        03c0aa2e43c03b0f4e664c63da618325

                                        SHA1

                                        ce0cf00d8d45816b67ee12eeae0487a353786c47

                                        SHA256

                                        6aa08781e4460f043158eb594b2bdf4b1a76c35bd481b6b60a38413a11dc8e27

                                        SHA512

                                        e804309838045ecdec47f3ce021150f92393e035816016272c6211cce05d45ee8391ea1ed036be41ead8b75f4c3c1be883cade9697471e11bfa7e13882257c39

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\exclusions
                                        Filesize

                                        18B

                                        MD5

                                        f46ef257534139a88f49c91b5ce8ad56

                                        SHA1

                                        37bf8547e48383141c0d5bd8fb986b9b2973f650

                                        SHA256

                                        d8c3ace08558bd4aa2a1643a10c55a151a6a4f46ea6f5670ae2da135a9ada71a

                                        SHA512

                                        274caf3069df6bf932a80f5c939293a24c71ba51cba53cb0a2b6985ce5c55b0fde9adfb1f515885f8bfe056c017451a3d40e339c3c16b723c423d0ce5fb08442

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\scheduler
                                        Filesize

                                        1KB

                                        MD5

                                        bb6b64b78bd84432d5d266d7f8b38805

                                        SHA1

                                        7edf9becce05f62fda6e61c8951a2e727042df5f

                                        SHA256

                                        b84c9fba23e62371928f8964a905ea931a705ef3c406ed5a736419635bca76b8

                                        SHA512

                                        4314eedfb329fa1083eb907a8544abfe41469ea72680286baf72fbc8c4d1be1938ac8df8c6658dad6ee082eec20ac0aba1653bf7a3676a7a14394238a4a1307a

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\scheduler
                                        Filesize

                                        1KB

                                        MD5

                                        664d31770b0a3eb6c7bdc5795a4cd1bd

                                        SHA1

                                        f7012d2c992822b3b2243e1e2656892c276d6cd9

                                        SHA256

                                        b4673c9be045dec3c4191d35c00324dc0dd61063c6d0a80878172efe8a44d121

                                        SHA512

                                        bd22332316c79939edf5852fec9776bd1640bdca34d0ad6432f1a3c6fb3f5df03194fb6451325ee6625ee7ba45ae75bf0d885f933ec8c3da30fd302b59f426b0

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\addons
                                        Filesize

                                        196KB

                                        MD5

                                        8f1275ceaef306b0afd43d6e27c02471

                                        SHA1

                                        54bd1fc56b4fa6793f120228e4e0e7b7ccc920ba

                                        SHA256

                                        88797a2c028ca6f87c9e7bca1446c0b36ac7897da59116ad7d1423b15b874dcb

                                        SHA512

                                        24c495811f94ab966419fc7e599cdbe1712679f9c2b95c83cdc3fe3827cb0cdd25a562479d0ce5e536bbbc1b816d08f255f0c0a86a8bf4361bec2a79a045d813

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\addons
                                        Filesize

                                        477KB

                                        MD5

                                        5b4e074cb5d682d0a78f91ba2428d1f2

                                        SHA1

                                        9380a401d5bcc0aa8e56ebf677b1cffaa2b357d1

                                        SHA256

                                        f83739395644dc637936624ecea7ec37a3559d104aa3086dd786bfe51128adb3

                                        SHA512

                                        7f4a819a20a9169d7f700bc501e24dd1bf316372cff444a2359735ad420527d5e767531e63b0492b185684e506abb6767d65a4d58f844b6e8c436af640c1c6a6

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\digisig
                                        Filesize

                                        65KB

                                        MD5

                                        8b541ae0c4b8f4ac1f93cb6d5a41c5f2

                                        SHA1

                                        d06fe69b543d3f0affcbeee233cc6c8d558ed119

                                        SHA256

                                        f913fc639da60aca8bc2b2eb5c6fa93a88d50d9cac7cc811ab60d59026dc1a7e

                                        SHA512

                                        62140f0620fe698732f6627fe79882957aaa0df8aa90fe5881e651c56668d8f50384831ff47269a7eb813b6d2b8a8dae14154035c33a50a697cbc6a2eedac856

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\domains
                                        Filesize

                                        262KB

                                        MD5

                                        ca50346f9f08998bcc290ae89569e19b

                                        SHA1

                                        e47d1892b5e67299be492c6f28a8acf2b2b00881

                                        SHA256

                                        a7dd416e7264ba0d3e9017e02b78a96f4264201cc31f267affb2521bdd1e5552

                                        SHA512

                                        8a9195740786146774bbfeb2050588040c70c1911782085fcfce14216ec3f8609cace60cd5656b7a193ef8779c6e541a0babf7e538d69b10c58aebe006db1fb5

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\domains
                                        Filesize

                                        342KB

                                        MD5

                                        ab5523ccd0943e0ff5dea1fcdf51fe58

                                        SHA1

                                        c6d87ab55cbd56c25d7afaec1a27a63f263674b9

                                        SHA256

                                        30ace25c44a409b5b3319e7b39ba927fe97ffbce02b8a200d487637e2d2c1422

                                        SHA512

                                        a47354f55282963ffcae3c0cda0ca86a411bfc4dbfd7bfda0e31ceff96ae5c8d032d3cd1242b8ac4fc23eeede715b2870d4edc1eaaf4e400145c5035c35a8a3f

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\filenames
                                        Filesize

                                        369KB

                                        MD5

                                        5f15fbeba7c894adbd628166680b0131

                                        SHA1

                                        5bb790f3559a4ae703264f23cfd81647576077a9

                                        SHA256

                                        dc7174e38ab6647d51dfeeb864220b3deb70ceba81977f9918f0d4c2341a6224

                                        SHA512

                                        219b85e713ad0b22ec0e66c343b8f9d810aad08c2cd38ee311f8b7759a4bc2a439bacee5a5d8de9312d9e2b15bd779308ff12e91774dd0df01a95057432b5dbb

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\filenames
                                        Filesize

                                        449KB

                                        MD5

                                        04677d487c955858dbe2d89386a3466e

                                        SHA1

                                        015e891083855fec8fec965aac9aa18c2e7052d6

                                        SHA256

                                        a4304e669cdc087ccec4677b691a6988328aba37fd3899312c538eb372021ef5

                                        SHA512

                                        e4e1d1c03bf37afb0595a29e0b47b5ed9796511b5803e78360ff41b9a405749c11e5cb8fdcd6ce0db68c32324eeae3047347d4ddd25a61240a691996d46ae150

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\guid
                                        Filesize

                                        353KB

                                        MD5

                                        188de6850ad751c9be8a76536abc6803

                                        SHA1

                                        f9d27eef812cb8581bc0079725782e69795c1922

                                        SHA256

                                        fa60e42439e9d415002d74b3a830dea4415b4a70644d98157c5c2256074b91bc

                                        SHA512

                                        801634fccc5483aaaf462a1045aafbbfc44fa8a7eb739d11f63c22f9bd774f18de3ecb9fc66d0d71e1a70584f4b94ed1565e01633e856f8b4d3d143f4392cac1

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\guid
                                        Filesize

                                        420KB

                                        MD5

                                        d22470dd857e85c4548327dda537f386

                                        SHA1

                                        64bbddb4b210eb0b9a0108f7c4aa952a0176a46b

                                        SHA256

                                        beb48ab25e12f8a5ed59bf6fdffc0dd71005f0073f7d04cf3e0166120c0c2ec3

                                        SHA512

                                        fc1c2079c8e2aa9f60e1bd9b1e418baa000cd119f097f21b9af4a73155bb596fbaf88f9654a80f134076ea7621320e9a98a3f1df765f918c3cc5689860e503e3

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\hosts
                                        Filesize

                                        44KB

                                        MD5

                                        b8c0d2cc9873a23e8ce503896087c1fd

                                        SHA1

                                        d18d4bf4f68ea88957a11ebd9968bb68225ac007

                                        SHA256

                                        c2d419f357cc62ec519c92f183ce6eade306b802d9187baa20d2cf5a26d1403c

                                        SHA512

                                        4b5cdbcca223db004e7c2e007d915538b746b1079da1a44fab95457f410108ee31b074b0eaa529437199cddf3a01b40b8bd1d40b83f11ca36e998fa4951a02e2

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\ips
                                        Filesize

                                        30KB

                                        MD5

                                        69dcc0d7ac2a7e41ae6161dbfd3eae71

                                        SHA1

                                        3a26daa6dde14f53c0fc09d55ad470454c8f72ec

                                        SHA256

                                        01d549401b74ed866516324d5165649bdaaa361ffdc0104aca433ee6d18f57a0

                                        SHA512

                                        38ec29835839f32642720045913873a971178e5b3da09ba66d930e4958ed0383f6cfa23e166969c6b9fd63bf9ac1044b19338ddc6d723934569185ddece9ddf6

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\mbr
                                        Filesize

                                        34KB

                                        MD5

                                        ac0af67ad50f7e3c0595b4e984523c73

                                        SHA1

                                        5f00dcb6f1ac3c697decfd521694d23a834792c6

                                        SHA256

                                        daed8d7bc6a68a801b7a72ead6f0e82db6e3cee7674229c1b847ad1f7c44d3c3

                                        SHA512

                                        8d94d46862ce3dddcb281cbfb9f60a36f7d902889346ad1c3f4f903977ccf9693cb5fb1ad1ef0596ad2143c49a3b74bfc417fac8701233d4d2f21bc18a68ca05

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\pdb
                                        Filesize

                                        59KB

                                        MD5

                                        6b95e110b4584ec2b4c6ba8e28127e38

                                        SHA1

                                        18b8f266ec0ea93d20b7952d6bc53998709781b8

                                        SHA256

                                        93f70981c1a013f43b10ffa35e7114c09ef4a0cc6bc394f7393c50adc5ffb07f

                                        SHA512

                                        9e90321c6ab6c9a3043172d623396296a91de3b2cbf437355b74b69b09ca731034c4e589dc5d7a4b8312bbd961eaeed44ed27558f7125d4d29c3efe047f0e82e

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\regnames
                                        Filesize

                                        167KB

                                        MD5

                                        70873ebca3ae88ad44d1c533203984f3

                                        SHA1

                                        2c4a865b6cf1d02eb09a427b937155fb47894b68

                                        SHA256

                                        3386b57e6ee804a02a7d668ac34d9b416d2378660ee4827450e6bd60a77498a2

                                        SHA512

                                        17ce3863bdfcc6f654464877eaa7e65d0d2c3af52b44df0392a814f7a55615b0d364f2b10eb33df8a6f429261963edeaa3aaf64d8abc921f296828804a0d6c0e

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\regnames
                                        Filesize

                                        386KB

                                        MD5

                                        918749f220cdcbf4c703d61eae8bc6ec

                                        SHA1

                                        862a5184074a35a35abe0e513f06eb55307d01b4

                                        SHA256

                                        8dd40313e2755b84876a4a475bbccedd80d4fe1840f3f299564fb9e00e583e7a

                                        SHA512

                                        d4f3c62dc461a6451c7d517d7da1f51381db3d80a678a3eb5f1e0651cf558790da0cb1a439b6ce380bfd6cd61e719b17c39f9ae2e60c0bff7d4ec8ee2b663535

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\services
                                        Filesize

                                        170KB

                                        MD5

                                        b74d4e58da24ad888e8db513446535e7

                                        SHA1

                                        58147ec602005a3710350d2e1d6ab0761d8cb4c7

                                        SHA256

                                        b79e55769d22edfeda24ce98d3f0f5723949397f471eecc69a193f2cea22f7ad

                                        SHA512

                                        dff565731945b9752a900cfecc54231f4d28dbaae20ff9a2391c09c2df5bebd5d6fd51c442600046201fd34318f8dccc49adb084d18fc158f13c7377e1dc0a33

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\services
                                        Filesize

                                        372KB

                                        MD5

                                        22c3717a1c5badce8443a552fe5e4f5e

                                        SHA1

                                        3b1f37507d3b1736a639d69ab06acb10862ac32c

                                        SHA256

                                        7ec5eeba00ad9f785731b1999f2d0ffc3786ce52a9bd4e5e757edf077ab271fa

                                        SHA512

                                        ba2db5550fbc704d2626c18e8c4635f2883f20433348afd3faad9a6eafecd3964f2f976bcf95d2ac8c477290f8d31a819ce66f291be8cd0a89796995ea1123c3

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\signatures
                                        Filesize

                                        103KB

                                        MD5

                                        93575a639a07df3bb4ae698a0194441f

                                        SHA1

                                        300d638a5a43d907987d4af39e345024fe091a9e

                                        SHA256

                                        89714e04e52e36d59f1c82d8c7d67aceaf091ecf73e97c6335f03b85e76f2951

                                        SHA512

                                        367104a9688436751bb03aca6d5417d77b94d2b13c633751fa2c9c7cf1245989983660e613c59089e4d4ac7a87578c6cf2fbaef37d96ff9623c70377f51d2399

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\signatures
                                        Filesize

                                        63KB

                                        MD5

                                        f59a94e88da66dfafe22651dfe0c2133

                                        SHA1

                                        b5b21aebb9e4e726b2dcfb72d5ceacad9d053cc3

                                        SHA256

                                        c6a7025475ccb1622c09e7342de08194269dd6de6e76cca40e3c0ea907dfd9d7

                                        SHA512

                                        01dcb4a17433ede1f808c2951050809d26ab7513081b3710adef565cf392022191290ae263429379666dd298ca27362e681cd3bfd1b04d625d494d1e31ca562f

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\tasks
                                        Filesize

                                        267KB

                                        MD5

                                        22b827a7a753461341076c692d1460c9

                                        SHA1

                                        9d9e58120fb6afd0df9e27efa40b38138ddc959d

                                        SHA256

                                        95e03a54e595f47779ac2405b6ae429192a31a2754068bee7aad84395188dab5

                                        SHA512

                                        34cb0c351288a92b00eee9ffe810639e35da27d2bf5c54ebd80766fbb1d15c39981e6968287d2df0e9b4bd67a6893bc227608b1837f337c4c34643d2dcf5e7f6

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\tasks
                                        Filesize

                                        29KB

                                        MD5

                                        6049f65b64a9a332bcb397cad2478af8

                                        SHA1

                                        c3c482564a5db0416eaca31e55dec9e2652087a6

                                        SHA256

                                        71728c0bd1580e379dfd33beb2b22575036c8bd71863b96d0a7f3da866075962

                                        SHA512

                                        00edca1a2bcbe269f49b49ea7fd35709190f46a3152011e21a48eed43ded8b86402e6ffb61476d8012b843968ffbbff1cfa6560307e673d3d59161ba251db60a

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\version
                                        Filesize

                                        32B

                                        MD5

                                        01d47096da9a5eb3b7307a443e18da95

                                        SHA1

                                        70b561a49f7f4d803fa6e68137e34119fa432cc7

                                        SHA256

                                        dcc42c0f5fc0892f3cd57d89678f4117f6d68c058d1d5e447e09ed4a7ceafb01

                                        SHA512

                                        6ad147b30c55c0a77f2707d07d51644c34539d4e794fe8c268608dd9522b6677408755bf1a7cb7e934612e4923c9181a2448631c2e392c354d1a84edd8aa07c4

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\webconfig
                                        Filesize

                                        22KB

                                        MD5

                                        c6247bff46c830c8d22a14e894f74fe7

                                        SHA1

                                        dc87098b3be3af8a5920cee1e83a9005388a3039

                                        SHA256

                                        0215c47f456ca5c35464276613385f06a342cd58e790497b1ed9fdb33e79f7c1

                                        SHA512

                                        588e873170a9ee588c24e9678d54e4397f088cb08d074f132137abf5eff60e3dd2e8a8ebfc8ab15e608a4999c3b164b7db96ff87a584abd2939508f97f1b25f7

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\windows
                                        Filesize

                                        65KB

                                        MD5

                                        0ffefc6fb47c9dd8bc04eec45d9f0576

                                        SHA1

                                        87daa1a3367dd71e59549b1ae807286915ec0d77

                                        SHA256

                                        8e178204cffb9a72a9da771639ad110c407d73b9c7a2ec05d0a9243e85ba4d41

                                        SHA512

                                        7c9175732237c1fde67dfd415ccab7d72335ae0a436cacf5926a5f2c0d72a685b12ac60c3493095ca9005af6304f7093a3ca37b2050e98ffd7881938d9a6713b

                                        Download Submit

                                      • C:\ProgramData\RogueKiller\signatures\wmi
                                        Filesize

                                        9KB

                                        MD5

                                        9588c487cebf881601f9799f65cec4e8

                                        SHA1

                                        5ddefc77d512a25f06525bbaebdb0265003ad6a9

                                        SHA256

                                        e6f37008cb50ae72957b6115ff31b97d8df7271f3063e4e63366c7b3cda64de0

                                        SHA512

                                        e219d17291bd7489c72a31327442490a64de3575ccc24b1d1468b50d0fe1599d59241a28007cba801093c81f2a932affa266a6486ba2f18443c1ac876f33135b

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        Filesize

                                        152B

                                        MD5

                                        05ed8d7350c6abddb2413582af13b728

                                        SHA1

                                        98b3e6793352038355ee54fc58828e5ca1cf0f77

                                        SHA256

                                        878b0ffac96b1428cb415ab15b289258dcf9fc175ac2571622e4dc1219f32c01

                                        SHA512

                                        b80bf631b56588daf08570c05aac9a67cee414403149c223a005a7dd9c81b5e8d4c6f175815106f039d47c1bfef875ecbf65efba106d5107b137f2aabe446058

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
                                        Filesize

                                        201KB

                                        MD5

                                        e3038f6bc551682771347013cf7e4e4f

                                        SHA1

                                        f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                        SHA256

                                        6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                        SHA512

                                        4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        Filesize

                                        1KB

                                        MD5

                                        5e945f751c21d9effa68e92cbfbc0eaa

                                        SHA1

                                        46d518d6cf54188f1be248e198b252e0684492e6

                                        SHA256

                                        f3d02e4617aea56f4b974836828caa1b2aaff59f28dc1b6a8cfea5b9e4695346

                                        SHA512

                                        f1eb103010fd1c50f3a2b08f84d6a8991d53856c705d1b9c562af99db115d4b6f951db895b84550d491d5a69a9c50a6927259731e77fa3e198abcfa4735976a2

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                        Filesize

                                        2KB

                                        MD5

                                        9a0ced5f3fa83e88aecc57db976db3d0

                                        SHA1

                                        8660fbc815fae35650adfb83c94c1c0ebfd09912

                                        SHA256

                                        0855fd819128a2620328c8ff0ff28f085a6b23cbaf1de4b703011439348f7c0a

                                        SHA512

                                        3f9044351920d076ba0fa234b304604615ddfbe1b00ef4b9c3fea2a0f19d997664e57cea2520e3b0dbc68689c9ae7df936e5051b42f29ea70dda3acc2c1cfbba

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                        Filesize

                                        111B

                                        MD5

                                        285252a2f6327d41eab203dc2f402c67

                                        SHA1

                                        acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                        SHA256

                                        5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                        SHA512

                                        11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        4KB

                                        MD5

                                        95e9efa9e7ffaa7fdd39c91e524391e2

                                        SHA1

                                        24bf57e2d183d4f06f99c3ae7ebc8cd24fe8a9be

                                        SHA256

                                        4e5abf7c37027b344db0e75f6cb5adc1bf082e6f817d078308f56a2dec914059

                                        SHA512

                                        0b5ca77146727a8074824007da8319507b9ee04c82e5bbfae8a60020427bd236d4a67618259ecca99ef5d6093950191f79129a688d713e554be6b6ddf8a4c9ff

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        68f7d9e97400797b390af15071cee875

                                        SHA1

                                        cf7ddc3fb7762d2082f1e95077c12cf11bdc19aa

                                        SHA256

                                        3fe9da30bef626bfb61f39c45246763f7fa5440314e4bb3cb3455108d6fc980d

                                        SHA512

                                        649d72ca59cf12b5148050059af6fe8ce9f2055dbd172d876c20fb8e013e723ed750f3dbae6c8f6076d92256f09e442bb6df70708fdb7064ade26c778872a835

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        5KB

                                        MD5

                                        b233f99c2429013a1800bc56aa65f5b1

                                        SHA1

                                        5c6fada38419267f969e4e48667f85b2edf469b4

                                        SHA256

                                        abedbc3152e12f756a493509060003e31bc8b3243747c655c954459161bee415

                                        SHA512

                                        6441823974b1cc9838ec038918925bfcd93d033fe255f6592a97ff96b30e5f787e7b4088280008a2542658bc12d9f164f04f9e345878fdc04052dbbf337ee48d

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        0f20e42acb528b5952517e57b3e07ad9

                                        SHA1

                                        bd2cb8976434375f39b5d896b0e1a66ebce82330

                                        SHA256

                                        05087bb8316d4de9313b278d5b92e78a2c9beb1eaed9ac8fa265dcd773fffa9b

                                        SHA512

                                        5ad44cde0c5a7f8bf0421527d8b308fc1467dafe6fa3d49504c2d9475af92b55d776257f5060ecb81f8faab91a0f0cd3a0e412b25cecfdd39794b289bbefdc08

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        340ca0aa85e2a138c35e30a5f9c5caaa

                                        SHA1

                                        5fa09454e4618cefb340237760d9212fb1205540

                                        SHA256

                                        3e3edeea63ff7e7af50a4262bb35d577073e37865572ae109594b165e7737595

                                        SHA512

                                        e8e0a894e50b20e0fa56e6e951f8dab1382e8ee8e9f0f2b2e120f8c91c070bd0e1845066c6cbb488778e0524969ae698eebed6e918550cc47bd89aab6c9d2cdf

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        f3d508f52d41a7840b2ef6a3c35eb5d3

                                        SHA1

                                        e4647fa36a54ca381e16aff93a94179433d460a5

                                        SHA256

                                        5299bdfaff578194c8ed1cab7af15d2163a06b23083c71dc9a7ea55f6ee892d3

                                        SHA512

                                        132bea644b43e71a9d855a881cc5fd75052ce29bb4241b7dc2d4225549af22507ad1bf4d9f1e468bb3a780960fd07738626fe3e09a4a03392a65dba660229708

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        f0fc85f5912f2b1db5cc6e8cdff60c31

                                        SHA1

                                        24ef88ce8ecf8036acd072dd6372007f7bb15d7a

                                        SHA256

                                        c0e59634fd963d36b25e4f05bede782b8afa7b22a7454009fd02bd266c11d18f

                                        SHA512

                                        91cf7734a2e3fd98c766898a2032f8d3c27c302be8cfe911846563d874cd2166f6fc6fe6db7e56ce0961795d7d2d38bfda567eee99bb323b2dd4354c4924454b

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                        Filesize

                                        25KB

                                        MD5

                                        3da3cf652acf7e0fee298963e8cb77d3

                                        SHA1

                                        8d35e8ba0767c10324335e8fc8f5c422ece4e504

                                        SHA256

                                        9b436ba7a14d3947bfe73fa9bd581f6fbf0acbf26e97a3a54d6d032d19f8cf64

                                        SHA512

                                        89e9555edd366fedaf79bf4c6da816a69fb220c987337369511c4422034cad486338a261eb6954d000dbfa636c969d04b65de62bb6df9c023ca5e11c892ee83d

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                        Filesize

                                        72B

                                        MD5

                                        941e13d2636a52c0526feb75e6cada98

                                        SHA1

                                        cabc3f0f1bb32bb98ef9c9cb30606510a1b60460

                                        SHA256

                                        6c0d48e1336335fa84bfe6d86272f30fc331cbdbfbfb88bc9b8b69259d12b794

                                        SHA512

                                        27a8c47db2645463c62a94bc7d2f53731f6844ed414d992128bf085b375077ee8f1637c36239fa4d5bed41ef527404397f5b7c7cb8608540f826330548483735

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aca66.TMP
                                        Filesize

                                        48B

                                        MD5

                                        cbe8508a2b351479cedcb3db5275af06

                                        SHA1

                                        f669fa0f6adea349ebc7425da149677c7ee9b40f

                                        SHA256

                                        c4713fae0040d2b967960ca49457615af21cee77c489a23b255b2ddd2f5aa8e0

                                        SHA512

                                        c76da43b8675b794f16c2bc451aecbe3a35a785c91981325ebc0abb80f2bea04e46d83b33952b9a94c12dda60a6c447f5672c25b224f2980d95920332321652e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        Filesize

                                        10KB

                                        MD5

                                        a20e4c36351aded78b259b7f0a0b7ca6

                                        SHA1

                                        1189f12d1e4ad652a2de04b301ee56a2f63b3bd5

                                        SHA256

                                        6810a82c3eec30742f59f7f29d7981814c9568eb7cd1a24b54bfc430d4ee08da

                                        SHA512

                                        e31bffc330d83ccdfb24c1c583f939bf7cf344ca0acf977b4ff8e5b17adebac7fbdb0b25a907e2beb7a58b16f918209bdf3805c32f929258ef98e19d3bd65279

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        Filesize

                                        10KB

                                        MD5

                                        8b153fb40745dd955dcc6fa945f90079

                                        SHA1

                                        f3da62ebbf23fc51947fbd9780789e11540fe1d5

                                        SHA256

                                        54c4c561ebd54a61fc756ff7ac5518d227d95ff290c43272ecb1e60abc229396

                                        SHA512

                                        cf4041109062088d185bbb3d76be0d7b29c5ebc940bdaa4259c2f744559d9a4aa2bc40c5e6be4798e6869ae43711e481bac92213d600fddc95808ae5134a08b4

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        Filesize

                                        11KB

                                        MD5

                                        d1895201e86c6bf8e14f78ec2b174ea8

                                        SHA1

                                        5ebf8e71026e48859ba035c0e673ae4c5d371a9d

                                        SHA256

                                        97ec177d61e1b0f535f0346136be637569696caaf24b90ce08ce52f30ffc1fb2

                                        SHA512

                                        bc26eaa6e5e90f417784f838294a7aa6b3faacd5bbb200a1bf33ecadd1632de4e8729093825e09d4750e99ed33a589964489bdf23342e09da1400482d86a22f5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-7P8TL.tmp\RogueKiller_setup.tmp
                                        Filesize

                                        784KB

                                        MD5

                                        79fc0c200d150def1d8abc50b21dbb7c

                                        SHA1

                                        f4adc9c05e7debf9a22ba354e0ab1221d5a5e27f

                                        SHA256

                                        459db6129ab3788a2a2d607bc3a4d88ba031766237bbc5ac4adc6de0fc13bf01

                                        SHA512

                                        e47067253247ccba739b27203e49089e453892217493ba7f082ea9d77bde64a04ca7d48666c20bb335a756fc31ffa838e19a6395c5084b8df751bb1375d72576

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-L7P12.tmp\roguekillerdll.dll
                                        Filesize

                                        4.2MB

                                        MD5

                                        dc2210c36b50bbb89b7e4fc5f41b8ac0

                                        SHA1

                                        988217cb7aeb9b932ad9ef3fe7f773d1c98e4501

                                        SHA256

                                        ff887f8a8178ca3a26c30b9b92bd8baef1c600ab9a5ff52ef9c4c6af832c766d

                                        SHA512

                                        57819af832626a4cd936637c13232c383ffee4362b7d2b688d5e18ef9ea00dfbad91f85bfd60297676e6acdea9af6eccb3b47d180fcd3f795d7ddbe11f79a991

                                        Download Submit

                                      • C:\Users\Public\Desktop\ROGUEK~1.LNK
                                        Filesize

                                        906B

                                        MD5

                                        c3c847109c880555e9006fb6f47df532

                                        SHA1

                                        746bb4cf040cb5d2edc00594b1d8e597bc19f952

                                        SHA256

                                        c1dc70bff7c99b54a64b9a35c7fad98ad1e23e87126edb9aec9dd66a7c296a0a

                                        SHA512

                                        e725768738ede7259f8c8a899042dcb831075091b1dffe8640eae3a5d4ad2863991e424a2dc91416d7cd15fcc80a0cb2c9156f5f57c91c717eb7b34e8792b363

                                        Download Submit

                                      • C:\Windows\Temp\as_E05D.tmp.zip
                                        Filesize

                                        204KB

                                        MD5

                                        b32fb307552d65dbea587bd5ea44ca05

                                        SHA1

                                        4ba6937a8f9ed4cc325f917770355bfecee761eb

                                        SHA256

                                        a7e6b4bb5406198925f76049e5b6038853493f8b0a2e4a8c8fee27b0448df46a

                                        SHA512

                                        e6f640fcc3842512ebb7298e650387b672ff25c7cf3606b8e83877e04ad40bdc787b23f0554002e5673c24c623c2d0032e66eca294d10d8f79c0f05a0869854d

                                        Download Submit

                                      • C:\Windows\system32\drivers\truesight.sys
                                        Filesize

                                        52KB

                                        MD5

                                        c555b977ed786b4dff8627ed64c58f63

                                        SHA1

                                        48d7b0bd5e3d89b94aeb09f443f87442fbee9ce8

                                        SHA256

                                        3079c59d84064199bdd48fc590c04e4b9471f99b6d07ad0f542cb09081dfa408

                                        SHA512

                                        d5231f529a20ae834a09cb03e84e08888a9581beb47d8dbbcd8e23d3ac8c2328cf0fd6401a29d6c2b107021d65e9b89a92d7f88d47640c45e0275938807246c5

                                        Download Submit

                                      • \??\pipe\LOCAL\crashpad_896_QCOTAPHIDPJTJWFK
                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                        Download Submit

                                      • memory/932-12-0x0000000000400000-0x0000000000428000-memory.dmp

                                        Filesize

                                        160KB

                                        Download

                                      • memory/932-0-0x0000000000400000-0x0000000000428000-memory.dmp

                                        Filesize

                                        160KB

                                        Download

                                      • memory/932-2-0x0000000000400000-0x0000000000428000-memory.dmp

                                        Filesize

                                        160KB

                                        Download

                                      • memory/932-242-0x0000000000400000-0x0000000000428000-memory.dmp

                                        Filesize

                                        160KB

                                        Download

                                      • memory/1472-780-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1472-786-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1472-791-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1472-790-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1472-789-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1472-781-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1472-788-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1472-779-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1472-785-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1472-787-0x000001F1A8120000-0x000001F1A8121000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3500-6-0x0000000002330000-0x0000000002331000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3500-74-0x0000000002330000-0x0000000002331000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3500-44-0x0000000000400000-0x00000000004D1000-memory.dmp

                                        Filesize

                                        836KB

                                        Download

                                      • memory/3500-13-0x0000000000400000-0x00000000004D1000-memory.dmp

                                        Filesize

                                        836KB

                                        Download

                                      • memory/3500-241-0x0000000000400000-0x00000000004D1000-memory.dmp

                                        Filesize

                                        836KB

                                        Download

                                      • memory/4680-250-0x000001D84AFD0000-0x000001D84AFE0000-memory.dmp

                                        Filesize

                                        64KB

                                        Download