Resubmissions
09/11/2024, 06:22
241109-g4wtpsslar609/11/2024, 02:58
241109-df8a2svpaw609/11/2024, 00:35
241109-axvjqstcpq609/11/2024, 00:33
241109-awmshatcmp6Analysis
- max time kernel
209s - max time network
210s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 02:58
Static task
static1
Behavioral task
behavioral1
Sample
my_furry_protogen___.msi
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
my_furry_protogen___.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
24 signatures
150 seconds
General
- Target my_furry_protogen___.msi
- Size 61.2MB
- Sample241109-df8a2svpaw
- SHA256 d33680d861d53ff3bb9f27807bd210adaa2931e44ecb1010d7b95b0aff70cd80
- MD5 af2166cd2f6e50902405cc669b85fe37
- SHA1 c995d3359ceac7ff6663ed0e08e6420dfe26a244
- SHA512 0da7e6e7afb819d71f80fd035ce4e874653326558fb222c45a70a6661db4dfb03fc815f4251eb5fed0f9269c89ac2ee8953d3e7ff8588d10fde532f98c068538
- SSDEEP 1572864:iFXQ0aiC/wNPiI+D4wxEew9RHVRhjaZx4PmmXY3YRU2RJ7DlC:yai+yKiw6PHfhjaZx8o3YRU2v7Dl
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DownloadHelperTray = "C:\\Users\\Admin\\AppData\\Local\\DownloadHelperTray\\DownloadHelperTray.exe" MsiExec.exe - Blocklisted process makes network request 7 IoCs
flow pid Process 6 4544 msiexec.exe 8 4544 msiexec.exe 10 4544 msiexec.exe 39 4644 msiexec.exe 41 4644 msiexec.exe 43 1572 MsiExec.exe 44 1572 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Videodownloader.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 27 IoCs
description ioc Process File created C:\Program Files (x86)\Videodownloader\Videodownloader\Downloader.exe msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\System.Net.Http.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\languagepack\de-DE.txt msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\Bilder\128x128-rot.ico msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\Installer.InstallState MsiExec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\SQLite.Interop.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\languagepack\en-US.txt msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\Videodownloader.exe msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\WriteableBitmapEx.Wpf.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\Installer.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\ffprobe.exe msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\UserManagement.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\Bilder\128x128-grun.ico msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\WpfAnimatedGif.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\System.Data.SQLite.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\System.Data.SQLite.Linq.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\wshom.ocx msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\ColorPickerWPF.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\ffmpeg.exe msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\Updater.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\System.Data.SQLite.EF6.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\Interop.IWshRuntimeLibrary.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\x86\SQLite.Interop.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\Videodownloader.exe.config msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\x64\SQLite.Interop.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\Videodownloader\Videodownloader\DotNetZip.dll msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{FEEBD562-6B8E-457A-9133-89B8C1E14443} msiexec.exe File opened for modification C:\Windows\Installer\MSI219E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI25E5.tmp msiexec.exe File created C:\Windows\Installer\e581b84.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI29DE.tmp msiexec.exe File created C:\Windows\Installer\e581b82.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1F9A.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\e581b82.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI1EBE.tmp msiexec.exe - Executes dropped EXE 4 IoCs
pid Process 4152 Videodownloader.exe 4896 DownloadHelperTray.exe 524 yt-dlp.exe 2460 yt-dlp.exe - Loads dropped DLL 64 IoCs
pid Process 1388 MsiExec.exe 1388 MsiExec.exe 1572 MsiExec.exe 1572 MsiExec.exe 1572 MsiExec.exe 1572 MsiExec.exe 1572 MsiExec.exe 1572 MsiExec.exe 1572 MsiExec.exe 1572 MsiExec.exe 1572 MsiExec.exe 1572 MsiExec.exe 4152 Videodownloader.exe 4152 Videodownloader.exe 4152 Videodownloader.exe 4152 Videodownloader.exe 4152 Videodownloader.exe 4152 Videodownloader.exe 4896 DownloadHelperTray.exe 4896 DownloadHelperTray.exe 4896 DownloadHelperTray.exe 4896 DownloadHelperTray.exe 4896 DownloadHelperTray.exe 4896 DownloadHelperTray.exe 4896 DownloadHelperTray.exe 4152 Videodownloader.exe 4152 Videodownloader.exe 4152 Videodownloader.exe 4152 Videodownloader.exe 4152 Videodownloader.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe 2460 yt-dlp.exe - Detects Pyinstaller 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023ca6-288.dat pyinstaller - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4544 msiexec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Videodownloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DownloadHelperTray.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4544 cmd.exe 5076 PING.EXE - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a47b29fbd6f9c3720000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a47b29fb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a47b29fb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da47b29fb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a47b29fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 5076 PING.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4152 Videodownloader.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4896 DownloadHelperTray.exe 4896 DownloadHelperTray.exe 4152 Videodownloader.exe 4152 Videodownloader.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4544 msiexec.exe Token: SeIncreaseQuotaPrivilege 4544 msiexec.exe Token: SeSecurityPrivilege 4644 msiexec.exe Token: SeCreateTokenPrivilege 4544 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4544 msiexec.exe Token: SeLockMemoryPrivilege 4544 msiexec.exe Token: SeIncreaseQuotaPrivilege 4544 msiexec.exe Token: SeMachineAccountPrivilege 4544 msiexec.exe Token: SeTcbPrivilege 4544 msiexec.exe Token: SeSecurityPrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeLoadDriverPrivilege 4544 msiexec.exe Token: SeSystemProfilePrivilege 4544 msiexec.exe Token: SeSystemtimePrivilege 4544 msiexec.exe Token: SeProfSingleProcessPrivilege 4544 msiexec.exe Token: SeIncBasePriorityPrivilege 4544 msiexec.exe Token: SeCreatePagefilePrivilege 4544 msiexec.exe Token: SeCreatePermanentPrivilege 4544 msiexec.exe Token: SeBackupPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeShutdownPrivilege 4544 msiexec.exe Token: SeDebugPrivilege 4544 msiexec.exe Token: SeAuditPrivilege 4544 msiexec.exe Token: SeSystemEnvironmentPrivilege 4544 msiexec.exe Token: SeChangeNotifyPrivilege 4544 msiexec.exe Token: SeRemoteShutdownPrivilege 4544 msiexec.exe Token: SeUndockPrivilege 4544 msiexec.exe Token: SeSyncAgentPrivilege 4544 msiexec.exe Token: SeEnableDelegationPrivilege 4544 msiexec.exe Token: SeManageVolumePrivilege 4544 msiexec.exe Token: SeImpersonatePrivilege 4544 msiexec.exe Token: SeCreateGlobalPrivilege 4544 msiexec.exe Token: SeCreateTokenPrivilege 4544 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4544 msiexec.exe Token: SeLockMemoryPrivilege 4544 msiexec.exe Token: SeIncreaseQuotaPrivilege 4544 msiexec.exe Token: SeMachineAccountPrivilege 4544 msiexec.exe Token: SeTcbPrivilege 4544 msiexec.exe Token: SeSecurityPrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeLoadDriverPrivilege 4544 msiexec.exe Token: SeSystemProfilePrivilege 4544 msiexec.exe Token: SeSystemtimePrivilege 4544 msiexec.exe Token: SeProfSingleProcessPrivilege 4544 msiexec.exe Token: SeIncBasePriorityPrivilege 4544 msiexec.exe Token: SeCreatePagefilePrivilege 4544 msiexec.exe Token: SeCreatePermanentPrivilege 4544 msiexec.exe Token: SeBackupPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeShutdownPrivilege 4544 msiexec.exe Token: SeDebugPrivilege 4544 msiexec.exe Token: SeAuditPrivilege 4544 msiexec.exe Token: SeSystemEnvironmentPrivilege 4544 msiexec.exe Token: SeChangeNotifyPrivilege 4544 msiexec.exe Token: SeRemoteShutdownPrivilege 4544 msiexec.exe Token: SeUndockPrivilege 4544 msiexec.exe Token: SeSyncAgentPrivilege 4544 msiexec.exe Token: SeEnableDelegationPrivilege 4544 msiexec.exe Token: SeManageVolumePrivilege 4544 msiexec.exe Token: SeImpersonatePrivilege 4544 msiexec.exe Token: SeCreateGlobalPrivilege 4544 msiexec.exe Token: SeCreateTokenPrivilege 4544 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4544 msiexec.exe Token: SeLockMemoryPrivilege 4544 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4544 msiexec.exe 4544 msiexec.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4644 wrote to memory of 1388 4644 msiexec.exe 88 PID 4644 wrote to memory of 1388 4644 msiexec.exe 88 PID 4644 wrote to memory of 1388 4644 msiexec.exe 88 PID 4644 wrote to memory of 476 4644 msiexec.exe 109 PID 4644 wrote to memory of 476 4644 msiexec.exe 109 PID 4644 wrote to memory of 1572 4644 msiexec.exe 112 PID 4644 wrote to memory of 1572 4644 msiexec.exe 112 PID 4644 wrote to memory of 1572 4644 msiexec.exe 112 PID 4152 wrote to memory of 4896 4152 Videodownloader.exe 121 PID 4152 wrote to memory of 4896 4152 Videodownloader.exe 121 PID 4152 wrote to memory of 4896 4152 Videodownloader.exe 121 PID 4152 wrote to memory of 524 4152 Videodownloader.exe 124 PID 4152 wrote to memory of 524 4152 Videodownloader.exe 124 PID 524 wrote to memory of 2460 524 yt-dlp.exe 126 PID 524 wrote to memory of 2460 524 yt-dlp.exe 126 PID 2460 wrote to memory of 8 2460 yt-dlp.exe 127 PID 2460 wrote to memory of 8 2460 yt-dlp.exe 127 PID 2460 wrote to memory of 4032 2460 yt-dlp.exe 128 PID 2460 wrote to memory of 4032 2460 yt-dlp.exe 128 PID 2460 wrote to memory of 2492 2460 yt-dlp.exe 130 PID 2460 wrote to memory of 2492 2460 yt-dlp.exe 130 PID 2460 wrote to memory of 4544 2460 yt-dlp.exe 131 PID 2460 wrote to memory of 4544 2460 yt-dlp.exe 131 PID 4544 wrote to memory of 5076 4544 cmd.exe 132 PID 4544 wrote to memory of 5076 4544 cmd.exe 132 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\my_furry_protogen___.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4544
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 539B5B33237A279F92FB490F1B339FD0 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1388
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:476
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4A15F854B6E1B601449A108387EE7F942⤵
- Adds Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1572
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:464
-
C:\Program Files (x86)\Videodownloader\Videodownloader\Videodownloader.exe"C:\Program Files (x86)\Videodownloader\Videodownloader\Videodownloader.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\DownloadHelperTray\DownloadHelperTray.exe"C:\Users\Admin\AppData\Local\DownloadHelperTray\DownloadHelperTray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4896
-
-
C:\Users\Admin\AppData\Roaming\Videodownloader\yt-dlp.exe"C:\Users\Admin\AppData\Roaming\Videodownloader\yt-dlp.exe" -U --no-check-certificate2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Roaming\Videodownloader\yt-dlp.exe"C:\Users\Admin\AppData\Roaming\Videodownloader\yt-dlp.exe" -U --no-check-certificate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵PID:8
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵PID:4032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵PID:2492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping 127.0.0.1 -n 5 -w 1000 & del /F "C:\Users\Admin\AppData\Roaming\Videodownloader\yt-dlp.exe.old""4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 5 -w 10005⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5076
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
4Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e581b83.rbs
- Size 141KB
- SHA256 1447dbd52179776b7a3834f7934845c7dc126d78ebdb39733d9057294c31015e
- MD5 7f2dffb0e9b66b40f80c2463725bbf4d
- SHA1 642bf02787453743e9789da16399186acda5d87b
- SHA512 810f1c35ceef0745d75fee01ac6dcc255ce18aed721eff2e1d94e5f335953b47a07a8341664286848216482d45b9e178a0c84d566974ddd1feed64083e3adbe1
- SSDEEP 3072:xpjMiSeJDdM13JlC2TySowKhX/bh9vCzUJtwWSPSFNGChSX0vi1R2iwUtuMzusgt:xpjMiSeJDdM13JlC2TySowKhX/bh9vCm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Videodownloader\Videodownloader\Installer.dll
- Size 17KB
- SHA256 8bd6ac81553af9910e43dc50b4ff2b83f4b6fb0c5d520871597a8bc97b7bb20d
- MD5 ddd810bf7a682cd931f6b307d505e8c5
- SHA1 8065736a13fc5baf3e3e665ab52246cfe4f3cd10
- SHA512 bd379d491bd370bb0dd192226d4641dd4d2446e9db6dd2d64b3f3c5631180c7c1371297e7d6a63a048659a6c3ef18f631011e21d59bcff512d8b217ac77e31b3
- SSDEEP 384:HvkUe3eFnniFPqhiqauRJ8+mqR56jRxdd+z:Wuw9uzopFW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Videodownloader\Videodownloader\Newtonsoft.Json.dll
- Size 683KB
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Videodownloader\Videodownloader\System.Data.SQLite.dll
- Size 345KB
- SHA256 04b94962d9d5cee5805ad5e9e40d3b6c4c1c69c25945ee31ac056977f0e25f1f
- MD5 a797167303390af2e4477db7f97828a3
- SHA1 7df04a18bdc069a9de78f31674937454e99b6b24
- SHA512 1d1a19794a964aa69166c9c5968378aa6c1e73a4b7a48a268f6adb63225b513ea2bc5cd421c7a5bdc9fe054a48423664918b6793f0e046ec0145b180228397f8
- SSDEEP 6144:Bb3dSwBhcd0Sh4BSdOQ2KsZ63KOUDi/FNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJr:7ITtFNFaFeFOFwcGF6cmFWc0FWc8cIc8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Videodownloader\Videodownloader\Updater.dll
- Size 95KB
- SHA256 84ffd69b18d250344ea553b943c09b4d0f9f514333fbcc76c07be01696af433a
- MD5 35e970798abed9b17a4d8b33a06e99e2
- SHA1 4c4ff27b386f0c7e3aa7710910c9242524d26e5f
- SHA512 2ba7dfbaaf6698929249d260c531edadb11ee3dc089cabaccdf4e83daf68c4bc34ccc34b2e65e5bfd7eaa1ce9950171302f4a59f86bb0ce1e8b2e74a13da7669
- SSDEEP 1536:N0j2IowPAZftK7jJoM4ni/H0CfggNx89urCN7ombgx/OP0:WqIowUftKSM4nw3hDnrCNEQgx/OP0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Videodownloader\Videodownloader\UserManagement.dll
- Size 150KB
- SHA256 2bab2fd8cd77087d81aa1820bc1c70b6122848ac5200e45f82faab47c4bf2c9f
- MD5 08f66923eada1853aa3c7216da2aac96
- SHA1 f6e90ffbeebcd3bbe9a6f01743507f0b0ce037a7
- SHA512 f58a82957d89c0fe279414709837bc428f18d14f4d52815673ec2242e1a585aeefc5ea7b1a946aeebf07edfff05db24c1f32adea2bacf2a5de6bf5a1a2ca970a
- SSDEEP 3072:0YOu88vdS745I5unUe2JfEjt75erfwTyelsp9BbYMmAMOcd:f9TlS74ysU/CjtFergqVmX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Videodownloader\Videodownloader\Videodownloader.exe
- Size 2.8MB
- SHA256 4235adb0bca98cc755547566e9fe0e7b503ab0c548a873f001fe359858a73715
- MD5 21c178de01e0bf4382922000bf0197a4
- SHA1 ed201b39db9c81ef526431ecb41a58eca5fb2bf6
- SHA512 4a09a8ac47d25dc38c017f1d5ce52d7afd1d5f904fc1e495fcc12c16fdd396659aadfa2e9e633ffae3b420b52041ca399310475e40d0b4b1b4b33676f636415e
- SSDEEP 49152:0FEwi/uXSbdF0WcWJD0tQiBH2e3ZX5q29LhCRFE2XamoIEbDGfOsLlunbA:06/uCbdF02JNe3Zp7FCRFE+amGyfJAnc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Videodownloader\Videodownloader\Videodownloader.exe.config
- Size 67KB
- SHA256 6d07185e8e5e356808f2dddbd7874fc2ecdc45d7c9cf4dd8760b66feb2abb8ee
- MD5 379d31925bf00f7b6993ce77f6cd1f89
- SHA1 3730bbc8baa1b2d4b1979de7bd5d73ce9f9fca62
- SHA512 20a6fd87aa2384219e5b39db7286dac6e6d7e67485beffff7c10fe22603c1915f5907873f73647bf49637ca2267eca4e2c9f53e16197502113cc7573fd7b0f57
- SSDEEP 384:TX27Z777FML7z7nmwSQCUkMqo7t99UJ9AQE8Nyy1o41p+20neWE1nzLW8QIUTTT8:9jhfqo7D+gQuchR2DDjS70N+HQfR6J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Videodownloader\Videodownloader\languagepack\de-DE.txt
- Size 14KB
- SHA256 0be112fe6d07507007c8eb2325b16a5240c30a6bc1ad56690024a8fce587a60c
- MD5 608c0c32a6a5ddae72db60812fd78a8c
- SHA1 c491ba78cea4e0b8fd0132e4793d5aa561383922
- SHA512 5772a12b0b31eeec88a3574592ba131930d9034bc315b1f5567efe8edfec5a0943f8416c6c4b500fbe0b7023ae349eb070942bf1b26cd56606dc1f72aabd71ba
- SSDEEP 384:Poc0LtLS7Fvc7wdgFFTaQR4d0eXk/kF8QEIextF:PocWL6U7wdgFFTtR4dI/kKrF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Videodownloader\Videodownloader\languagepack\en-US.txt
- Size 13KB
- SHA256 2fa38ea90ac9427e8113d4f4c368ce5c34385d4ee08428a5cf41d96755ed09bd
- MD5 44126b6d0dbd96b07531e4e26a107a5d
- SHA1 dbc5ec1d7ff39807f0de6bab0e99988054ce8769
- SHA512 da4fe173d2474e58d00abaedd654eaa61cfd63e3801f492704046949e5ffb285410c42da4301bc6261eac661f623ed025c4f0dff6ff218f73695dcd8a46adcdd
- SSDEEP 384:PoQ1YktLExByE7Cl9GDVBb03Q72ruz6so/htdR9/k:PoQ1YoLSByE7rZKrg6hdk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60B3F7207DEB992031C120EB71F562CD
- Size 4KB
- SHA256 54f08bfd73dd3477610059c4a1d92723e698def0efa7ad4661584a51d9aab79b
- MD5 94bf0bf032ce32469dd74f4f1f5320e6
- SHA1 86bff704a2f82816f346a6a374250f35743de3b0
- SHA512 ac62c42bfe02a35739dfed5df012bb3ef1f7bdbde1f4d9dce9448812bb6d25891dbacc2591e859f644c95151bdb7179f4f8e355b81a2a38ca7afce4980a79901
- SSDEEP 96:fQykCtZOcZf96rfV2mWcZPihyY96dpe6xiEY3XtMqS2DUQzeQl8ihzk5+A:IykgZ19cfV2mWcwhyw16xiEutMqp4QTm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_D21903E2722B551F252C717985D24037
- Size 1KB
- SHA256 4174cf1e7f4782e58680d2af40148932bf8efa740f5e48544ce95fa8d26b7ba0
- MD5 7e6a4125934a973d96f8c78f8bb138b7
- SHA1 3b935d84cdd5a5b82fe1a639fb3aac807df05ac8
- SHA512 b609f873d6d6279defc8038e970fa33539394a6a503ffb16e692d7b1ba0a7d3ff21e1d92a5994bed5ca141bfbd19a542cf5efa989aea0e440999e9bf86927848
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF8D319B9741B9E1EBE906AACEA5CBBA_905B5724CEECF7C47BDE629AC2B6F135
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60B3F7207DEB992031C120EB71F562CD
- Size 222B
- SHA256 7d02386bdf36bac413613e56b7eda03f81426874f0f1c9261fbeee98cf75d4e4
- MD5 4f77fa1357515c755f6ac3d6c8dc24a0
- SHA1 6bb0df22f4ae138c6d3fc314a2069138a3960a45
- SHA512 6fef632b00e569a2ae54533383d3c8c866e393a1b6e75072de3881d53ade3d72a5250c52983926bdbaa912f9bad1918865b156df593e74f22b6f76914a1b7bcb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60B3F7207DEB992031C120EB71F562CD
- Size 222B
- SHA256 32a7f1d70fada84bcb42361b6bdcf32771bcb273c1954d7a530b92c38bf6726d
- MD5 2f5e9b9073b71089d06bb282d783ee81
- SHA1 a778222ae63f121c1b4899dd3c8e8e78ddd453cb
- SHA512 2548219f292966dfa50cddc8bb51f127d0a5c435ccd927d94d342a73da1374e8534575b0c4b483ed8e243657c44e8fbc318a2958fb53e99a1b02b56b39a70afd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_D21903E2722B551F252C717985D24037
- Size 498B
- SHA256 cc13fdc3aaff51906f4d675467b441e65339e4826d526b0ffcbda3b1d273811e
- MD5 c9f59d6a43f08e93f8790a83c44065ee
- SHA1 46ce88208fbb20c849477a035f118747cce0e8d6
- SHA512 d496a0047e0b91cf0802f28b7040caed6cf6cb21fae4aa0690a119bd51a01f90616b7dc84b939ea10b0ce58140abd76d424748089baed0cb74c117ff84337222
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF8D319B9741B9E1EBE906AACEA5CBBA_905B5724CEECF7C47BDE629AC2B6F135
- Size 444B
- SHA256 32b4bfb0440393acb7fdcb261a1c934216669f48ed042d6c549bb1f51515d389
- MD5 83cfe25f3d304acc72741f480041a54b
- SHA1 5e0a18cfecce4c0d5598c09e7f88d42525abfe9e
- SHA512 8e988174b6d76688073f008637249218696fd893ccee88538e92aff0e44ac7ea4587b75dfa22f510f0746fd857497296d9ce8a28f048f628e25c1936748203f1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF8D319B9741B9E1EBE906AACEA5CBBA_905B5724CEECF7C47BDE629AC2B6F135
- Size 444B
- SHA256 c5eb0eac8f611a386b6605990e7cf01752df493d6eb71114ddb041b48d789e2c
- MD5 084b65866f4c8dc02ec6ce7524acaed1
- SHA1 972c62b9be47eff430bba092b3ce7ba34ba3fc0b
- SHA512 8cdef8a9e0ab76437ef6326e91a133182af58338b0e6932061926973986d7037835f5ababbb3b80bbbfcfbf851ae1cb125a9413441abfd2bc3b822b727fac1eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\DownloadHelperTray\CookieDecrypt.dll
- Size 9KB
- SHA256 21f41f20fe355d1313d5309456094d90155b8fcb05efdc4ba8c25f1737878969
- MD5 7c2ef701098979d9336f206d36065c1f
- SHA1 dd7640125efcf90c17850cbbbcfa74ad9e127863
- SHA512 59b2fd79dbafbeb096b5631aeafcc4c551293109128aded74d85ad8e64dd3302a8f8cf9fc3374955b63d6d82441472cd2103bb4e38af6bfa2ba645a81c9cc4a5
- SSDEEP 96:qGj5rjcuv7gVusuzboTn9xjuCTGjMa2P8K3dN6PKJB6hRxDv71emV0K1p+sf:qGj5rjcuv7OQAuCTGQaG8K3dN23emU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\DownloadHelperTray\DownloadHelperTray.exe
- Size 143KB
- SHA256 15c01f65d8db757a98402a97b0eb9d6261b98042d22fceed3407316ee32e7bb5
- MD5 72248e24644abcdc01b3effe0f876b1a
- SHA1 4c6ed0d58bfb8fa6cfa8f8c82e9472935a2b9b3f
- SHA512 4ee30f267c5e12acc82a0025f48e5f63d2cedce4cf890e532d969b3ba9a0ea3d2dd7d46c464a33910214e53f5a1feaafde4d893d85a7483dd76f17d89423557f
- SSDEEP 3072:oukXia3t2YekT0qFULgkvEQkOwwY7XP04:oX3thAVD4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\DownloadHelperTray\config.conf
- Size 199B
- SHA256 450ff8537ea8b6df8427474e1e55adf22b9ef35226d51c04f423084afe29da0e
- MD5 7b9fbd1f384c197b0b2d7c601e06b5da
- SHA1 162785adc77ddc42b8af7de0fc8b3dd362cd0ec4
- SHA512 c3f73d8a16d4cbed507092a38e2761de05b0aee0ce59579386928510e4aca74f4212c4085deac974669c42e41f5a0188b4ed64a3440cbec74758023d2b1f1d42
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\DownloadHelperTray\db.sqlite
- Size 96KB
- SHA256 72c93bb5f025e474f2589e61724b5995e3d8bcb24304e37fde6247a1658e0465
- MD5 8df97305146de25aa7402b29912a8ecc
- SHA1 64ea273eb86cc665b28de137ffc202e12238ecd8
- SHA512 52ab24ce42814dc777512b25eee85d78d0542db8ab931058254526edb99d3883c8710925b97f5fd98e0aba83127a2de38a0af0964a0dae3e46716b398f36905f
- SSDEEP 24:TL4P1kwIrnLbXYFpFNYd+6UwcQ8ri5fBods98FA1V+WEmzEhvS232mNVpP965Rab:T8PawkLLopFsU1+BoNWUWMS6rh9WT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\DownloadHelperTray\h.db
- Size 124KB
- SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
- MD5 9618e15b04a4ddb39ed6c496575f6f95
- SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
- SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
- SSDEEP 96:hBWU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:hBl+bDo3irhnyTpvVj3XBBE3u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\DownloadHelperTray\x86\SQLite.Interop.dll
- Size 1.2MB
- SHA256 aafca999c2493c667e3021ea0aba01170635ab1aa147fe764cd50abac85943c9
- MD5 5f001a1b09175d75165039b433ce17ba
- SHA1 09ea420ebe54f2b7fc43aca8fb2f906cd3b8febf
- SHA512 9b9de4791415826867a61f6efee2d3d08d17fc79de660a4a73100a676fca6347325b0609610672cb42baf5a8962dd84eb3b103d7f72a50a58dcb68f1265191ad
- SSDEEP 24576:fTvTI7dZjHWU6XWsdgCt/BhRoFBajCMmjHc+rvHpHypVBR0bnB9T:fI7HHlp64vlRA+0pVkbBB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CFG1F89.tmp
- Size 152B
- SHA256 b839cdd1c3f55651cd4d0e54a679bce5ac60ed7618a7b74bfc8ef8ca311e53ed
- MD5 68675e0d405c8c76102802fa624eb895
- SHA1 f8cf5e4a678b4574365057ff91019adeb2f9d4a0
- SHA512 c712c1bc97c9b7282262622367f399c18dd73156acd09c80d151a92c78d4119af9101bf902678b3fe767e9cc9fff95b6aafb858d179c7ff7d2721d1e9171cc3d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSID10B.tmp
- Size 285KB
- SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
- MD5 b77a2a2768b9cc78a71bbffb9812b978
- SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
- SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
- SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Videodownloader\Videodownloader.exe_Url_t0cu3g0lfwuyba52ak2hasjqz2jvrav2\1.1.8.0\sfhknhaf.newcfg
- Size 489B
- SHA256 f2db54a5473ad3fe06fc5d2bd4a32d58fe461f29dea7dffa9fd9022017ddcef2
- MD5 d8df09be131b33440ac80dfd76640581
- SHA1 82fae51bbe24c7873657290ba9f6be4c2341a9e1
- SHA512 2c08122c7854f888a98a95b348bb6ac7d74408ba24857fa0843c523f5d0d0bbde786fc42a6f2337ae37fb34cd29ba2aef6ffc604117682ce57e51ddd7410e4d4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Videodownloader\Videodownloader.exe_Url_t0cu3g0lfwuyba52ak2hasjqz2jvrav2\1.1.8.0\user.config
- Size 367B
- SHA256 0c385277267d7dd41175b7b1da24768a0444b7175b6028083f3f912514e672fe
- MD5 a69a43444cd60109c3fa0bcda7ddd6ac
- SHA1 d33b266ca1a3dfa338381a665ed6895b01527143
- SHA512 006befba1e8ad797c9b2ac040500562ce77e9e4032e56a2262ce5874f2627490b7487ae3ec64265dcbd10822f1b14bcd13467efd4d61553c129a1a4eb93ec7a2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Videodownloader\Videodownloader.exe_Url_t0cu3g0lfwuyba52ak2hasjqz2jvrav2\1.1.8.0\user.config
- Size 38KB
- SHA256 5cb946b6d0108a0ee0472f6c5d98532fd22deaa1804cb8cef95a0b4cd64cd287
- MD5 86acd38c14577cb0ada31ddd81200f00
- SHA1 e43eb0b2311185baeb05d2490481eb9bc7075f30
- SHA512 c5e73b29d3173932b5094f712f1a5fa0adae33f72648782fa190c3718b2c8d870b3a6835d566fa3b48801150460d196a148566755b54fcec314fc4aecf4a5653
- SSDEEP 384:1x52tUn64Tzii+SjrYVpUytdRrAtiWlngt:wW64TeEOW2t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Videodownloader\database.sqlite
- Size 16KB
- SHA256 2013852866d4af469bb425226437fd374f94b501bdde0e970f7114e550c0c88f
- MD5 15217f1314580163716aaa50d6e464e1
- SHA1 0d8daa81904854afe4d42cf1d680a843876fc5f5
- SHA512 a4b7d310aff9ce5daecd6c8aa6036ae9e09709404109af644d64012357dfbe0e44c8886c89047482585f33aabdb1db22ccd9693d609b4cc341d1cc01a96d95e4
- SSDEEP 384:icxPHCGFd4xPHCGFdDxPHCGFd/xPHCGFdr:i1gZ1+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{FEEBD562-6B8E-457A-9133-89B8C1E14443}\_036F6082C1540B3CEA7165.exe
- Size 116KB
- SHA256 a6d8e710e5f7f47feec4e91200ff1ce134517cd8db11088c12fa0998cfb3d0e3
- MD5 9ea5503d25adc3a165328b58ccd49b11
- SHA1 b72948be2a4b425aad366930e35c16147d41a89d
- SHA512 f588337b793c61ffbd493a6b5d3452f88abf9f7e56470b41533c3059a1dca91520980b0a40ae74f2255635334b06fab48cced48df73f6211eea208c45090dda3
- SSDEEP 3072:kqTuO7SEPM+0b6H77jo7vdQiHBCOfi1BYCy7L0:kOuaPW+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Videodownloader\yt-dlp.exe
- Size 13.1MB
- SHA256 2ff706a386a6890d4fd6871609e99248402959b149781feaeb41fede1c5efea1
- MD5 64aa1a129f2ad1e7dfb0b823c2f99e3b
- SHA1 adf872bcb1755ccb3e1d273e9bbe145540ac897d
- SHA512 887fe29ae72c3650971a23788a1d6a3acd8181650c154e7ab03cad981c3cc93575241b962650a254cd07eec3dcd03fc1af0397d1896794b99b9ec0ba36435a15
- SSDEEP 393216:Mup/2CjOCEDLJ83a109XdwWUUsVzIfOENwakjEqID:7/2CjOCEDtEaMtw4l5Nwakj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI25E5.tmp
- Size 114KB
- SHA256 4f10c0bd8d22e8215b02f092279abf7bb148cb1497207ec2ebab32662009b2ac
- MD5 fe01d395c4b85df8c426fc9620120ba8
- SHA1 23348d42947a64efa5209b30e9b8a6264f4a990a
- SHA512 d255211adb5fbf5cda875ad138abb064a7deedbed28f4e862df4fea962f84437c92a53dd18ed6d2098d0d9415d4a5ca80e39e9bc91b4382b01714d23f29615ea
- SSDEEP 1536:dS8CWyksWMcdM4Bpjr+UsgtFmVrrXL1MgbIurgnOMolQbm8DhIGo0Uqc3:dS8SgMA+jVrrb1MMBnMolULDhImc3
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 5811fe98f13747d0e27bbdad95d421955bfc46617f16f5d4037253f99e40147e
- MD5 55e738983c5aa26588b464d8480603cd
- SHA1 fa8f2b4dfe8b2a6b9fa0313bb23e241a043fd9b2
- SHA512 8090074b7966668e17c977ce1ae52c2304e1c3533742e4c5b313fbb3ef82b97cc52a4764f14a524597f9e9302a996f16316c8e79f72dcde552c78e6fd4de7bdc
- SSDEEP 24576:9Zxm+1aydoO/vvTL5WKu/Gq+bjZBC1sCGsWdI1rFSkqbetT5YP1JichBrZ:nX
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{fb297ba4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fcaa4c29-ae51-4718-852d-cb96194b78d6}_OnDiskSnapshotProp
- Size 6KB
- SHA256 254c8e39e0b570dbd6e9d2e301b16b3a8137de6cd86fc8d98a511c2a2c4492ca
- MD5 5e6fac29cd3410cc61ce233659e044bd
- SHA1 44bc388105db931da33fe6bfb8043de7c2aea950
- SHA512 097e243ad7cf9a2cb9e50feb37d79388ce28712f2027345c01846508b9c49a8126eedb07cbea2d8c293fae7ab3b48a015bbc729d6462d2259d43b34c464a2439
- SSDEEP 96:Fcn3wu4wDD84LTHzbOHXOHBlBRQs8Sc9XE56tOSVQpu:qAIb++lVm
- MD5 SHA1 SHA512 SSDEEP