c4812e37aaf60bb0c03ba37a5de10cdf37171202c1fd1396e692916377556447

Analysis

max time kernel
447s
max time network
450s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2024, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Script-ware/Installer.exe
Size 1.3MB
Sample240916-qv7dhszhkj
SHA256 acf96978c04d6be7089811792c24d2084fbcd41fa966e3c33f16af3cb7148d68
MD5 efe97f3890d47071a9d38ccf2da54aae
SHA1 54a9e215628828dbf8048aeb5ece90d39b133d38
SHA512 ef733be9a892ef8241d7cde0014d051528e647f14517cf20e313bd9022a9919c72f8054f81fe13d57184bc288706e8eaf55c96e20109a9f46e84986ecb948500
SSDEEP 24576:1f3DOoUWhdoNLLJpTmJG/Olrvn++Sib5h5N4bSRaCUsvp1uEBzyN3DedwlYvN47:hSoU2siG/Ai+S+v4GR5jBzkyClY147
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

agilenet discovery evasion themida trojan vmprotect

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SirHurt V4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SirHurt V4 Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SirHurt V4_New.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SirHurt V4_New.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SirHurt V4_New.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SirHurt V4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SirHurt V4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SirHurt V4 Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SirHurt V4 Bootstrapper.exe

Obfuscated with Agile.Net obfuscator 38 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/1920-581-0x0000000005EE0000-0x0000000005EEE000-memory.dmp	agile_net
behavioral1/memory/1920-582-0x0000000006160000-0x00000000061C6000-memory.dmp	agile_net
behavioral1/memory/1920-583-0x00000000061E0000-0x000000000629A000-memory.dmp	agile_net
behavioral1/memory/1920-584-0x00000000062A0000-0x00000000062AE000-memory.dmp	agile_net
behavioral1/memory/1920-589-0x0000000009590000-0x000000000981E000-memory.dmp	agile_net
behavioral1/memory/3540-803-0x000000000A8A0000-0x000000000AA7C000-memory.dmp	agile_net
behavioral1/memory/3540-884-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-882-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-880-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-874-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-870-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-866-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-864-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-862-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-858-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-852-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-846-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-842-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-840-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-836-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-834-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-832-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-878-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-876-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-872-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-868-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-860-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-856-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-854-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-850-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-848-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-844-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-838-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-830-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-828-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-826-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-824-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net
behavioral1/memory/3540-823-0x000000000A8A0000-0x000000000AA78000-memory.dmp	agile_net

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000700000002348c-503.dat	themida
behavioral1/memory/2504-509-0x0000000000A70000-0x000000000133E000-memory.dmp	themida
behavioral1/memory/2504-510-0x0000000000A70000-0x000000000133E000-memory.dmp	themida
behavioral1/files/0x000700000002348d-511.dat	themida
behavioral1/memory/2504-514-0x0000000000A70000-0x000000000133E000-memory.dmp	themida
behavioral1/files/0x00070000000234b7-573.dat	themida
behavioral1/memory/1920-579-0x00000000002D0000-0x00000000013DC000-memory.dmp	themida
behavioral1/memory/1920-580-0x00000000002D0000-0x00000000013DC000-memory.dmp	themida
behavioral1/memory/1920-792-0x00000000002D0000-0x00000000013DC000-memory.dmp	themida
behavioral1/memory/3540-799-0x0000000000BD0000-0x0000000001804000-memory.dmp	themida
behavioral1/memory/3540-800-0x0000000000BD0000-0x0000000001804000-memory.dmp	themida
behavioral1/memory/3540-10748-0x0000000000BD0000-0x0000000001804000-memory.dmp	themida

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0007000000023088-298.dat	vmprotect

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SirHurt V4 Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SirHurt V4_New.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SirHurt V4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2504	SirHurt V4 Bootstrapper.exe
1920	SirHurt V4_New.exe
3540	SirHurt V4.exe

Executes dropped EXE 6 IoCs

pid	Process
3896	ScriptWare.exe
1660	Asshurt4-cracked.exe
4480	RaindropV2.exe
2504	SirHurt V4 Bootstrapper.exe
1920	SirHurt V4_New.exe
3540	SirHurt V4.exe

Loads dropped DLL 3 IoCs

pid	Process
1920	SirHurt V4_New.exe
3540	SirHurt V4.exe
3540	SirHurt V4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2112	3896	WerFault.exe	110
10732	3540	WerFault.exe	132
10800	3540	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SirHurt V4 Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SirHurt V4_New.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SirHurt V4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScriptWare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Asshurt4-cracked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RaindropV2.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	ScriptWare.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	ScriptWare.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ScriptWare.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133709674139018726"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	chrome.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	ScriptWare.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df12000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	ScriptWare.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	ScriptWare.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	ScriptWare.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E	ScriptWare.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
3636	chrome.exe
3636	chrome.exe
3636	chrome.exe
3636	chrome.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe
1660	Asshurt4-cracked.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	Installer.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4788	7zG.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
1900	7zG.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4528	7zG.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1660	Asshurt4-cracked.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 4984	4428	chrome.exe	90
PID 4428 wrote to memory of 4984	4428	chrome.exe	90
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 4204	4428	chrome.exe	91
PID 4428 wrote to memory of 2304	4428	chrome.exe	92
PID 4428 wrote to memory of 2304	4428	chrome.exe	92
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93
PID 4428 wrote to memory of 4160	4428	chrome.exe	93

C:\Users\Admin\AppData\Local\Temp\Script-ware\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Script-ware\Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaa780cc40,0x7ffaa780cc4c,0x7ffaa780cc58
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2104,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4532,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4552,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3476,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3276,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3516,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4328,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3196,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1124,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4040,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5496,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5452,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5508,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4644,i,6492171497005616343,11381494511878204712,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:4668

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2624

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap16320:88:7zEvent23065
1⤵
- Suspicious use of FindShellTrayWindow
PID:4788

C:\Users\Admin\Downloads\Script-ware\ScriptWare.exe
"C:\Users\Admin\Downloads\Script-ware\ScriptWare.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies system certificate store
PID:3896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 3212
  2⤵
  - Program crash
  PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3896 -ip 3896
1⤵
PID:2188

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Asshurt4-Cracked\" -ad -an -ai#7zMap22617:94:7zEvent24032
1⤵
- Suspicious use of FindShellTrayWindow
PID:1900

C:\Users\Admin\Downloads\Asshurt4-Cracked\Asshurt4-cracked.exe
"C:\Users\Admin\Downloads\Asshurt4-Cracked\Asshurt4-cracked.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\RaindropV2 (1)\" -ad -an -ai#7zMap25831:90:7zEvent22469
1⤵
- Suspicious use of FindShellTrayWindow
PID:4528

C:\Users\Admin\Downloads\RaindropV2 (1)\RaindropV2.exe
"C:\Users\Admin\Downloads\RaindropV2 (1)\RaindropV2.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Sirhurt\" -ad -an -ai#7zMap6156:76:7zEvent27003
1⤵
PID:3452

C:\Users\Admin\Downloads\Sirhurt\Sirhurt\SirHurt V4 Bootstrapper.exe
"C:\Users\Admin\Downloads\Sirhurt\Sirhurt\SirHurt V4 Bootstrapper.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2504

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Sirhurt\" -ad -an -ai#7zMap5625:76:7zEvent9741
1⤵
PID:556

C:\Users\Admin\Downloads\Sirhurt\Sirhurt\SirHurt V4_New.exe
"C:\Users\Admin\Downloads\Sirhurt\Sirhurt\SirHurt V4_New.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1920

C:\Users\Admin\Downloads\Sirhurt\Sirhurt\SirHurt V4.exe
"C:\Users\Admin\Downloads\Sirhurt\Sirhurt\SirHurt V4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 1568
  2⤵
  - Program crash
  PID:10732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 1568
  2⤵
  - Program crash
  PID:10800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3540 -ip 3540
1⤵
PID:10708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3540 -ip 3540
1⤵
PID:10780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 05b43441091b46761412a042fd464e200eb524637adf0e69a9bc605d4d806eba
MD5 41ca579c4b76cc36c4105a2fcbf9b309
SHA1 64b7a97036265fcd7efdb990d62d145e81f2f335
SHA512 1cd0dd5fd9245d2965ec0cac54e633ef0092ffb9ee2009b82a7fe73cc543fccdcce6c592d4a44d7e80c6d2c6add5a3ce70dd35303df2b85e338f2d3a5d47389c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 235cfc699e6893abfbcf34f10cf071bf4e116b42862be41d4f73f6ba41ec4ca4
MD5 3d1d149f99ea4f96f4aa7ab2fa529a15
SHA1 a917171a823ff75ded51499f98de9d995d9e1f04
SHA512 1e3c9a20fcbd8b7486ef8c78696bd1fb12948573806a8e8403b8c59a5fdfb2fd3be1950baed477804ef4be8c034e255b476cb53df9abc0bcd345c996268b64dd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8eca0edc93be5d0386d09bfd931429145da20f69a46fd5cf18a710cccf01906c
MD5 d4f449a2653852e9dd8af735ede38947
SHA1 9cb469063892c4db27ac7590e80bd30fc06c6dbb
SHA512 922705e73d9af0315ff5bd2295f64804019ad75b3dd10bd7d851f8f6a24c040fdcc9bd74304fd817b0b8e0d1a4fdd89fa961906d4123703fb600b7364a9e5ba1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a230012e9a0464b1214256782b797aa5d42ff1c18bed456bebac8b98099f176d
MD5 e4ab6c828b8a55d132c6d7a044cbe2f4
SHA1 30951d92af283efd5737dd272eb152a58f2131ce
SHA512 b1a9bbcbd9a2f1c1a49a99da0bf1986717cac0eb0a0aee3461769c6dc29a48d9c524762da57b669fd4d49d34c531a4d9a3e08a372300e44f3262f1932a0feec8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0afcb5ed840a886cb3a27a1494f6cef3f8f1cafc6fa1f7495045459d83b1a6a0
MD5 670366f0cf1e40803b7acc57d333ce75
SHA1 c13258fe00154517e5db2d145c76ff68a5ee0a9a
SHA512 3e3052e2d00ecd36c2cf1788770ee7d51cd87b3485935779d12522f29ab5287c14298622665427aba7810d90c132adedb67276be038e42118aa312182c634e3c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ea421e41eb897837705dfd6b739cb11c3c05d83fa3dae925e13c279c570ad042
MD5 c7f8bd78294899ac1d0898258bb79ebd
SHA1 f7081205a75800da0cc2096409c193ffea3f584f
SHA512 cf27bd7cabd6dd5d363ee4208ff8cef876822bbc0abdf3cc76a4d3082be25ba4a12ce67e4f5954f738ad4ef1e8cd3c17b769a6f61e7ffae19af5b03bd1bd3dde
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 354B
SHA256 29165f024969444607806ee51f2afda1527b85ea1b8e767b3bcc99b17fba6891
MD5 07e7887183c3bedf8c90a957c8b7e891
SHA1 9b740bc0872a80518af072727f1eb7dabb3062d3
SHA512 546596bdc7b05a0e575e0ab3cdbdca32b3b2e9c9458c937b19f9f63b013205769a9b8f87ded0cfcaa3c983fbe1635734cee122cba8fbd8e0f4a15a5d4a708243
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 05faaca615f370786b91894940483a2fe75ce483a8b38f47a241401752a46e7d
MD5 818995a809fa38ca62206041069b0588
SHA1 ece7d662d5f28be52b80de0a0a9fe66c2906578f
SHA512 d28b0faaa52cd82316459ac01c385b135a75ef9bb812b23a1fe05c5f1ba0953f6867b8728c32542b03062eef3c728f1e8685b00c38592787bbf7adf46c2e88de
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 f079dc97f6eb689a11834955131e30237f6a09b7bd8871f4e9da680c30cc0af5
MD5 0fbec89803815512eec9a5c016ccc505
SHA1 e7b82fcbd54722a96876b6eb56f14932102f7b71
SHA512 aa73d9ed90eb463c3dbf865fdbcc8a09203581147f1e0ad2c2de7805bb98bee0a9126d2822a937ef7baf5e71eda3ca1cb5d0f6f94cdcae27de78cba118fa6b36
SSDEEP 192:Kr2s2IPjbwejTHV+FRmeFtoPo6yIsnVdg4:Kr2mX7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 d821a2d40138adedf9f8c08a408487ad40f3d62e09b4e834e44bfba68b1ce6b7
MD5 0aa214564cfeb426ad2c32b02c25f51e
SHA1 dc39bf5389c843f5d8ab5e52f3d0765a3c6cd616
SHA512 5364ee8f15e6b0f8eb950b9dcb95eb747ed16846ce92c06ee0112edd70c45ded61c47d8199f34f0bfcea1612d56364e93725520f6e36de147afd0966afb67c5f
SSDEEP 192:Krrs2IPjbyteHTHV+FFQ+7seieFtoPo6yIsnVdg4:Krrm37Gzs284
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8ce9c4b2ff17132caa4efea40d97ff4700e6df38650425614efe2d2e14b2a0b0
MD5 06f270ebbc6275616c7a879648fb5c99
SHA1 5eb830b5118df32ebc09fd46b17e0e10f3b7c644
SHA512 1837f4c3961c67b9bc799dd910398003f3735ce1d72a5b228eea431452c738e75a6990570629f80e1ae9b47939608630cd03bd843373f7c9f0d82b4d225a314e
SSDEEP 192:Krrs2IPjbyZeHTHV+FH/6OeFtoPo6yIsnVdg4:KrrmT7Gf6f84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 30dc31f79d166fb8d1d41856d2bacbf457fc1eeb23b1de4772d375b355630617
MD5 6a65492223803cdcfbffc4ec9a9ac942
SHA1 2228ccd67a6a8e9e30cd96ce4edab7de93ac8928
SHA512 0f35fafc1003f9c563c7718d46628aaa3ca3fe6f174b386ceac25620caeaca46464a18542c732c10f943ab79cee16ca6beaa02a613c6e224d4fc2216d35946d3
SSDEEP 192:Kr2s2IPjbLejTHV+FRmeFtoPo6yIsnVdg4:Kr2my7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 dc43c1890ff730194234a92bd836faa0ab63a06b9f35b4dc45dc5f768ad96cc0
MD5 d12396a24f2dbd51ecc9b294869888d6
SHA1 9a72574ac0132b1cb885c21ffe68ceb2426a6390
SHA512 7284e4accf73cd2ed39fa6d3cf94202ebfbcdf8f8c4b2e2d54dba09dad3950f3e9121055cd185d3938c1b5471af618a9398a28e8f49ac9b8e0eed367a4f755f4
SSDEEP 192:Kr2s2IPjbGejTHV+FRmeFtoPo6yIsnVdg4:Kr2mp7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 f2d195c1f59f0c12c0498a078391b39c99255f3a8b0f148bfc0f03b31bff25e1
MD5 010cd556b4299418a46d642f9d04b1fe
SHA1 1002cd343c4d14fb2b236d7ed28b2a77d9601818
SHA512 766ea30a1c08dbbcb7460a957e917a8ff7d4c618f7749fcb05abafcdd3d8616fbfbfb7e6d0303e658e27a4c950897edb2523b20003c4822adb2abdeef79529c8
SSDEEP 192:Kr2s2IPjbxejTHV+FRmeFtoPo6yIsnVdg4:Kr2m87GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 79c0a9b724b5426bba5dbe8352798d8550371dc6900e88088907b4c022738c18
MD5 45978f721d9c715e9958dd042626a16c
SHA1 d89022b9a7c0adf0b9702f2d51e37605164524d4
SHA512 af0f02131dd7aaf2811c1301ae5dae595e744011232f4b18e165720362ef0413972eeb0d296f26d2ed480ecdb889f9ccc3d147d318e6bf905180dd4235beaef1
SSDEEP 192:Kr2s2IPjbEejTHV+FRmeFtoPo6yIsnVdg4:Kr2mj7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 a2f51db8701ca10cd61495c431dd202bf2ba3feddf63227a92baa39655d2a82a
MD5 e16dc483912fbdd22efdd81cd687d8c6
SHA1 9a087686f480786df8ae16a83472bfe949c02d30
SHA512 43ff6077e012ef9582d82d05be25f5d7aa8817e761e5cb8d0abcdba90108ce97bf8ad95961b4ae38c34fafd19d30bb907adb08884ea1cf0e05c833df418b5e41
SSDEEP 192:Kr2s2IPjbeejTHV+FRmeFtoPo6yIsnVdg4:Kr2mx7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 35077fd8c4e90c2b12acd38a876eb584b9febf053a4ae8a980af41faebe60290
MD5 e5f8b78e0fde14921dcb294ccd09bcf6
SHA1 962b31962b165727c7e555f2302e37dd05c4ce21
SHA512 9524f33c851f47db18f9aa3d7934d7cc522399e9b72e1a66419b82abc6e54c0272e3b427400df2b591798df43faabc75b4e426232746163c541167dba50c701c
SSDEEP 192:KrYs2IPjb/ejTHV+FRmeFtoPo6yIsnVdg4:KrYme7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 933b5d4a089f5628b270578d959d2827b46763a087ad6d8f953d94b84d0f1191
MD5 fde0f0c97b5038cdc1f0bf0ab1f33782
SHA1 888f49e6ada85db79ebe28075975879e98dba825
SHA512 9ff155c6ae9d2ff5f5bf1e4107b5a64b1b8d7fb02b3107026add1ea1c8bc3588ca35355cef3bd4889e951a1792c3f32fe14600d5148f2db410d5b2853c994bbe
SSDEEP 192:Kr2s2IPjuejTHV+FR5UeFjoPo6yIsnVdg4:Kr2A7GRt84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 74ea41e30597b6cd93fb15a11424323b961bdd398fea47bd1e6cbef153362421
MD5 d760c2dacd2914432a1cbdb29a1dbc97
SHA1 accc12d63eb01b3275f40c1d055211337299f75b
SHA512 88440ce7bbe7fd8dce91edbf7fa3867fd1ebe164db0b5c66ba2c889c2dd8a46f45adb858e3978a3a30b4d744835dd49d779caabae8e7038b9f7b891a1c821255
SSDEEP 192:Kr2s2IPjbZejTHV+FRmeFtoPo6yIsnVdg4:Kr2mU7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8f749e80ae191269afb09191b32e8e2fa47fa76123aed7e6f00ad2ba9a27404c
MD5 3e76dbe80b6b9a2a83498981b97b39f5
SHA1 c2b3a5ad5ca5d599a9eeee104d71a63497508e17
SHA512 ad41f35883904488f538e01696a6741ca9ec1475e1ada71d03713adb3172f78814b8f340e0e5a2c7400b885660011f1f732432619f6a243f960887ae620107f8
SSDEEP 192:Kr2s2IPjbZejTHV+FRmeFtoPo6yIsnVdg4:Kr2mU7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 34276ce128123a8fae4ce9999a34dd96a6d1d6ccc3ed858777a9624823d967c5
MD5 8d82386337b51a133aae0a71e7822945
SHA1 5342a70d293e1e6467bfcd256550e3e12f26033f
SHA512 521e326f93a8d3f963f3eabbf4b11eb1073172a010ee01f2c80947e2bce165e6fed41b37e531463964ca585356a39fb109d34d47f8cabdd8a5638c78141a7a6c
SSDEEP 192:KrYs2IPjbyDLeHTHV+F08kTeFtoPo6yIsnVdg4:KrYmw67Gvko84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 b82b6b2d1c2e2101fab32efec23273c1a80bf5083d2a4b20e32f1ac1cb7ad72c
MD5 5d117636c7e884c45595bf12c9be49be
SHA1 97ecc1c02a51a80f73bf3c70c95d62c3450dca3e
SHA512 89af227ade55a0855984c39e5d1de598c38cd25f3ba85973438b9188575f6e42409228077cb3c6a4bc45f1e3cd6e322ff7f5bb9287ac894ddeba780e9f90baa6
SSDEEP 192:Krrs2IPjbyFeHTHV+FFQ+7seieFtoPo6yIsnVdg4:Krrmr7Gzs284
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 4e1a98402db77a63d3c906a77f5155c8928f3efa9534c224b59cbdca1f9af435
MD5 b774af34c72c19fb03facace6f47812e
SHA1 fb3d61830fe41c7db205795f91c13174162efb8c
SHA512 d081419794cd461563da6133213a9b9f3eb4dae2bc91db3749b46d84be31dcabbc746397d311d89df2ff5b8d386e92438ad83b46c2755277517a1b24238a926c
SSDEEP 192:Krrs2IPjby1eHTHV+FkDbLu7TeFtoPo6yIsnVdg4:Krrmv7GYus84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8c022a4af22e299ffe61e45d7ddb67c182e07dd85ef4e9a6ae0f4603052aa48a
MD5 035ba84de6c676a4b68a4b0e34954a42
SHA1 885bf3096cc216b70dbbeffbcf345403f41559b1
SHA512 e9043c75eb8b5fc907198b7246ee4de6ca9de12bb5188f500153e7268c94506f3b90408c7a141ddce67dd01dbd2a48296034a95b1303595ca53b4c64207d2c11
SSDEEP 192:KrGs2IPjbyPeHTHV+FByi4eFtoPo6yIsnVdg4:KrGmJ7G4id84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8be5a30e93c96e9a74ce1e90d20f3b6155be2bff7410ccbd1cf92878265bbe20
MD5 b4dc062bcbdcf05e8684c7e33d845ef6
SHA1 5a895f8034132fbc9d055d309f0b701caa202cc6
SHA512 0b1a7ca48b31feb75b46faa212770925030a7ba50d9df336f6c76074f8faef9543b9d7df6032d7be0cce34a6622690eb26e337ac3c0526309fa5b52b167cf4e5
SSDEEP 192:KrGs2IPjby5eHTHV+FByi4eFtoPo6yIsnVdg4:KrGmz7G4id84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 57c1241ef3319d80fd417e83e68ef787e2c9a4c09b23cf949335f1f5acd63bbc
MD5 e9191a137761e83ce5998ba2a0e15297
SHA1 44e55e2e7d6e088f71019b5cc984ce94f2818f09
SHA512 84a2fbf4a75215904033663ba57de50d9be89a77a23ff3afedb091895012e9e2da29ba4e9c91d5537a864759047a697c385f241a93b175acd19afb4c9452988b
SSDEEP 192:KrGs2IPjby8eHTHV+FByi4eFtoPo6yIsnVdg4:KrGmw7G4id84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 2525e8a2bbdb65c28601278d0ebd41cdaf1dbb9ae2c6f4188137316f35344b7f
MD5 f1d5a2c57abacaf1c843bbe8d7a885e5
SHA1 4dc29345e7862b9958ca1d132edc71f1be9c8f77
SHA512 3ea0185d5760e3237135b2873222dcd08e8b50443fc95353fe78f252d639437bf4dd369ad0a9f7cf302b69af18394789882ae9ab887b1d4a285a5ac6eb1a0988
SSDEEP 192:KrGs2IPjbyQeHTHV+FByi4eFtoPo6yIsnVdg4:KrGmE7G4id84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 6829f577cb12309c7187a166427fb3c410685d3759814e6555e9d0d7e7533c83
MD5 9f38765ffbe12206e4e6e88b64695c1e
SHA1 27f9a523e7eab713bfbd7bdb21811457253d61ea
SHA512 218795ccb3e468f7b690dd598d1783631d33f65147f66da9cc3f2f9eda1139b5f71435e50fbed95b45e829a1fa63a5c3559697450cc89d02393c40260bf6b320
SSDEEP 192:KrGs2IPjbyeeHTHV+FByi4eFtoPo6yIsnVdg4:KrGmK7G4id84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 06c52c20f4ebf0366b3cab5b084fa87d28e8bb71be1b30275cb0cf6ec68396b4
MD5 5ed014176a386fe302a718d661999d93
SHA1 0f3f403846322b542c74644c0ecc171fb4cf0079
SHA512 604edecbaf9669cf6db3a18d5ed3a396779b9c3d1c9bafdc707bd0869104aa405202dee751ab1de3684eb13fdc7a08aecb81d882ee8e7d255bcc9fb9a4a37fff
SSDEEP 192:Kr2s2IPjYejTHV+FR5UeFjoPo6yIsnVdg4:Kr2G7GRt84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 05d0b5c68212fb9632da9a767937898eabff266f7c8b79abde4195026e744386
MD5 5c23d30d1116c4d4bfadcad3fbe50d67
SHA1 94f1d5d905302f38fa0e576308310b1e4d674747
SHA512 8b129c2179ff4319dbc3fb7682bbcfc70fd68660d90fdbbb86fd5784deaf6a09f632230fc14d941097d2532acae3a164b70906c0b0576833866b8f4c1ecd3292
SSDEEP 192:KrYs2IPjby3ejTHV+FRmeFtoPo6yIsnVdg4:KrYm17GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 4d053cb64210d80508aa83309353619296eec3555e689d2864a0d53a71a9ff72
MD5 e1d804d9451be29186252f83c0a65fcd
SHA1 80759d4c2c555d1cca29b097c08d31bd95919802
SHA512 a330678c615cecd50d6e4621bb596cac2db138683cae25322d0ce5db9029f53787898a3ed9d5f1e7dbdc5da0d4ccb70cdc882c7257cc3cef7afd82f7d9f3c923
SSDEEP 192:Kr2s2IPjbjejTHV+FRmeFtoPo6yIsnVdg4:Kr2ma7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 2bb56e1ceab6585b54e094703dc2d70a350ec25be6a31a1e12ce25a76b04ac53
MD5 4285d644eb4c583d562921f630c94220
SHA1 9f734732ce76b478d15865e5cb2e9405dc139028
SHA512 88dea758399e07be37134ef28aca48db88d32c49292ac79a626785ebf8bc59d7aa92e04778fa16c98f289c33c0fe456be08f481f02e5c333f1dc4b4890361322
SSDEEP 192:KrGs2IPjbyZeHTHV+FmJGgeFtoPo6yIsnVdg4:KrGm/7GQG184
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 5b0601c361a8460825d5dbc1a312e673254c8aeee595681c8b0d13715ea5fb2b
MD5 2a8dc39e236a5d0e5b92764e8d342f18
SHA1 359b304f59ec2f92971e4b9a42b4932efeb4e6af
SHA512 d9d0ea08143341734b6fd63a00c2617ca842081f0ddd74047e8a3d3ba4a92de8eaaf4da1fa0637b99f270963fd047c53c9c7dce828463ecabe7b0f80f28b5169
SSDEEP 192:KrYs2IPjbIejTHV+FRmeFtoPo6yIsnVdg4:KrYmf7GRn84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 47ac10bfce69967768b5c2f634b50bf25785ffecdd0af5c68605b4a2b61f53eb
MD5 b2e97d9768b9c55cd22132e0b5db3150
SHA1 f14194dc158bb881fb4b2a2b7c5552519158429c
SHA512 edf3c8e16b9400d002782845b63be841efb59a3c4c61316f841424c6278e9670568aed15ad35ed518da7aa522b4d29c1617b801ace46272517e7768e6950a46c
SSDEEP 192:Kr2s2IPjbDejTHV+FR2eFJoPo6yIsnVdg4:Kr2m67GRT84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 3e26f4e1aad0d83ec04b172147714af2ee2d85f44740459834e1ae396f62f7dc
MD5 130f8f0a6d5397968ea7b96aeb8ee09c
SHA1 8ea41dbca69d822f31fc553539902894a7f51629
SHA512 8a4b156943e74a272e3b84c03571fab5d1e38c645041518e1582b79462d24520d23e4d06a87fc620caa61a1c2dcb0461d1db5f335416f18f55c4efca486fa7ea
SSDEEP 384:jXtZ7pLhLc+eLOXkK1kXqKf/pUZNCgVLH2HfSrGrUDxHGYeYLK:jdZ7pLhLnQUkK1kXqKf/pUZNCgVLH2HX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f542145d-db07-4088-bc14-750f32138567.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f542145d-db07-4088-bc14-750f32138567.tmp
Size 9KB
SHA256 a586d59c84c5c7d168bdccb03a903ba7fafe11939d1efdf0331820e246f9ef9f
MD5 78bc6a790484c86defe525dc0a48ba9f
SHA1 30d7804033ca1031ee106bc2fe55f142810c6980
SHA512 69c6eb2de08bfe710435250d213a404c18b66156d5515fd4a920711d430901b8cc6760779442cce4e308c314cec06cb88416a795ed64b769f597ba357df80560
SSDEEP 192:KrGs2IPjbyheHTHV+FByi4eFtoPo6yIsnVdg4:KrGmf7G4id84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 207KB
SHA256 fbf101a6ed6e6555a219913b5d992d66fb9ffface61b143cfc825d00e99b1308
MD5 bc37df2f4b4260c09498e28cac9de9e3
SHA1 bd08d7019a37b89d1be9d036b6750618b58fab91
SHA512 7c1eaa09e79d38555553b0888e08b9284e6afb1d816b13fca553f584d5ab45ed31da95a11603987be99bf2fcfdcd7658ac3bbad3feffa90a7377ac37779bbdcc
SSDEEP 6144:zMNU4zMvFlEHDs+yf3BNgczkY5I58+h/m3S:zeRMGDsLBvwYi8+hWS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SciLexer.dll

Path C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll
Size 943KB
SHA256 08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d
MD5 2ff7acfa80647ee46cc3c0e446327108
SHA1 c994820d03af722c244b046d1ee0967f1b5bc478
SHA512 50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd
SSDEEP 24576:bY1+2o17X3i5aa5I6gs77y7yCxIOU5y0KFjV09OV:a+tDijO/kjCi80ijV0kV
MD5 SHA1 SHA512 SSDEEP

Submit Download

GunaDotNetRT.dll

Path C:\Users\Admin\AppData\Local\Temp\fe18e516-f12f-4073-bf13-52a839118bfb\GunaDotNetRT.dll
Size 136KB
SHA256 77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
MD5 9af5eb006bb0bab7f226272d82c896c7
SHA1 c2a5bb42a5f08f4dc821be374b700652262308f0
SHA512 7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
SSDEEP 3072:nIuwb3gn+bp4G6qepZn07UHGm2pM1g23mGpzqQ4AZ2Z34E:nIb3gn+bp45DGP923mGpzjcZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Asshurt4-Cracked.zip

Path C:\Users\Admin\Downloads\Asshurt4-Cracked.zip
Size 2.1MB
SHA256 307febcb3af48383a886d9b869346cc22c66f15395338d9700d678151361dc30
MD5 1f26ecb67b844a0e275436947058e990
SHA1 d28a24306779c88e0574c3d7287a24a0d8293d73
SHA512 b32a6d7d30fb1f11e59a78b49f460ba56e3a06de0cec3c24830317cc4237eb0b6b6bc39a55ea336b1fa75dd9d02061f8aeb82af36d1646215fbf584e277a0873
SSDEEP 49152:BsqSKApicqBjBXP4cXh/kewngiQvW2m7uwuVnY:hS9oLXP4cB7iQO2tDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Asshurt4-Cracked.zip.crdownload

Path C:\Users\Admin\Downloads\Asshurt4-Cracked.zip.crdownload
Size 1.3MB
SHA256 cc19ec1576d59e7456a4792cdf8b3a5ef38b0f0fce8acff23b2a1505d7dc3991
MD5 b97955367aa5900277bf8242eab51c84
SHA1 9c3ef40520dfdcb1d0477e28b17f574ad5ed2411
SHA512 8e57e63954a65f1675348c923e9048dca11d30686b3a490872a679ada3ee91f09c0d6e4c42195458460c4fe86b9497ffb0961912c3eaa3d6551c5255dcd34e73
SSDEEP 24576:dfpmhNqSKjApiTITeBE4ZJdXBalJuh4c1t575NNjOL1gD1qndIMt72HCTp:BsqSKApicqBjBXP4cXh/kewngi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Asshurt4-cracked.exe

Path C:\Users\Admin\Downloads\Asshurt4-Cracked\Asshurt4-cracked.exe
Size 4.9MB
SHA256 d7afb9f733b490d11fa1f2bbababaf9b1942b597c998763e4b7de17f3cea89b3
MD5 0f1eaa00f00c6fd1eac751085b45a10f
SHA1 5e0058313b65c64065c56747fa6e3b4175e39717
SHA512 cda4d061124b5e78ed6b9ee94fc292ef92a8e82108eb8ee3a0cf09e5700f58b9099e572cf290e398cf6ca7bfed95609ec34d6d107f5e4150114d6818b6e80afd
SSDEEP 98304:AKPnbrMpKcnbbM0KKKfnbrMZKcnbbMQ9K:AKPb4pKcbo0KKKfb4ZKcboaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

lua5.1.dll

Path C:\Users\Admin\Downloads\Asshurt4-Cracked\lua5.1.dll
Size 785KB
SHA256 b7511fe8e2864505c79bb8bd3413063ff884505b8fd43f62ccd669f1e2b93a3a
MD5 effd1a58e449ac3127539eb1597a2d9a
SHA1 ea3fe26ef445d88b8f5bbe4453df1c5e24e3b8fb
SHA512 6f316e48005cc14c6724abec2d631b907a85fdca60f3ccf53f0cc77741dd33a41b3e7335612e28284d2bca6164b8de2405d39b4322d3d3ae96a028af3fa20a56
SSDEEP 24576:cL0s5Oi2wM6sGewX6nE4wieAUTGOed6FubWshPGew:+g6sGewKEzNeXWsVGew
MD5 SHA1 SHA512 SSDEEP

Submit Download

RaindropV2 (1).zip

Path C:\Users\Admin\Downloads\RaindropV2 (1).zip
Size 755KB
SHA256 a2a60308d4ac2004e92e88c84354fb3f76a224bb86a6bc30aa997b07fe1a359a
MD5 2f8021d6fb758bcfc7d67d206a73a884
SHA1 e6108919fcdca24bfbc9d495acbfb1db4cc02f95
SHA512 19be49beb4756ba6dd739b35435a7d581152ea9a06d8be620698bbb489d8e849818361c67330139d44de6e2315eab14eba4f54ebc0ab8029a2d9bef9ec683ca2
SSDEEP 12288:nOdwamrh/oZztWe8X4mY6iyBuZGujbMnt0Rkv9wlHSmHdxll8ApnQd:2wa8ovW2mW6uZGuVymHdvZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

RaindropV2.exe

Path C:\Users\Admin\Downloads\RaindropV2 (1)\RaindropV2.exe
Size 802KB
SHA256 27489773c52fc03c20db4c39eb6947f306547da0c5e6117f0cbac84e0864fede
MD5 cb11d161e660d6eee4c9b88c90f9a49e
SHA1 277d89e925f13d350bc9eede8fbb9f911f20281a
SHA512 024ae691d4b4c91eb0df76824b0bdf4589c3b9be9332df5bb9d8285f8d8b1f31bad89b6501977250636fdf3539424619e724c14915235e9c5c74c8741df494ff
SSDEEP 12288:RdWakR97qZLtWY874iAUimBQZQu3rsn/YJ6b9ol54mHBLdlAA5MQX:rWaWqzW4i+uQZQuZGmHB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Script-WareV2.zip.crdownload

Path C:\Users\Admin\Downloads\Script-WareV2.zip.crdownload
Size 19.9MB
SHA256 c4812e37aaf60bb0c03ba37a5de10cdf37171202c1fd1396e692916377556447
MD5 df33376b6ec3248b62dd96d57f2afc9f
SHA1 f39cdee7d9e7a9b70f21261cacd566d161484a3e
SHA512 c53bdb4a19cc430e8f6b0b437f7f05fc6b3732ab97ad1d7b5fb806a532f98509d0d37e20a3cffefc3fc5675c827cd3ab59430bedcfbd8fe8aa8b9e77d39d7009
SSDEEP 393216:4d/QGhhDiUBhJu9ssqrwW1t3fHe8apZclR8fAEpjI8r59VwBdRWlU/q7mkDcwEt7:k/ZhDJBhJFsqkqfXEGdX1r9pdH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScriptWare.exe

Path C:\Users\Admin\Downloads\Script-ware\ScriptWare.exe
Size 14.1MB
SHA256 218f51111d95aff9ac48cdf3a0a9a2095acea67957d96bfb631de75a7a059ef8
MD5 b788cb6e8e50414193103a6f52833e45
SHA1 fcc02d922a2fb94d90f8b617e1b2b8e878af382b
SHA512 f693640db3f61d0583f7ac2a7a79956bfb0e22127e3a9659adabdf3bce1615b56361eff02c61b1e490d1a026f4748f48cb6997aba5c1fbac307f30b99b957855
SSDEEP 393216:ycFJi0bdAuKGFrHJ4W9pp/+vMogAuKGFrHJkRAPADY11kSc/zmjx:ti0bAWH1m6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sirhurt.zip

Path C:\Users\Admin\Downloads\Sirhurt.zip
Size 33.1MB
SHA256 34d367f28deac0ee5f4c41ccc414394262818430d6bbe82ac450c08ee0b683c5
MD5 6192142abbfab5d24207981f37d1b85c
SHA1 0dc7b32dc99b549117b5790acd6d1824e377f460
SHA512 121bf003d2c836ec82bc597e3a29c050a8b53c29769a48e793066b784d3b84188b8d2bfbe476d1c0d28038e82f2a4455bc6127542f4ddab498990f20143f05fc
SSDEEP 786432:IQE/ImUrAS5PoS8mWy94GgS6y0Fu5dPmASruSJ9e2rQzInbGhA:ISrAmPWnhjBrQdPmnT9e2rQknbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SirHurt V4 Bootstrapper.exe

Path C:\Users\Admin\Downloads\Sirhurt\Sirhurt\SirHurt V4 Bootstrapper.exe
Size 3.4MB
SHA256 1a75dbcfd8b465ec27738ce35103ae32814d9fe3bd7364940b955d58b75887a3
MD5 3282cbe6fd2811c4b7d57063e5a52bc1
SHA1 a0b62b03d1f8124dfc8ebd594b9a5db1b15da210
SHA512 d0bce9dee648c177e994c3157556b1af540703738dc8a1987e3381f58ded7ed8512e1ebdd13d8e1ec028fdeb964d500526bde58a3fd86e3a23dbded39c0fd721
SSDEEP 98304:VuqCRYZ9IcAkcGAFGfIUg6aqNNqLyJuG8Xqn5Q6fnFBRj:VuqCRsgkc+fIf6X8rfk66/t
MD5 SHA1 SHA512 SSDEEP

Submit Download

SirHurt V4.exe

Path C:\Users\Admin\Downloads\Sirhurt\Sirhurt\SirHurt V4.exe
Size 6.9MB
SHA256 fc226d5772a9f5a6b903f7ab365616e87ff3e8f6cb3233943e2bcb4aae0228ae
MD5 42a2cdfafab555d44f54d3edcb91a556
SHA1 d6a639cb206499067316b96e21d25d66faa335c4
SHA512 fca35ad591f7a81e12bf892ffe5eba8b977394ef30b4ebc627832c89c3ac81f6d190d05c2f98734d49a7ef4ebe64729457656ea8c91bc4a406082d692f2e98ba
SSDEEP 196608:u2JSLDQj+9L/RFINhEJHU50+w75ZfnEfoolcIHnnxWbE7LIu:vSoa97LjJ0o73fnho+sxWbE7LIu
MD5 SHA1 SHA512 SSDEEP

Submit Download

SirHurt V4_New.exe

Path C:\Users\Admin\Downloads\Sirhurt\Sirhurt\SirHurt V4_New.exe
Size 11.7MB
SHA256 781378bf758d9397231665873061d8a6c5bb952cffc25b446046c808a928b1ac
MD5 72c1a8274cff7e8ee76c3755d2194ba4
SHA1 27354c5877cb5c62a0c9a7dc7b28fb5cec979dca
SHA512 8862972e6cb400f44b1ebf7a2327d3caf9d8d75d437d47105847fbf42f591fa159fd279b6e2261027a796903bded7080a87b5a719f385b75d68e115116e915db
SSDEEP 196608:BJ15jGK7cOQn9lORl13pe8ImK8nF57+kTo0mJYJUiCFe27XJeBkSIjOpbf:BJzLcN2nDeUnr+Uo0mJCUle27UkbypD
MD5 SHA1 SHA512 SSDEEP

Submit Download

DebugData.txt

Path C:\Users\Admin\Downloads\Sirhurt\Sirhurt\bin\DebugData.txt
Size 14KB
SHA256 5c220782e5fa5fbfc7ae8e75a7c1fd04cafa8f1f1544942c00198a351b964f14
MD5 155791abd59cd42de2574da248090a9f
SHA1 c1329046e90726b42306e7da82de65132f6fbfd6
SHA512 1a5d46836aa41f274dae92637d80ed85e6367f41393bdea7a1a289f502452c2ed4b1e9f81f5f1063b2b3ab7ee571c2f29f49599e9037d51b5b98870217905fe3
SSDEEP 96:c90tmDTLov8tkSjsI+tKSrtIQKta2n2JfPMot86D4ZGvViUSBt87M/SB:Nt2TLntxjsI+tKSrtUtamStQBtTo
MD5 SHA1 SHA512 SSDEEP

Submit Download

DebugData.txt

Path C:\Users\Admin\Downloads\Sirhurt\Sirhurt\bin\DebugData.txt
Size 14KB
SHA256 ad20982980467dfe72e5ab5f3551309028c1133f14f7055a3de5f999216b20a0
MD5 03a240e979209664a5d7b4674831e64b
SHA1 3268b882138264b54e92d68ff7383aaecf9aabd8
SHA512 18a0af2702f0b1a0b743301f7b8f50789055dd302f1d43dc9514829396783e4386e8f6290187349a2153afa957f77783b67e2915643946946510bcb4a8c2f58d
SSDEEP 96:c90tmDTLov8tkSjsI+tKSrtIQKta2n2JfPMot86D4ZGvViUSBt87M/S+:Nt2TLntxjsI+tKSrtUtamStQBtTL
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\Downloads\Sirhurt\Sirhurt\bin\schemes\settings.ini
Size 731B
SHA256 35e269ee6086a5a0b407dd7ce92777ceecf5057e197468f81bfd4a537b542cf5
MD5 819e1e7006e078a24226aa966a4d6fe0
SHA1 fd87eba8f8249834b797110fd6b6b90be2d80982
SHA512 df7b79b8e152bec6994584efdca0f959dca069dd6e8f9509872d002b80be003f67fb2c61f6b5f639f7d80ff4e8d51d80971a83c13d240010724298ba53232a87
MD5 SHA1 SHA512

Submit Download

memory/1660-297-0x0000000000CE0000-0x00000000012BC000-memory.dmp

Download

memory/1920-586-0x0000000007BC0000-0x0000000007D14000-memory.dmp

Download

memory/1920-583-0x00000000061E0000-0x000000000629A000-memory.dmp

Download

memory/1920-588-0x0000000009560000-0x0000000009566000-memory.dmp

Download

memory/1920-589-0x0000000009590000-0x000000000981E000-memory.dmp

Download

memory/1920-590-0x0000000009840000-0x0000000009B94000-memory.dmp

Download

memory/1920-591-0x0000000009BF0000-0x0000000009BF6000-memory.dmp

Download

memory/1920-582-0x0000000006160000-0x00000000061C6000-memory.dmp

Download

memory/1920-587-0x0000000007D10000-0x0000000007D40000-memory.dmp

Download

memory/1920-584-0x00000000062A0000-0x00000000062AE000-memory.dmp

Download

memory/1920-585-0x0000000007A40000-0x0000000007A82000-memory.dmp

Download

memory/1920-581-0x0000000005EE0000-0x0000000005EEE000-memory.dmp

Download

memory/1920-580-0x00000000002D0000-0x00000000013DC000-memory.dmp

Download

memory/1920-579-0x00000000002D0000-0x00000000013DC000-memory.dmp

Download

memory/1920-715-0x00000000002D0000-0x00000000013DC000-memory.dmp

Download

memory/1920-575-0x00000000002D0000-0x00000000013DC000-memory.dmp

Download

memory/1920-792-0x00000000002D0000-0x00000000013DC000-memory.dmp

Download

memory/2504-510-0x0000000000A70000-0x000000000133E000-memory.dmp

Download

memory/2504-514-0x0000000000A70000-0x000000000133E000-memory.dmp

Download

memory/2504-509-0x0000000000A70000-0x000000000133E000-memory.dmp

Download

memory/2504-505-0x0000000000A70000-0x000000000133E000-memory.dmp

Download

memory/3400-4-0x00000000097C0000-0x00000000097C8000-memory.dmp

Download

memory/3400-1-0x0000000000850000-0x00000000009AC000-memory.dmp

Download

memory/3400-2-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/3400-0-0x000000007522E000-0x000000007522F000-memory.dmp

Download

memory/3400-3-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/3400-6-0x00000000097D0000-0x00000000097DE000-memory.dmp

Download

memory/3400-5-0x0000000009CC0000-0x0000000009CF8000-memory.dmp

Download

memory/3400-13-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/3400-11-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/3400-10-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/3400-9-0x000000007522E000-0x000000007522F000-memory.dmp

Download

memory/3400-8-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/3400-7-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/3540-862-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-822-0x0000000073C30000-0x0000000073CB9000-memory.dmp

Download

memory/3540-795-0x0000000000BD0000-0x0000000001804000-memory.dmp

Download

memory/3540-799-0x0000000000BD0000-0x0000000001804000-memory.dmp

Download

memory/3540-800-0x0000000000BD0000-0x0000000001804000-memory.dmp

Download

memory/3540-803-0x000000000A8A0000-0x000000000AA7C000-memory.dmp

Download

memory/3540-10749-0x00000000705B0000-0x00000000705E7000-memory.dmp

Download

memory/3540-10748-0x0000000000BD0000-0x0000000001804000-memory.dmp

Download

memory/3540-819-0x00000000705B0000-0x00000000705E7000-memory.dmp

Download

memory/3540-884-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-882-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-880-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-874-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-870-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-866-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-864-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-823-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-858-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-852-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-846-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-842-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-840-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-836-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-834-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-832-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-824-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-878-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-876-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-872-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-868-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-860-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-856-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-854-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-850-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-848-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-844-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-838-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-830-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-828-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3540-826-0x000000000A8A0000-0x000000000AA78000-memory.dmp

Download

memory/3896-151-0x00000000003B0000-0x00000000011D0000-memory.dmp

Download

memory/3896-154-0x0000000006000000-0x000000000600A000-memory.dmp

Download

memory/3896-153-0x0000000005B50000-0x0000000005BE2000-memory.dmp

Download

memory/3896-152-0x0000000006100000-0x00000000066A4000-memory.dmp

Download

memory/3896-155-0x00000000067B0000-0x00000000069A6000-memory.dmp

Download

memory/3896-170-0x000000000A2B0000-0x000000000A362000-memory.dmp

Download

memory/4480-390-0x0000000005360000-0x0000000005366000-memory.dmp

Download

memory/4480-389-0x0000000002D50000-0x0000000002D8E000-memory.dmp

Download

memory/4480-388-0x00000000075D0000-0x000000000766A000-memory.dmp

Download

memory/4480-387-0x00000000007E0000-0x00000000008B2000-memory.dmp

Download