babuk | 79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe
Size

12.0MB
MD5

59d018958d77ee68568eac6250a4224e
SHA1

a5ac1b794b33da74b7d587b04394721f7aa96d0f
SHA256

79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac
SHA512

5f285f3920463646a77487c9e0b1c46ebe950f779fafb524d6064aa280ba84c3119cd19c2b88f3011e20a7f7b70a1341103d42baca28f1781d8670bca8737881
SSDEEP

393216:VobaG+ZUoC9EYeWJ8taL/d2otNCk2rszUXS:VMaG+Z7C9M+RJ2ontkXS

Score

10^/10

babuk defense_evasion discovery execution impact pyinstaller ransomware

Malware Config

Signatures

Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
ransomware babuk
Babuk family
babuk
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 3 IoCs

Processes:

valorant-skin-cli.exee_win.exevalorant-skin-cli.exe

pid process

2392 valorant-skin-cli.exe
2360 e_win.exe
3056 valorant-skin-cli.exe

pid	process
2392	valorant-skin-cli.exe
2360	e_win.exe
3056	valorant-skin-cli.exe

Loads dropped DLL 41 IoCs

Processes:

79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exevalorant-skin-cli.exevalorant-skin-cli.exe

pid	process
1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe
2540
1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe
1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe
2392	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e_win.exe

description	ioc	process
File opened (read-only)	\??\N:	e_win.exe
File opened (read-only)	\??\M:	e_win.exe
File opened (read-only)	\??\Q:	e_win.exe
File opened (read-only)	\??\Y:	e_win.exe
File opened (read-only)	\??\L:	e_win.exe
File opened (read-only)	\??\X:	e_win.exe
File opened (read-only)	\??\E:	e_win.exe
File opened (read-only)	\??\J:	e_win.exe
File opened (read-only)	\??\Z:	e_win.exe
File opened (read-only)	\??\S:	e_win.exe
File opened (read-only)	\??\G:	e_win.exe
File opened (read-only)	\??\V:	e_win.exe
File opened (read-only)	\??\W:	e_win.exe
File opened (read-only)	\??\T:	e_win.exe
File opened (read-only)	\??\P:	e_win.exe
File opened (read-only)	\??\O:	e_win.exe
File opened (read-only)	\??\A:	e_win.exe
File opened (read-only)	\??\H:	e_win.exe
File opened (read-only)	\??\K:	e_win.exe
File opened (read-only)	\??\B:	e_win.exe
File opened (read-only)	\??\R:	e_win.exe
File opened (read-only)	\??\U:	e_win.exe
File opened (read-only)	\??\I:	e_win.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\valorant-skin-cli.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

e_win.exe79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe

Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exe

pid process

1692 vssadmin.exe
1512 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

e_win.exevalorant-skin-cli.exe

pid process

2360 e_win.exe
3056 valorant-skin-cli.exe
3056 valorant-skin-cli.exe
3056 valorant-skin-cli.exe
3056 valorant-skin-cli.exe

pid	process
1692	vssadmin.exe
1512	vssadmin.exe

pid	process
2360	e_win.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe
3056	valorant-skin-cli.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

vssvc.exevalorant-skin-cli.exe

description	pid	process
Token: SeBackupPrivilege	2128	vssvc.exe
Token: SeRestorePrivilege	2128	vssvc.exe
Token: SeAuditPrivilege	2128	vssvc.exe
Token: 35	3056	valorant-skin-cli.exe
Token: SeDebugPrivilege	3056	valorant-skin-cli.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exee_win.execmd.exevalorant-skin-cli.execmd.exe

description	pid	process	target process
PID 1728 wrote to memory of 2392	1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe	valorant-skin-cli.exe
PID 1728 wrote to memory of 2392	1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe	valorant-skin-cli.exe
PID 1728 wrote to memory of 2392	1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe	valorant-skin-cli.exe
PID 1728 wrote to memory of 2392	1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe	valorant-skin-cli.exe
PID 1728 wrote to memory of 2360	1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe	e_win.exe
PID 1728 wrote to memory of 2360	1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe	e_win.exe
PID 1728 wrote to memory of 2360	1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe	e_win.exe
PID 1728 wrote to memory of 2360	1728	79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe	e_win.exe
PID 2360 wrote to memory of 2304	2360	e_win.exe	cmd.exe
PID 2360 wrote to memory of 2304	2360	e_win.exe	cmd.exe
PID 2360 wrote to memory of 2304	2360	e_win.exe	cmd.exe
PID 2360 wrote to memory of 2304	2360	e_win.exe	cmd.exe
PID 2304 wrote to memory of 1692	2304	cmd.exe	vssadmin.exe
PID 2304 wrote to memory of 1692	2304	cmd.exe	vssadmin.exe
PID 2304 wrote to memory of 1692	2304	cmd.exe	vssadmin.exe
PID 2392 wrote to memory of 3056	2392	valorant-skin-cli.exe	valorant-skin-cli.exe
PID 2392 wrote to memory of 3056	2392	valorant-skin-cli.exe	valorant-skin-cli.exe
PID 2392 wrote to memory of 3056	2392	valorant-skin-cli.exe	valorant-skin-cli.exe
PID 2360 wrote to memory of 904	2360	e_win.exe	cmd.exe
PID 2360 wrote to memory of 904	2360	e_win.exe	cmd.exe
PID 2360 wrote to memory of 904	2360	e_win.exe	cmd.exe
PID 2360 wrote to memory of 904	2360	e_win.exe	cmd.exe
PID 904 wrote to memory of 1512	904	cmd.exe	vssadmin.exe
PID 904 wrote to memory of 1512	904	cmd.exe	vssadmin.exe
PID 904 wrote to memory of 1512	904	cmd.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe
"C:\Users\Admin\AppData\Local\Temp\79a67070f0fbff66cb39f3dadd3e3565b1b1b98ed9e079562aabd90d10ad75ac.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\valorant-skin-cli.exe
  "C:\Users\Admin\AppData\Local\Temp\valorant-skin-cli.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\valorant-skin-cli.exe
    "C:\Users\Admin\AppData\Local\Temp\valorant-skin-cli.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\Users\Admin\AppData\Local\Temp\e_win.exe
  "C:\Users\Admin\AppData\Local\Temp\e_win.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1692
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\How To Restore Your Files.txt

Filesize
259B

MD5
f026fb213f419a400ba83e1a69d26472

SHA1
821f1318d077065fe1a3fe2075f053f1191d5739

SHA256
b87c7d852c60b34e5986e2d41fb4f644df11f7350ef2272ad58a469e476d2bc1

SHA512
6929aa4dccef21718625513ab21c9e39599969d6350dadfa00747cc8bde302d2d7158df845686f1e607b2b05126697263982f6ab61e189781117c9329176e50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\VCRUNTIME140.dll

Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\_ctypes.pyd

Filesize
131KB

MD5
2787764fe3056f37c79a3fc79e620172

SHA1
a64d1a047ba644d0588dc4288b74925ed72e6ed4

SHA256
41c593c960f3f89b1e1629c6b7bd6171fe306168f816bef02027332a263de117

SHA512
1dc5bb470be558c643a3f68e23423697384bc547b1192cd398dff640e28f7df85563bc87643cdcde9b8b4f880f272e13a673a018ae251e100bd99790f993afa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-core-file-l1-2-0.dll

Filesize
8KB

MD5
01ee88f70ab6520a54a8c9ba237bc75e

SHA1
9e297804c4b0e19390c73977a7fcf1c6ec917d66

SHA256
15a13bc680239ddb7e5dda53bdfbd166d89ae314e5034ac7594b50114da1abbc

SHA512
36567fe144ec3713df806b9bd3997eda642bd7e210be3ee17f7c141ec8a70e10dba250655e3d437b7b9fef63e6be57da1dbcb8de3160bd579a8351052a968db3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-core-file-l2-1-0.dll

Filesize
8KB

MD5
fb6af9a40d30fa8d970217ace57704b7

SHA1
980ba27123f0de37db2a516dd6daa29eae6a060c

SHA256
dce4df960ccb0414674a6e7d4c51cde8cdd4346a2080d6a2a01ed6a6afbd52a9

SHA512
1219cc811729057330cd89602110732ea6ca86784f8373f597eabb5e2474d07cd3f11d76c147e4b9a494fef2cb25ee580400a0b93635802804c0ecb1e5e074e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-core-localization-l1-2-0.dll

Filesize
11KB

MD5
82672372ae7c6c15a709f214c020c3ee

SHA1
6a138add2652f9fadda95c64abca90a9e8f61e09

SHA256
cb54f828fcb2cffced2d11e69652ceeef44ff991c924c082c7d6f35666404466

SHA512
cf2a8026d7997197aeb24800760d0ce04c6c349215fe80e446e8ac22e9f341a561db43b508a39143aff63b04d5917a97c9213b1bba0eb0289d38cbb5d70e9c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
9KB

MD5
694c036c691378974ee4edec8f8128dc

SHA1
9e4c8d7620b63321f701ff5317fe487e33e531c1

SHA256
c73b5d6f28360fa69b44a39e81c93e03f6ff455eae0790c20c6ca692d88a2392

SHA512
9a54d33dfac01eb0f58b4dc28f17c5d81af089e1282e92fe9626460043c31dd289c6cc8ee5e9a2c061933f0e3cd3e3b702fb907ebd7ec19cdf71270a8f47f1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-core-timezone-l1-1-0.dll

Filesize
9KB

MD5
f1d3c2607da086de92b866c9a9226b06

SHA1
1e2200341c069848e5cd77bd566feea4312f2fcf

SHA256
963153542df92d87608dac4449b7408b9822646e2401aff02888d70a8f0f8f13

SHA512
5359fb8c1ca49f8bde4d20b0db2453f18a8a852f6bf29f5d6f206fc8b6840bc03d4e8fc056903ad37bb700a763ac40b8efa42557bb6a2f23c6c6b3f51ae09695

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-convert-l1-1-0.dll

Filesize
12KB

MD5
1db439853df4c6307fb1ee3f431f566d

SHA1
ea8fe6c8be191ad97901706feebe1500e4a58cd5

SHA256
11103a3021f0bebf7cae7dd5d94679dc08b65230f2af6f01a88685451631222e

SHA512
7db2560dedb1a22545705ad86b808e05f609442cd40682a75853c15e8008ebaf0ccecb9f9a502ca6dd86f279e66bff78a5e5c2c40ebe4d7ac0b0ebe5866524b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-environment-l1-1-0.dll

Filesize
9KB

MD5
ebf7690dedc60eab504bbd49eea2c64c

SHA1
674ce62839c64a330fcc324268b880085ce4a0d3

SHA256
acc4da89be6d453e86a997a31888f75c18acfc1935106d7f487f7feaa0449f75

SHA512
520eefcec868e3d560ce2eb3b1f5895a4786d8fe310a25f2803d3f60c1cb10088941c8cc8202b9b82e0e5238ff8285222a58b215fd3740d86db5575e611f95a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-heap-l1-1-0.dll

Filesize
9KB

MD5
24adddc22cdd6483549606f7bb690f1d

SHA1
f024f3ced67bdd00d929c34be0291beee797f010

SHA256
4d786427eba567a8eee77cd5b9e4f673e82933a63e2c9a65e705361b8e5b9719

SHA512
1109949da627d0e9beb71d0a1f5a40c5553c6d018a340592b0a2be6a2b097733ec61b32a40cae4c420f7e2bd28b19dd731e117dfc76049f06cd8be603f568a06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-locale-l1-1-0.dll

Filesize
9KB

MD5
9791dcf9b94fa69e90fe4c378ff8e6a9

SHA1
46fe3e66d050c84b23d3365300ad624347ef2c56

SHA256
dcfc46f5bca1bca6d018ea9a28bf5d9005430f3a28b89befdf5223ca736c7f1c

SHA512
e2dfed325c77b45a2571264f128fb050422cedc1421ef107f6e32e7fe29223c7c955f14ecc8e4f74bcb724747be660ff6e519af95cdf4c6574258b35a3efabdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-process-l1-1-0.dll

Filesize
9KB

MD5
49ad1cc2fb76d24f18739c9b5c3f1465

SHA1
d552d73348359a06ff888edf7f90876bfa866d6c

SHA256
461fc76107217e340075e36df70ba32b1f5d80d1484bc27e91e80530ee770916

SHA512
c575ef3ca7b10b3eed5a45873dae2b94e5462b288eef995097e4d4ae5d71ace750a277cee8e49b7f0a050f3e0a9f5f0d84151ed0f591e9f0ca3675c67eac1e21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
13KB

MD5
c287d972884de0bed3b6f28523b8f4f9

SHA1
443d19e57c6e488d60569e64150e1f0b83785b1e

SHA256
d40b6bd5c99d4149952e1afdab1f0f5b88f37b681e3a5c4fa943439f5b73091c

SHA512
4aec134fa59ef17cf807409dc562ddab0d14f8adf7c347ad179c443c30a4c28b63a245923a6ca6205373628b15fb7551fb0d953a834357b9412189e863ceb3cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\base_library.zip

Filesize
759KB

MD5
5cb31103b8c5e6ceaaa78e4f3f961e2d

SHA1
cb14e1205c62cc3e8e808259f51731864724c541

SHA256
eff3e9c4b1a960c3cdc4f3a85d416b93c4d34ba1f76f3008eaba369f7fafeecd

SHA512
42b2776e7c20919805594d4fc1d6446eeecc27a60154577568fdb04fc811250cc5410dd1afdf25c61e22c8ef3f4f77670b01e586317b810a3365a877b5f6bdb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\libcrypto-1_1.dll

Filesize
3.2MB

MD5
bf83f8ad60cb9db462ce62c73208a30d

SHA1
f1bc7dbc1e5b00426a51878719196d78981674c4

SHA256
012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d

SHA512
ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\libssl-1_1.dll

Filesize
670KB

MD5
fe1f3632af98e7b7a2799e3973ba03cf

SHA1
353c7382e2de3ccdd2a4911e9e158e7c78648496

SHA256
1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b

SHA512
a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\python37.dll

Filesize
3.6MB

MD5
c4e99d7375888d873d2478769a8d844c

SHA1
881e42ad9b7da068ee7a6d133484f9d39519ca7e

SHA256
12f26beb439ddf8d56e7544b06a0675d5da6670c02f8f9cede7aad1de71eb116

SHA512
a5b79a919f15cda2c295c8da923ffe5dd30408376e459669e4e376b9d4d504d43671518d7085352bb90c4ce4efc6d81c91ac6cedbdaa896f916d80f7346a695b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\select.pyd

Filesize
26KB

MD5
39b7c056bca546778690b9922315f9ff

SHA1
5f62169c8de1f72db601d30b37d157478723859b

SHA256
9514b4c40c35396b1952a8acf805e993a3875b37370f44ef36ed33c7151412ef

SHA512
229538131d83299ea90652818c99972c1ee692c070e7fea9599420c99dd8ae75fb2367e9509aad23984fe0a8d21221a59bd57493b5cd1d6c7391c3c55d714e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23922\ucrtbase.dll

Filesize
983KB

MD5
e3cbcb26ee85737e70ce55d498fcaa38

SHA1
8dcdcf5e8d9b621a149163cc3f12d01fde1ef4ac

SHA256
8ab85c80c5d9ad3618fd86aa45a878bb5a5d7e449528c317a8239c33876c75b5

SHA512
eb85a84f0d7e4f65ab67869e56b68f8da72a570b9b2fd0ee28e9d3ea9a80b4d35352261213b0e26d9d7592e750a0870e7b62df69e948bc060b0bfe6cea9fb12d

Download Submit
C:\Users\Admin\AppData\Local\Temp\e_win.exe

Filesize
79KB

MD5
2298d910b2d34e870e0f561eda4dcfc6

SHA1
078b2cace5161e34aaaaeba6bfbe3f6259651f34

SHA256
bb845cf9c1674452a995f58b3971c04fd67a0a8d256288e58cb4454bb80a5efe

SHA512
6465216a71c116321a6e7d9e1746247cfe1c29a5897422f13ed55cfb3a0daa42ba673a7cc308bf5440c6bf5fb084d065a6b4aab84c11ca1d81fdf23c09cbfe33

Download Submit
C:\Users\Admin\AppData\Roaming\valorant-skin-cli\config.json

Filesize
297B

MD5
570b1fdf399f507290125437e06b77e6

SHA1
660c6cdd4d6a257e7219f970a73c7a81d7509adc

SHA256
2d33a0d437b652881cf68883f1fe44f779e17c13ef32348b3d224890d9779b7e

SHA512
9414c42919e718da6e5e1648feeb9398a51b759e0d4ad51cafeeea0f1180a32d15fb4528711cd26234adc197e552e0c21715eb360cc041c2d47105dd6516b4b6

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23922\_socket.pyd

Filesize
74KB

MD5
10cd16bb63862536570c717ffc453da4

SHA1
b3ef50d7ac4652b5c35f1d86a0130fb43dd5a669

SHA256
e002a1bd6fba44681d557b64d439585dba9820226e1c3da5a62628bbaa930ae3

SHA512
55ee581c4005901661efaf9aad6ea39b2b2e265579539d464d62e4209638567b3b9fdd945d0bed0a1047f977d374a5707a970c621ca289077e2d6c5aeca491b1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23922\_ssl.pyd

Filesize
121KB

MD5
8b5af5ac31b6bde9023a4adc3e7f0ce1

SHA1
c5d7eaaed9be784227a0854bfb8a983058410a35

SHA256
7040d3712f31b7d11882ce8c907452fa725678b646b900f6868f43ab3e4ddab6

SHA512
499aa2321a2e5492c700513d63cf08fc12d3a430a5e9f5d865279919f6d7b74385b6767bbee63616f84b52d02070b16b2d4c3921163c42864f33e7b5331b1444

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-conio-l1-1-0.dll

Filesize
9KB

MD5
0e18c3109ae41bd4225f69ce1dbb763b

SHA1
745ec3be2b03b17f21cd74fe14dd96b94389553e

SHA256
5db1bf8cef972a3aa377bbdf418232a308d1767ab2f4e4d1c83619c4fd5c7ec2

SHA512
1fd8bac395cf49f6c18a73e7d135163f5677cd1a4b0b44790a3b737424c616b4e53dfd781840ff4cbb46b4bb8df1b2b7533bcba52d9f2e25400f4a644da48d88

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
10KB

MD5
e9129bb3ae28607029494b937c2074eb

SHA1
24b3262825b4e23641a5d27faf15afac19d7b91c

SHA256
7c0e3ba24d208c5fdadc57da903f730a9503a736520d988474b008f5d3a99735

SHA512
7a920a033e1b74b4434f3f5b0b0428cbd0396c5b5c036b01aeea42f53048941b494cb0bf1d0e1cdc478271f69b9b9ef96fdf79ddecf60e85c1ffb91a340c33ae

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-math-l1-1-0.dll

Filesize
17KB

MD5
31e61bd8a4f92a42944303105b9e801d

SHA1
028032d7f9a39b5739b32075ea023a3eea5e6792

SHA256
570736fb7e93e6bb234101c7e81e9690b721ea700c70c9fc2fa37de687957a5c

SHA512
696aaa0be03742cf526e8b60c5423fcbb8cc02f1de057d9e874931b19273166a8a4589e93dfaf5473407ddd3267e06e36996bad4a0ef1bd7a978aed00386f7a9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
14KB

MD5
559d8b3dbf2ea442269dfd2531455c28

SHA1
ae17518eeab8cd532af5cb2563ef54f72f6d4425

SHA256
82a4b13b461d6d268015805294008bf62d9cab4e2b81fb6900fedc10554b3764

SHA512
12d51b0888cd992888b010c91ecbced694ba72319c0d875c7b8033765e400ee3db1847e9f2b74030b7d8da5599069cacf2f11e97d7f7f448ecf8e4e64302a875

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-string-l1-1-0.dll

Filesize
14KB

MD5
f378627ae6b8f533a1c71433fdf42200

SHA1
6ef4849b82d2bdb355a67ab69e52d2dcf28d5664

SHA256
82c29fc85fbdcf7a170764d481ed302f410d759c7b846e51dc4e6780bb65975a

SHA512
d76f4ac7a79ae33799445f61263186922ba64aa3d567ce4c0d1e17194322d35e81057a33029f7571c547fdb867be63424d87fcbf6562e6132c58bddf7bd310a2

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-time-l1-1-0.dll

Filesize
11KB

MD5
8b5e2346f72a484c44897ae6f26bdc12

SHA1
452b3b95f5d6054d88b1da054fd57a69a1f4eb8c

SHA256
d78910f3226f7ec4617c75c543a7917498c8007cce563cbcb245c3e316a9de22

SHA512
4a4015c8dd6fce6878b1bd689443bd3fc16259302a10e6523e2aca201b4ddcb50e93b6ac839dbdf168beed93ec146c864796344a842a569be8adf4d32b427cb0

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI23922\api-ms-win-crt-utility-l1-1-0.dll

Filesize
9KB

MD5
eb44dcb02484e81c880e6b1927875290

SHA1
f5179be7ff257c75937ad1be915d53cb60a43358

SHA256
8c307236035515b2071ee41ffca7ffcb66e45d6ed0602b3459d6d414cc73bcf7

SHA512
0406373e51598f1a89fd382ee94f168784dade1f7adc145e8ac898e22a7e395fa559e1cdd9165492454a6dc154f7e36c1f7fa056847e3f9b6e87fe122d9757d9

Download Submit
\Users\Admin\AppData\Local\Temp\valorant-skin-cli.exe

Filesize
11.8MB

MD5
618f14f157f325c42d4ee192d218e704

SHA1
d7889120eeeb8bab7fc45e0391afdffcae4d681a

SHA256
f19ea07dc1e91fc2a19bffad3e0e7a0b3b76d05cc617bae40a43289691b9a190

SHA512
fe8d79303670d593670c32b804ebcfe905f0ce2f85e346e6972ec95591bd66b3b77def5657f7bbae49310df1b4e94897722c3035721463da77ebdaa5b66d4ee6

Download Submit
memory/1728-15-0x0000000000400000-0x0000000001009000-memory.dmp

Filesize
12.0MB

Download